diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/ftplistparser.c | 15 | ||||
| -rw-r--r-- | lib/rtsp.c | 5 | ||||
| -rw-r--r-- | lib/sendf.c | 11 |
3 files changed, 28 insertions, 3 deletions
diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c index bbf6e9ef9..12ee51d86 100644 --- a/lib/ftplistparser.c +++ b/lib/ftplistparser.c @@ -354,6 +354,8 @@ static CURLcode ftp_pl_insert_finfo(struct connectdata *conn, return CURLE_OK; } +/* Curl_ftp_parselist is a write callback function */ + size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb, void *connptr) { @@ -365,6 +367,10 @@ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb, unsigned long i = 0; CURLcode rc; + if(bufflen >= CURL_WRITEFUNC_PAUSE) + /* CURL_WRITEFUNC_PAUSE limits input size */ + return CURL_WRITEFUNC_OUT_OF_MEMORY; + if(parser->error) { /* error in previous call */ /* scenario: * 1. call => OK.. @@ -372,6 +378,9 @@ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb, * 3. (last) call => is skipped RIGHT HERE and the error is hadled later * in wc_statemach() */ + if(parser->error == CURLE_OUT_OF_MEMORY) + return CURL_WRITEFUNC_OUT_OF_MEMORY; + return bufflen; } @@ -388,12 +397,12 @@ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb, parser->file_data = Curl_fileinfo_alloc(); if(!parser->file_data) { parser->error = CURLE_OUT_OF_MEMORY; - return bufflen; + return CURL_WRITEFUNC_OUT_OF_MEMORY; } parser->file_data->b_data = malloc(FTP_BUFFER_ALLOCSIZE); if(!parser->file_data->b_data) { PL_ERROR(conn, CURLE_OUT_OF_MEMORY); - return bufflen; + return CURL_WRITEFUNC_OUT_OF_MEMORY; } parser->file_data->b_size = FTP_BUFFER_ALLOCSIZE; parser->item_offset = 0; @@ -416,7 +425,7 @@ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb, parser->file_data = NULL; parser->error = CURLE_OUT_OF_MEMORY; PL_ERROR(conn, CURLE_OUT_OF_MEMORY); - return bufflen; + return CURL_WRITEFUNC_OUT_OF_MEMORY; } } diff --git a/lib/rtsp.c b/lib/rtsp.c index 198c25dc1..77c1367ff 100644 --- a/lib/rtsp.c +++ b/lib/rtsp.c @@ -725,6 +725,11 @@ CURLcode rtp_client_write(struct connectdata *conn, char *ptr, size_t len) writeit = data->set.fwrite_rtp?data->set.fwrite_rtp:data->set.fwrite_func; wrote = writeit(ptr, 1, len, data->set.rtp_out); + if(CURL_WRITEFUNC_OUT_OF_MEMORY == wrote) { + failf (data, "Out of memory writing RTP data"); + return CURLE_OUT_OF_MEMORY; + } + if(CURL_WRITEFUNC_PAUSE == wrote) { failf (data, "Cannot pause RTP"); return CURLE_WRITE_ERROR; diff --git a/lib/sendf.c b/lib/sendf.c index 847090be3..e9d5c3775 100644 --- a/lib/sendf.c +++ b/lib/sendf.c @@ -459,6 +459,11 @@ CURLcode Curl_client_write(struct connectdata *conn, wrote = len; } + if(CURL_WRITEFUNC_OUT_OF_MEMORY == wrote) { + failf(data, "Out of memory writing body"); + return CURLE_OUT_OF_MEMORY; + } + if(CURL_WRITEFUNC_PAUSE == wrote) return pausewrite(data, type, ptr, len); @@ -481,6 +486,12 @@ CURLcode Curl_client_write(struct connectdata *conn, regardless of the ftp transfer mode (ASCII/Image) */ wrote = writeit(ptr, 1, len, data->set.writeheader); + + if(CURL_WRITEFUNC_OUT_OF_MEMORY == wrote) { + failf(data, "Out of memory writing header"); + return CURLE_OUT_OF_MEMORY; + } + if(CURL_WRITEFUNC_PAUSE == wrote) /* here we pass in the HEADER bit only since if this was body as well then it was passed already and clearly that didn't trigger the pause, |