luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

curl: allow 500MB data URL encode strings

Browse Source 
Previously it would bail out of the generated data reached 8MB in
memory.

Reported-by: Antoine du Hamel
Fixes #14337
Closes #14340
This commit is contained in:
Daniel Stenberg 2024-08-01 16:45:50 +02:00
parent 9bfc7f9234
commit 1f61db5907
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/tool_getparam.c
View File

@ -846,6 +846,9 @@ static void cleanarg(argv_item_t str)
#define cleanarg(x) #define cleanarg(x)
#endif #endif
/* the maximum size we allow the dynbuf generated string */
#define MAX_DATAURLENCODE (500*1024*1024)
/* --data-urlencode */ /* --data-urlencode */
static ParameterError data_urlencode(struct GlobalConfig *global, static ParameterError data_urlencode(struct GlobalConfig *global,
char *nextarg, char *nextarg,
@ -921,15 +924,22 @@ static ParameterError data_urlencode(struct GlobalConfig *global,
char *n; char *n;
replace_url_encoded_space_by_plus(enc); replace_url_encoded_space_by_plus(enc);
if(nlen > 0) { /* only append '=' if we have a name */ if(nlen > 0) { /* only append '=' if we have a name */
n = aprintf("%.*s=%s", (int)nlen, nextarg, enc); struct curlx_dynbuf dyn;
curl_free(enc); curlx_dyn_init(&dyn, MAX_DATAURLENCODE);
if(!n) if(curlx_dyn_addn(&dyn, nextarg, nlen) ||
curlx_dyn_addn(&dyn, "=", 1) ||
curlx_dyn_add(&dyn, enc)) {
curl_free(enc);
return PARAM_NO_MEM; return PARAM_NO_MEM;
}
curl_free(enc);
n = curlx_dyn_ptr(&dyn);
size = curlx_dyn_len(&dyn);
} }
else else {
n = enc; n = enc;
size = strlen(n);
size = strlen(n); }
postdata = n; postdata = n;
} }
else else