From f49df54a36a39995be32782154f3ca2692f17ac4 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 6 Dec 2005 23:05:51 +0000 Subject: 7.15.1 with the now to be announced security flaw fixed --- lib/url.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/url.c b/lib/url.c index bc6033a36..3715b10ca 100644 --- a/lib/url.c +++ b/lib/url.c @@ -2378,12 +2378,18 @@ static CURLcode CreateConnection(struct SessionHandle *data, if(urllen < LEAST_PATH_ALLOC) urllen=LEAST_PATH_ALLOC; - conn->pathbuffer=(char *)malloc(urllen); + /* + * We malloc() the buffers below urllen+2 to make room for to possibilities: + * 1 - an extra terminating zero + * 2 - an extra slash (in case a syntax like "www.host.com?moo" is used) + */ + + conn->pathbuffer=(char *)malloc(urllen+2); if(NULL == conn->pathbuffer) return CURLE_OUT_OF_MEMORY; /* really bad error */ conn->path = conn->pathbuffer; - conn->host.rawalloc=(char *)malloc(urllen); + conn->host.rawalloc=(char *)malloc(urllen+2); if(NULL == conn->host.rawalloc) return CURLE_OUT_OF_MEMORY; conn->host.name = conn->host.rawalloc; -- cgit v1.2.3