diff options
author | Daniel Stenberg <daniel@haxx.se> | 2017-10-03 17:00:18 +0200 |
---|---|---|
committer | Daniel Stenberg <daniel@haxx.se> | 2017-10-16 09:23:19 +0200 |
commit | 172ce9cc19a72342243c0cb06b2144ac16a84f89 (patch) | |
tree | 97753efe9744ecc85c063e049a7f21f2a32db4db /lib/url.c | |
parent | 4440b6ad575385b433dc4b8a28ef80000aa95f7f (diff) | |
download | curl-172ce9cc19a72342243c0cb06b2144ac16a84f89.tar.gz |
setopt: avoid integer overflows when setting millsecond values
... that are multiplied by 1000 when stored.
For 32 bit long systems, the max value accepted (2147483 seconds) is >
596 hours which is unlikely to ever be set by a legitimate application -
and previously it didn't work either, it just caused undefined behavior.
Also updated the man pages for these timeout options to mention the
return code.
Closes #1938
Diffstat (limited to 'lib/url.c')
-rw-r--r-- | lib/url.c | 18 |
1 files changed, 15 insertions, 3 deletions
@@ -875,7 +875,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option, * Option that specifies how quickly an server response must be obtained * before it is considered failure. For pingpong protocols. */ - data->set.server_response_timeout = va_arg(param, long) * 1000; + arg = va_arg(param, long); + if((arg>=0) && (arg < (INT_MAX/1000))) + data->set.server_response_timeout = arg * 1000; + else + return CURLE_BAD_FUNCTION_ARGUMENT; break; case CURLOPT_TFTP_NO_OPTIONS: /* @@ -1725,7 +1729,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option, * The maximum time you allow curl to use for a single transfer * operation. */ - data->set.timeout = va_arg(param, long) * 1000L; + arg = va_arg(param, long); + if((arg>=0) && (arg < (INT_MAX/1000))) + data->set.timeout = arg * 1000; + else + return CURLE_BAD_FUNCTION_ARGUMENT; break; case CURLOPT_TIMEOUT_MS: @@ -1736,7 +1744,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option, /* * The maximum time you allow curl to use to connect. */ - data->set.connecttimeout = va_arg(param, long) * 1000L; + arg = va_arg(param, long); + if((arg>=0) && (arg < (INT_MAX/1000))) + data->set.connecttimeout = arg * 1000; + else + return CURLE_BAD_FUNCTION_ARGUMENT; break; case CURLOPT_CONNECTTIMEOUT_MS: |