From 453e7a7a03a2cec749abd3878a48e728c515cca7 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 1 Aug 2017 17:16:07 +0200 Subject: glob: do not continue parsing after a strtoul() overflow range Added test 1289 to verify. CVE-2017-1000101 Bug: https://curl.haxx.se/docs/adv_20170809A.html Reported-by: Brian Carpenter --- src/tool_urlglob.c | 5 ++++- tests/data/Makefile.inc | 2 +- tests/data/test1289 | 35 +++++++++++++++++++++++++++++++++++ 3 files changed, 40 insertions(+), 2 deletions(-) create mode 100644 tests/data/test1289 diff --git a/src/tool_urlglob.c b/src/tool_urlglob.c index 6b1ece008..d56dcd912 100644 --- a/src/tool_urlglob.c +++ b/src/tool_urlglob.c @@ -273,7 +273,10 @@ static CURLcode glob_range(URLGlob *glob, char **patternp, } errno = 0; max_n = strtoul(pattern, &endp, 10); - if(errno || (*endp == ':')) { + if(errno) + /* overflow */ + endp = NULL; + else if(*endp == ':') { pattern = endp+1; errno = 0; step_n = strtoul(pattern, &endp, 10); diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc index 35446cf71..59f692e8f 100644 --- a/tests/data/Makefile.inc +++ b/tests/data/Makefile.inc @@ -132,7 +132,7 @@ test1252 test1253 test1254 test1255 test1256 test1257 test1258 test1259 \ test1260 test1261 test1262 \ \ test1280 test1281 test1282 test1283 test1284 test1285 test1286 test1287 \ -test1288 \ +test1288 test1289 \ test1298 test1299 \ test1300 test1301 test1302 test1303 test1304 test1305 test1306 test1307 \ test1308 test1309 test1310 test1311 test1312 test1313 test1314 test1315 \ diff --git a/tests/data/test1289 b/tests/data/test1289 new file mode 100644 index 000000000..d679cc0bc --- /dev/null +++ b/tests/data/test1289 @@ -0,0 +1,35 @@ + + + +HTTP +HTTP GET +globbing + + + +# +# Server-side + + + +# Client-side + + +http + + +globbing with overflow and bad syntxx + + +http://ur%20[0-60000000000000000000 + + + +# Verify data after the test has been "shot" + +# curl: (3) [globbing] bad range in column + +3 + + + -- cgit v1.2.3