moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-21 23:58:49 -05:00
Code Issues Releases Wiki Activity

curl: detect and bail out early on parameter integer overflows

Browse Source 
Make the number parser aware of the maximum limit curl accepts for a
value and return an error immediately if larger, instead of running an
integer overflow later.

Fixes #1730
Closes #1736
This commit is contained in:
Daniel Stenberg 2017-08-06 20:10:40 +02:00
parent 453e7a7a03
commit 5c7455fe76
5 changed files with 36 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/tool_getparam.c
View File

@ -545,7 +545,8 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
GetStr(&config->oauth_bearer, nextarg);
break;
case 'c': /* connect-timeout */
err = str2udouble(&config->connecttimeout, nextarg);
err = str2udouble(&config->connecttimeout, nextarg,
LONG_MAX/1000);
if(err)
return err;
break;
@ -1047,7 +1048,7 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
return err;
break;
case 'R': /* --expect100-timeout */
err = str2udouble(&config->expect100timeout, nextarg);
err = str2udouble(&config->expect100timeout, nextarg, LONG_MAX/1000);
if(err)
return err;
break;
@ -1713,7 +1714,7 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
break;
case 'm':
/* specified max time */
err = str2udouble(&config->timeout, nextarg);
err = str2udouble(&config->timeout, nextarg, LONG_MAX/1000);
if(err)
return err;
break;

1
src/tool_getparam.h
View File

@ -41,6 +41,7 @@ typedef enum {
PARAM_NO_MEM,
PARAM_NEXT_OPERATION,
PARAM_NO_PREFIX,
PARAM_NUMBER_TOO_LARGE,
PARAM_LAST
} ParameterError;

2
src/tool_helpers.c
View File

@ -64,6 +64,8 @@ const char *param2text(int res)
return "out of memory";
case PARAM_NO_PREFIX:
return "the given option can't be reversed with a --no- prefix";
case PARAM_NUMBER_TOO_LARGE:
return "too large number";
default:
return "unknown error";
}

35
src/tool_paramhlp.c
View File

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -164,7 +164,11 @@ ParameterError str2num(long *val, const char *str)
{
if(str) {
char *endptr;
long num = strtol(str, &endptr, 10);
long num;
errno = 0;
num = strtol(str, &endptr, 10);
if(errno == ERANGE)
return PARAM_NUMBER_TOO_LARGE;
if((endptr != str) && (endptr == str + strlen(str))) {
*val = num;
return PARAM_OK; /* Ok */
@ -197,16 +201,27 @@ ParameterError str2unum(long *val, const char *str)
* Parse the string and write the double in the given address. Return PARAM_OK
* on success, otherwise a parameter specific error enum.
*
* The 'max' argument is the maximum value allowed, as the numbers are often
* multiplied when later used.
*
* Since this function gets called with the 'nextarg' pointer from within the
* getparameter a lot, we must check it for NULL before accessing the str
* data.
*/
ParameterError str2double(double *val, const char *str)
static ParameterError str2double(double *val, const char *str, long max)
{
if(str) {
char *endptr;
double num = strtod(str, &endptr);
double num;
errno = 0;
num = strtod(str, &endptr);
if(errno == ERANGE)
return PARAM_NUMBER_TOO_LARGE;
if((long)num > max) {
/* too large */
return PARAM_NUMBER_TOO_LARGE;
}
if((endptr != str) && (endptr == str + strlen(str))) {
*val = num;
return PARAM_OK; /* Ok */
@ -219,14 +234,17 @@ ParameterError str2double(double *val, const char *str)
* Parse the string and write the double in the given address. Return PARAM_OK
* on success, otherwise a parameter error enum. ONLY ACCEPTS POSITIVE NUMBERS!
*
* The 'max' argument is the maximum value allowed, as the numbers are often
* multiplied when later used.
*
* Since this function gets called with the 'nextarg' pointer from within the
* getparameter a lot, we must check it for NULL before accessing the str
* data.
*/
ParameterError str2udouble(double *val, const char *str)
ParameterError str2udouble(double *val, const char *str, long max)
{
ParameterError result = str2double(val, str);
ParameterError result = str2double(val, str, max);
if(result != PARAM_OK)
return result;
if(*val < 0)
@ -384,11 +402,12 @@ ParameterError str2offset(curl_off_t *val, const char *str)
#if(CURL_SIZEOF_CURL_OFF_T > CURL_SIZEOF_LONG)
*val = curlx_strtoofft(str, &endptr, 0);
if((*val == CURL_OFF_T_MAX || *val == CURL_OFF_T_MIN) && (errno == ERANGE))
return PARAM_BAD_NUMERIC;
return PARAM_NUMBER_TOO_LARGE;
#else
errno = 0;
*val = strtol(str, &endptr, 0);
if((*val == LONG_MIN || *val == LONG_MAX) && errno == ERANGE)
return PARAM_BAD_NUMERIC;
return PARAM_NUMBER_TOO_LARGE;
#endif
if((endptr != str) && (endptr == str + strlen(str)))
return PARAM_OK;

5
src/tool_paramhlp.h
View File

@ -7,7 +7,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -33,8 +33,7 @@ void cleanarg(char *str);
ParameterError str2num(long *val, const char *str);
ParameterError str2unum(long *val, const char *str);
ParameterError str2double(double *val, const char *str);
ParameterError str2udouble(double *val, const char *str);
ParameterError str2udouble(double *val, const char *str, long max);
long proto2num(struct OperationConfig *config, long *val, const char *str);