diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2017-08-01 17:16:07 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2017-08-07 09:24:30 +0200 |
| commit | 453e7a7a03a2cec749abd3878a48e728c515cca7 (patch) | |
| tree | 79b607daa5b3e4aa8175becf49a849c491fbc746 /src/tool_urlglob.c | |
| parent | 358b2b131ad6c095696f20dcfa62b8305263f898 (diff) | |
| download | curl-453e7a7a03a2cec749abd3878a48e728c515cca7.tar.gz | |
glob: do not continue parsing after a strtoul() overflow range
Added test 1289 to verify.
CVE-2017-1000101
Bug: https://curl.haxx.se/docs/adv_20170809A.html
Reported-by: Brian Carpenter
Diffstat (limited to 'src/tool_urlglob.c')
| -rw-r--r-- | src/tool_urlglob.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/tool_urlglob.c b/src/tool_urlglob.c index 6b1ece008..d56dcd912 100644 --- a/src/tool_urlglob.c +++ b/src/tool_urlglob.c @@ -273,7 +273,10 @@ static CURLcode glob_range(URLGlob *glob, char **patternp, } errno = 0; max_n = strtoul(pattern, &endp, 10); - if(errno || (*endp == ':')) { + if(errno) + /* overflow */ + endp = NULL; + else if(*endp == ':') { pattern = endp+1; errno = 0; step_n = strtoul(pattern, &endp, 10); |