diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2019-04-29 08:00:49 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2019-04-29 08:02:44 +0200 |
| commit | 5fc28510a4664f46459d9a40187d81cc08571e60 (patch) | |
| tree | b6d15dac4952967aecf54af92f5a0f5ca10fcb66 /lib/urldata.h | |
| parent | 2fe2da9f1a6b059f94c28e963032539790dbcae5 (diff) | |
CURL_MAX_INPUT_LENGTH: largest acceptable string input size
This limits all accepted input strings passed to libcurl to be less than
CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls:
curl_easy_setopt() and curl_url_set().
The 8000000 number is arbitrary picked and is meant to detect mistakes
or abuse, not to limit actual practical use cases. By limiting the
acceptable string lengths we also reduce the risk of integer overflows
all over.
NOTE: This does not apply to `CURLOPT_POSTFIELDS`.
Test 1559 verifies.
Closes #3805
Diffstat (limited to 'lib/urldata.h')
| -rw-r--r-- | lib/urldata.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/urldata.h b/lib/urldata.h index 8f7742082..4b09f24fd 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -79,6 +79,10 @@ */ #define RESP_TIMEOUT (120*1000) +/* Max string intput length is a precaution against abuse and to detect junk + input easier and better. */ +#define CURL_MAX_INPUT_LENGTH 8000000 + #include "cookie.h" #include "psl.h" #include "formdata.h" |