f5e43ea923
Filippo Tedeschi
2026-09-24
Subject
easy: validate buffer pointer in curl_easy_recv and curl_easy_send
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/easy.c+2 -2
| @@ -1306,7 +1306,7 @@ CURLcode curl_easy_recv(CURL *curl, void *buffer, size_t buflen, size_t *n) | |
| CURLcode result; | |
| if(CURL_EAPI_ENTER(&guard, curl, easy_recv, &result)) { | |
| - | if(!n) { |
| + | if(!n || (buflen && !buffer)) { |
| result = CURLE_BAD_FUNCTION_ARGUMENT; | |
| goto out; | |
| } | |
| @@ -1381,7 +1381,7 @@ CURLcode curl_easy_send(CURL *curl, const void *buffer, size_t buflen, | |
| struct Curl_easy *data = curl; | |
| size_t written = 0; | |
| - | if(!n) { |
| + | if(!n || (buflen && !buffer)) { |
| result = CURLE_BAD_FUNCTION_ARGUMENT; | |
| goto out; | |
| } | |
tests/libtest/lib556.c+10 -0
| @@ -27,6 +27,7 @@ static CURLcode test_lib556(const char *URL) | |
| { | |
| CURLcode result; | |
| CURL *curl; | |
| + | size_t ncheck = 0; |
| int transfers = 0; | |
| if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { | |
| @@ -45,6 +46,15 @@ static CURLcode test_lib556(const char *URL) | |
| easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L); | |
| easy_setopt(curl, CURLOPT_VERBOSE, 1L); | |
| + | if(curl_easy_recv(NULL, NULL, 0, NULL) != CURLE_BAD_FUNCTION_ARGUMENT || |
| + | curl_easy_recv(curl, NULL, 10, &ncheck) != CURLE_BAD_FUNCTION_ARGUMENT || |
| + | curl_easy_send(NULL, NULL, 0, NULL) != CURLE_BAD_FUNCTION_ARGUMENT || |
| + | curl_easy_send(curl, NULL, 10, &ncheck) != CURLE_BAD_FUNCTION_ARGUMENT) { |
| + | curl_mfprintf(stderr, "curl_easy_recv/send argument validation failed\n"); |
| + | result = TEST_ERR_FAILURE; |
| + | goto test_cleanup; |
| + | } |
| + | |
| again: | |
| result = curl_easy_perform(curl); | |