diff options
| author | Jonathan Nieder <jrnieder@gmail.com> | 2013-08-19 01:36:46 -0700 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2013-08-20 11:16:38 +0200 |
| commit | 2f1a0bc0bf36c5ad0f8755d9c7553e1f5729af43 (patch) | |
| tree | f06bad1760fc484b22732c0a60a97a7d888dd598 /lib/urldata.h | |
| parent | 09ddb1d61cdb9ee11ebf481b29dac1be8f0ab848 (diff) | |
url: handle arbitrary-length username and password before '@'
libcurl quietly truncates usernames, passwords, and options from
before an '@' sign in a URL to 255 (= MAX_CURL_PASSWORD_LENGTH - 1)
characters to fit in fixed-size buffers on the stack. Allocate a
buffer large enough to fit the parsed fields on the fly instead to
support longer passwords.
After this change, there are no more uses of MAX_CURL_OPTIONS_LENGTH
left, so stop defining that constant while at it. The hardcoded max
username and password length constants, on the other hand, are still
used in HTTP proxy credential handling (which this patch doesn't
touch).
Reported-by: Colby Ranger
Diffstat (limited to 'lib/urldata.h')
| -rw-r--r-- | lib/urldata.h | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/lib/urldata.h b/lib/urldata.h index 770afe698..be139ef64 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -1152,7 +1152,6 @@ typedef enum { * Session-data MUST be put in the connectdata struct and here. */ #define MAX_CURL_USER_LENGTH 256 #define MAX_CURL_PASSWORD_LENGTH 256 -#define MAX_CURL_OPTIONS_LENGTH 256 struct auth { unsigned long want; /* Bitmask set to the authentication methods wanted by |