6e5dee3fd0 — curl

Subject

ssls: validate input arguments in import, export, and unpack

No binary (build failed)

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

(log yok)

lib/easy.c+10 -4

@@ -1418,8 +1418,11 @@ CURLcode curl_easy_ssls_import(CURL curl, const char session_key,
	CURLcode result;

	if(CURL_EAPI_ENTER(&guard, curl, easy_ssls_import, &result)) {
-	result = Curl_ssl_session_import((struct Curl_easy *)curl, session_key,
-	shmac, shmac_len, sdata, sdata_len);
+	if(!sdata \|\| !sdata_len)
+	result = CURLE_BAD_FUNCTION_ARGUMENT;
+	else
+	result = Curl_ssl_session_import((struct Curl_easy *)curl, session_key,
+	shmac, shmac_len, sdata, sdata_len);
	}
	CURL_EAPI_LEAVE(&guard);
	return result;
@@ -1443,8 +1446,11 @@ CURLcode curl_easy_ssls_export(CURL *curl,
	CURLcode result;

	if(CURL_EAPI_ENTER(&guard, curl, easy_ssls_export, &result)) {
-	result = Curl_ssl_session_export((struct Curl_easy *)curl,
-	export_fn, userptr);
+	if(!export_fn)
+	result = CURLE_BAD_FUNCTION_ARGUMENT;
+	else
+	result = Curl_ssl_session_export((struct Curl_easy *)curl,
+	export_fn, userptr);
	}
	CURL_EAPI_LEAVE(&guard);
	return result;

lib/vtls/vtls_scache.c+1 -1

@@ -1218,7 +1218,7 @@ CURLcode Curl_ssl_session_import(struct Curl_easy *data,
	struct Curl_ssl_session *s = NULL;
	CURLcode result;

-	if(!scache) {
+	if(!scache \|\| !sdata \|\| !sdata_len) {
	result = CURLE_BAD_FUNCTION_ARGUMENT;
	goto out;
	}

lib/vtls/vtls_spack.c+1 -0

@@ -247,6 +247,7 @@ CURLcode Curl_ssl_session_unpack(struct Curl_easy *data,
	size_t dlen;
	CURLcode result;

+	DEBUGASSERT(ps);
	DEBUGASSERT(buf);
	DEBUGASSERT(buflen);
	*ps = NULL;

tests/libtest/lib1678.c+26 -0

@@ -130,6 +130,32 @@ static CURLcode test_lib1678(const char *URL)
	if(result)
	goto test_cleanup;

+	if(curl_easy_ssls_import(NULL, "example.test:443", NULL, 0, packet,
+	packet_len) != CURLE_BAD_FUNCTION_ARGUMENT) {
+	result = CURLE_BAD_FUNCTION_ARGUMENT;
+	goto test_cleanup;
+	}
+	if(curl_easy_ssls_import(easy, "example.test:443", NULL, 0, NULL,
+	packet_len) != CURLE_BAD_FUNCTION_ARGUMENT) {
+	result = CURLE_BAD_FUNCTION_ARGUMENT;
+	goto test_cleanup;
+	}
+	if(curl_easy_ssls_import(easy, "example.test:443", NULL, 0, packet, 0) !=
+	CURLE_BAD_FUNCTION_ARGUMENT) {
+	result = CURLE_BAD_FUNCTION_ARGUMENT;
+	goto test_cleanup;
+	}
+	if(curl_easy_ssls_export(NULL, NULL, NULL) !=
+	CURLE_BAD_FUNCTION_ARGUMENT) {
+	result = CURLE_BAD_FUNCTION_ARGUMENT;
+	goto test_cleanup;
+	}
+	if(curl_easy_ssls_export(easy, NULL, NULL) !=
+	CURLE_BAD_FUNCTION_ARGUMENT) {
+	result = CURLE_BAD_FUNCTION_ARGUMENT;
+	goto test_cleanup;
+	}
+
	for(i = 0; i < T1678_IMPORT_COUNT; ++i) {
	result = curl_easy_ssls_import(easy,
	"example.test:443",