76e7d496b6
Daniel Stenberg
2025-12-24
Subject
escape: add a length check in curl_easy_escape
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
docs/libcurl/curl_easy_escape.md+1 -2
| @@ -34,8 +34,7 @@ A-Z, 0-9, '-', '.', '_' or '~' are converted to their "URL escaped" version | |
| constrained by its type, the returned string may not be altered. | |
| If *length* is set to 0 (zero), curl_easy_escape(3) uses strlen() on the input | |
| - | *string* to find out the size. This function does not accept input strings |
| - | longer than **CURL_MAX_INPUT_LENGTH** (8 MB). |
| + | *string* to find out the size. |
| You must curl_free(3) the returned string when you are done with it. | |
lib/escape.c+3 -0
| @@ -62,6 +62,9 @@ char *curl_easy_escape(CURL *data, const char *string, int inlength) | |
| if(!length) | |
| return curlx_strdup(""); | |
| + | if(length > SIZE_MAX/16) |
| + | return NULL; |
| + | |
| curlx_dyn_init(&d, length * 3 + 1); | |
| while(length--) { | |