moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-21 23:58:49 -05:00
Code Issues Releases Wiki Activity

mime: refuse to add subparts to one of their own descendants.

Browse Source 
Reported-by: Alexey Melnichuk
Fixes #1962
This commit is contained in:
Patrick Monnerat 2017-10-08 18:49:52 +01:00
parent 112ea5adb6
commit ebcbed3821
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
lib/mime.c
View File

@ -26,6 +26,8 @@
#include "mime.h" #include "mime.h"
#include "non-ascii.h" #include "non-ascii.h"
#include "urldata.h"
#include "sendf.h"
#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_SMTP) || \ #if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_SMTP) || \
!defined(CURL_DISABLE_IMAP) !defined(CURL_DISABLE_IMAP)
@ -1409,6 +1411,8 @@ CURLcode curl_mime_data_cb(curl_mimepart *part, curl_off_t datasize,
CURLcode Curl_mime_set_subparts(curl_mimepart *part, CURLcode Curl_mime_set_subparts(curl_mimepart *part,
curl_mime *subparts, int take_ownership) curl_mime *subparts, int take_ownership)
{ {
curl_mime *root;
if(!part) if(!part)
return CURLE_BAD_FUNCTION_ARGUMENT; return CURLE_BAD_FUNCTION_ARGUMENT;
@ -1427,6 +1431,17 @@ CURLcode Curl_mime_set_subparts(curl_mimepart *part,
if(subparts->parent) if(subparts->parent)
return CURLE_BAD_FUNCTION_ARGUMENT; return CURLE_BAD_FUNCTION_ARGUMENT;
/* Should not be the part's root. */
root = part->parent;
if(root) {
while(root->parent && root->parent->parent)
root = root->parent->parent;
if(subparts == root) {
failf(part->easy, "Can't add itself as a subpart!");
return CURLE_BAD_FUNCTION_ARGUMENT;
}
}
subparts->parent = part; subparts->parent = part;
part->readfunc = mime_subparts_read; part->readfunc = mime_subparts_read;
part->seekfunc = mime_subparts_seek; part->seekfunc = mime_subparts_seek;