mirror of
https://github.com/moparisthebest/curl
synced 2024-11-16 14:35:03 -05:00
5fc28510a4
This limits all accepted input strings passed to libcurl to be less than CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls: curl_easy_setopt() and curl_url_set(). The 8000000 number is arbitrary picked and is meant to detect mistakes or abuse, not to limit actual practical use cases. By limiting the acceptable string lengths we also reduce the risk of integer overflows all over. NOTE: This does not apply to `CURLOPT_POSTFIELDS`. Test 1559 verifies. Closes #3805
45 lines
619 B
Plaintext
45 lines
619 B
Plaintext
<testcase>
|
|
<info>
|
|
<keywords>
|
|
CURLOPT_URL
|
|
</keywords>
|
|
</info>
|
|
|
|
<reply>
|
|
</reply>
|
|
|
|
<client>
|
|
<server>
|
|
none
|
|
</server>
|
|
|
|
# require HTTP so that CURLOPT_POSTFIELDS works as assumed
|
|
<features>
|
|
http
|
|
</features>
|
|
<tool>
|
|
lib1559
|
|
</tool>
|
|
|
|
<name>
|
|
Set excessive URL lengths
|
|
</name>
|
|
</client>
|
|
|
|
#
|
|
# Verify that the test runs to completion without crashing
|
|
<verify>
|
|
<errorcode>
|
|
0
|
|
</errorcode>
|
|
<stdout>
|
|
CURLOPT_URL 10000000 bytes URL == 43
|
|
CURLOPT_POSTFIELDS 10000000 bytes data == 0
|
|
CURLUPART_URL 10000000 bytes URL == 3
|
|
CURLUPART_SCHEME 10000000 bytes scheme == 3
|
|
CURLUPART_USER 10000000 bytes user == 3
|
|
</stdout>
|
|
</verify>
|
|
|
|
</testcase>
|