summaryrefslogtreecommitdiff
path: root/lib/escape.c
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2013-05-19 23:24:29 +0200
committerDaniel Stenberg <daniel@haxx.se>2013-06-22 11:21:35 +0200
commit192c4f788d48f82c03e9cef40013f34370e90737 (patch)
tree3065f5fa6d538ed1aa21c2a7cc020c63ebd75086 /lib/escape.c
parentda0db499fd1fed3ab061d8c03d25c06164c9f429 (diff)
downloadcurl-192c4f788d48f82c03e9cef40013f34370e90737.tar.gz
Curl_urldecode: no peeking beyond end of input buffer
Security problem: CVE-2013-2174 If a program would give a string like "%FF" to curl_easy_unescape() but ask for it to decode only the first byte, it would still parse and decode the full hex sequence. The function then not only read beyond the allowed buffer but it would also deduct the *unsigned* counter variable for how many more bytes there's left to read in the buffer by two, making the counter wrap. Continuing this, the function would go on reading beyond the buffer and soon writing beyond the allocated target buffer... Bug: http://curl.haxx.se/docs/adv_20130622.html Reported-by: Timo Sirainen
Diffstat (limited to 'lib/escape.c')
-rw-r--r--lib/escape.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/lib/escape.c b/lib/escape.c
index 6a26cf8ef..aa7db2c5b 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@@ -159,7 +159,8 @@ CURLcode Curl_urldecode(struct SessionHandle *data,
while(--alloc > 0) {
in = *string;
- if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
+ if(('%' == in) && (alloc > 2) &&
+ ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
/* this is two hexadecimal digits following a '%' */
char hexstr[3];
char *ptr;