[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[GNUnet-SVN] [gnurl] 200/208: glob: do not continue parsing after a strt
From: |
gnunet |
Subject: |
[GNUnet-SVN] [gnurl] 200/208: glob: do not continue parsing after a strtoul() overflow range |
Date: |
Wed, 09 Aug 2017 17:36:37 +0200 |
This is an automated email from the git hooks/post-receive script.
ng0 pushed a commit to annotated tag gnurl-7.55.0
in repository gnurl.
commit 453e7a7a03a2cec749abd3878a48e728c515cca7
Author: Daniel Stenberg <address@hidden>
AuthorDate: Tue Aug 1 17:16:07 2017 +0200
glob: do not continue parsing after a strtoul() overflow range
Added test 1289 to verify.
CVE-2017-1000101
Bug: https://curl.haxx.se/docs/adv_20170809A.html
Reported-by: Brian Carpenter
---
src/tool_urlglob.c | 5 ++++-
tests/data/Makefile.inc | 2 +-
tests/data/test1289 | 35 +++++++++++++++++++++++++++++++++++
3 files changed, 40 insertions(+), 2 deletions(-)
diff --git a/src/tool_urlglob.c b/src/tool_urlglob.c
index 6b1ece008..d56dcd912 100644
--- a/src/tool_urlglob.c
+++ b/src/tool_urlglob.c
@@ -273,7 +273,10 @@ static CURLcode glob_range(URLGlob *glob, char **patternp,
}
errno = 0;
max_n = strtoul(pattern, &endp, 10);
- if(errno || (*endp == ':')) {
+ if(errno)
+ /* overflow */
+ endp = NULL;
+ else if(*endp == ':') {
pattern = endp+1;
errno = 0;
step_n = strtoul(pattern, &endp, 10);
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
index 35446cf71..59f692e8f 100644
--- a/tests/data/Makefile.inc
+++ b/tests/data/Makefile.inc
@@ -132,7 +132,7 @@ test1252 test1253 test1254 test1255 test1256 test1257
test1258 test1259 \
test1260 test1261 test1262 \
\
test1280 test1281 test1282 test1283 test1284 test1285 test1286 test1287 \
-test1288 \
+test1288 test1289 \
test1298 test1299 \
test1300 test1301 test1302 test1303 test1304 test1305 test1306 test1307 \
test1308 test1309 test1310 test1311 test1312 test1313 test1314 test1315 \
diff --git a/tests/data/test1289 b/tests/data/test1289
new file mode 100644
index 000000000..d679cc0bc
--- /dev/null
+++ b/tests/data/test1289
@@ -0,0 +1,35 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+globbing
+</keywords>
+</info>
+
+#
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+globbing with overflow and bad syntxx
+</name>
+<command>
+http://ur%20[0-60000000000000000000
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# curl: (3) [globbing] bad range in column
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>
--
To stop receiving notification emails like this one, please contact
address@hidden
- [GNUnet-SVN] [gnurl] 147/208: rtspd: fix MSVC level 4 warning, (continued)
- [GNUnet-SVN] [gnurl] 147/208: rtspd: fix MSVC level 4 warning, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 64/208: progress: fix "time spent", broke in adef394ac, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 162/208: splay: fix signed/unsigned mismatch warning, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 204/208: configure: fix recv/send/select detection on Android, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 186/208: darwin: silence compiler warnings, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 172/208: multi: fix request timer management, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 194/208: darwinssl: fix compiler warning, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 149/208: libtest: fix MSVC warning C4706, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 181/208: CMake: set MSVC warning level to 4, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 202/208: test1427: verify command line parser integer overflow detection, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 200/208: glob: do not continue parsing after a strtoul() overflow range,
gnunet <=
- [GNUnet-SVN] [gnurl] 203/208: ax_code_coverage.m4: update to latest version, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 180/208: CURLOPT_NETRC.3: fix typo in 7e48aa386156f9c2, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 165/208: RELEASE-NOTES: synced with 001701c47, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 179/208: CURLOPT_NETRC.3: mention the file name on windows, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 197/208: easy_events: make event data static, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 177/208: travis: build osx with openssl too, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 185/208: BUILD.WINDOWS: mention buildconf.bat for builds off git, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 207/208: RELEASE-NOTES: curl 7.55.0, gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 208/208: Patchset for gnURL microfork: * Patches to rename libcurl to libgnurl by Christian * Updated for latest curl using git cherry-pick by Jeff, Florian, ng0 * Patches to fix the testsuite (deleted tests/data/test1139, renamed reference from libcurl.* to libgnurl.*) by ng0 * Added guix-gnurl.scm which can be used to build this with guix prior to installing it. (author: ng0) * Further adjustments by ng0 * 7.55.0: Manual addition of a7bbbb7c368c6096802007f61f19a02e9d75285b and f864bd8c880d5a91637 [...], gnunet, 2017/08/09
- [GNUnet-SVN] [gnurl] 95/208: test: add impacket for SMB testing, gnunet, 2017/08/09