From 172ce9cc19a72342243c0cb06b2144ac16a84f89 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 3 Oct 2017 17:00:18 +0200 Subject: setopt: avoid integer overflows when setting millsecond values ... that are multiplied by 1000 when stored. For 32 bit long systems, the max value accepted (2147483 seconds) is > 596 hours which is unlikely to ever be set by a legitimate application - and previously it didn't work either, it just caused undefined behavior. Also updated the man pages for these timeout options to mention the return code. Closes #1938 --- lib/url.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) (limited to 'lib/url.c') diff --git a/lib/url.c b/lib/url.c index 8eba5fd00..177952372 100644 --- a/lib/url.c +++ b/lib/url.c @@ -875,7 +875,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option, * Option that specifies how quickly an server response must be obtained * before it is considered failure. For pingpong protocols. */ - data->set.server_response_timeout = va_arg(param, long) * 1000; + arg = va_arg(param, long); + if((arg>=0) && (arg < (INT_MAX/1000))) + data->set.server_response_timeout = arg * 1000; + else + return CURLE_BAD_FUNCTION_ARGUMENT; break; case CURLOPT_TFTP_NO_OPTIONS: /* @@ -1725,7 +1729,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option, * The maximum time you allow curl to use for a single transfer * operation. */ - data->set.timeout = va_arg(param, long) * 1000L; + arg = va_arg(param, long); + if((arg>=0) && (arg < (INT_MAX/1000))) + data->set.timeout = arg * 1000; + else + return CURLE_BAD_FUNCTION_ARGUMENT; break; case CURLOPT_TIMEOUT_MS: @@ -1736,7 +1744,11 @@ CURLcode Curl_setopt(struct Curl_easy *data, CURLoption option, /* * The maximum time you allow curl to use to connect. */ - data->set.connecttimeout = va_arg(param, long) * 1000L; + arg = va_arg(param, long); + if((arg>=0) && (arg < (INT_MAX/1000))) + data->set.connecttimeout = arg * 1000; + else + return CURLE_BAD_FUNCTION_ARGUMENT; break; case CURLOPT_CONNECTTIMEOUT_MS: -- cgit v1.2.3