diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2017-08-01 17:17:06 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2017-08-07 09:24:30 +0200 |
| commit | c9332fa5e84f24da300b42b1a931ade929d3e27d (patch) | |
| tree | d56382d8e2793fd3d1c746433f47b762e91abe50 | |
| parent | fa48987356e3c1ced8ac32f10b06e578a4d23583 (diff) | |
file: output the correct buffer to the user
Regression brought by 7c312f84ea930d8 (April 2017)
CVE-2017-1000099
Bug: https://curl.haxx.se/docs/adv_20170809C.html
Credit to OSS-Fuzz for the discovery
| -rw-r--r-- | lib/file.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/file.c b/lib/file.c index bd426eac2..666cbe75b 100644 --- a/lib/file.c +++ b/lib/file.c @@ -501,7 +501,7 @@ static CURLcode file_do(struct connectdata *conn, bool *done) tm->tm_hour, tm->tm_min, tm->tm_sec); - result = Curl_client_write(conn, CLIENTWRITE_BOTH, buf, 0); + result = Curl_client_write(conn, CLIENTWRITE_BOTH, header, 0); if(!result) /* set the file size to make it available post transfer */ Curl_pgrsSetDownloadSize(data, expected_size); |