1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://www.curl.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
***************************************************************************/
#include "test.h"
#include "testutil.h"
#include "warnless.h"
#include "memdebug.h"
/* The maximum string length limit (CURL_MAX_INPUT_LENGTH) is an internal
define not publicly exposed so we set our own */
#define MAX_INPUT_LENGTH 8000000
static char buffer[MAX_INPUT_LENGTH + 2];
int test(char *URL)
{
const struct curl_easyoption *o;
CURL *easy;
int error = 0;
(void)URL;
curl_global_init(CURL_GLOBAL_ALL);
easy = curl_easy_init();
if(!easy)
return 1;
/* make it a zero terminated C string with just As */
memset(buffer, 'A', MAX_INPUT_LENGTH + 1);
buffer[MAX_INPUT_LENGTH + 1] = 0;
printf("string length: %d\n", (int)strlen(buffer));
for(o = curl_easy_option_next(NULL);
o;
o = curl_easy_option_next(o)) {
if(o->type == CURLOT_STRING) {
CURLcode result;
/*
* Whitelist string options that are safe for abuse
*/
switch(o->id) {
case CURLOPT_PROXY_TLSAUTH_TYPE:
case CURLOPT_TLSAUTH_TYPE:
continue;
default:
/* check this */
break;
}
/* This is a string. Make sure that passing in a string longer
CURL_MAX_INPUT_LENGTH returns an error */
result = curl_easy_setopt(easy, o->id, buffer);
switch(result) {
case CURLE_BAD_FUNCTION_ARGUMENT: /* the most normal */
case CURLE_UNKNOWN_OPTION: /* left out from the build */
case CURLE_NOT_BUILT_IN: /* not supported */
break;
default:
/* all other return codes are unexpected */
fprintf(stderr, "curl_easy_setopt(%s...) returned %d\n",
o->name, (int)result);
error++;
break;
}
}
}
curl_easy_cleanup(easy);
curl_global_cleanup();
return error;
}
|
