From e1f3f3a14f678a8469ffd2d032fa1a237a6aad98 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 13 May 2020 00:52:34 +0200 Subject: url: reject too long input when parsing credentials Since input passed to libcurl with CURLOPT_USERPWD and CURLOPT_PROXYUSERPWD circumvents the regular string length check we have in Curl_setstropt(), the input length limit is enforced in Curl_parse_login_details too, separately. Reported-by: Thomas Bouzerar Closes #5383 --- lib/url.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'lib/url.c') diff --git a/lib/url.c b/lib/url.c index d0e60d2ea..ce94bac05 100644 --- a/lib/url.c +++ b/lib/url.c @@ -2586,6 +2586,12 @@ CURLcode Curl_parse_login_details(const char *login, const size_t len, size_t plen; size_t olen; + /* the input length check is because this is called directcly from setopt + and isn't going through the regular string length check */ + size_t llen = strlen(login); + if(llen > CURL_MAX_INPUT_LENGTH) + return CURLE_BAD_FUNCTION_ARGUMENT; + /* Attempt to find the password separator */ if(passwdp) { psep = strchr(login, ':'); -- cgit v1.2.3