luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

urlapi: when URL encoding the fragment, pass in the right length

Browse Source 
A benign bug because it would only add an extra null terminator.

Made lib1560 get a test that runs this code.

Closes #12250
This commit is contained in:
Daniel Stenberg 2023-11-02 13:43:54 +01:00
parent bbdbd4b025
commit 5c846a12a3
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/urlapi.c
View File

@ -1224,7 +1224,7 @@ static CURLUcode parseurl(const char *url, CURLU *u, unsigned int flags)
if(flags & CURLU_URLENCODE) {
struct dynbuf enc;
Curl_dyn_init(&enc, CURL_MAX_INPUT_LENGTH);
if(urlencode_str(&enc, fragment + 1, fraglen, TRUE, FALSE)) {
if(urlencode_str(&enc, fragment + 1, fraglen - 1, TRUE, FALSE)) {
result = CURLUE_OUT_OF_MEMORY;
goto fail;
}

3
tests/libtest/lib1560.c
View File

@ -151,6 +151,9 @@ struct clearurlcase {
};
static const struct testcase get_parts_list[] ={
{"https://curl.se/# ",
"https | [11] | [12] | [13] | curl.se | [15] | / | [16] | %20%20",
CURLU_URLENCODE|CURLU_ALLOW_SPACE, 0, CURLUE_OK},
{"", "", 0, 0, CURLUE_MALFORMED_INPUT},
{" ", "", 0, 0, CURLUE_MALFORMED_INPUT},
{"1h://example.net", "", 0, 0, CURLUE_BAD_SCHEME},