Fixed a couple of problems in the IPv6 scope code. First, a host name in

an URL in a Location: header didn't have the scope ID removed, so an
invalid host name was used.  Second, when the scope ID was removed, it
also removed any port number that may have existed in the URL.

1 files changed, 6 insertions, 3 deletions

diff --git a/lib/url.c b/lib/url.c
index 170310beb..e39a3d2a0 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -3089,16 +3089,19 @@ static CURLcode ParseURLAndFillConnection(struct SessionHandle *data,
     path[0] = '/';
   }
 
-  if (conn->host.name[0] == '[' && !data->state.this_is_a_follow) {
+  if (conn->host.name[0] == '[') {
     /* This looks like an IPv6 address literal.  See if there is an address
        scope.  */
     char *percent = strstr (conn->host.name, "%25");
     if (percent) {
       char *endp;
-      conn->scope = strtoul (percent + 3, &endp, 10);
+      unsigned int scope = strtoul (percent + 3, &endp, 10);
       if (*endp == ']') {
         /* The address scope was well formed.  Knock it out of the hostname.  */
-        strcpy (percent, "]");
+        memmove(percent, endp, strlen(endp)+1);
+        if (!data->state.this_is_a_follow)
+          /* Don't honour a scope given in a Location: header */
+          conn->scope = scope;
       }
     }
   }