From db0a0dfb0eb41d39273b0590b992df58f38b9a4d Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 29 Jul 2019 22:10:13 +0200 Subject: curl: cap the maximum allowed values for retry time arguments ... to avoid integer overflows later when multiplying with 1000 to convert seconds to milliseconds. Added test 1269 to verify. Reported-by: Jason Lee Closes #4166 --- src/tool_getparam.c | 4 ++-- src/tool_paramhlp.c | 22 ++++++++++++++++++++++ src/tool_paramhlp.h | 3 ++- 3 files changed, 26 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/tool_getparam.c b/src/tool_getparam.c index d0336351a..77a77da70 100644 --- a/src/tool_getparam.c +++ b/src/tool_getparam.c @@ -911,12 +911,12 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */ config->retry_connrefused = toggle; break; case 'h': /* --retry-delay */ - err = str2unum(&config->retry_delay, nextarg); + err = str2unummax(&config->retry_delay, nextarg, LONG_MAX/1000); if(err) return err; break; case 'i': /* --retry-max-time */ - err = str2unum(&config->retry_maxtime, nextarg); + err = str2unummax(&config->retry_maxtime, nextarg, LONG_MAX/1000); if(err) return err; break; diff --git a/src/tool_paramhlp.c b/src/tool_paramhlp.c index 3a4286c67..c9dac4f0f 100644 --- a/src/tool_paramhlp.c +++ b/src/tool_paramhlp.c @@ -197,6 +197,28 @@ ParameterError str2unum(long *val, const char *str) return PARAM_OK; } +/* + * Parse the string and write the long in the given address if it is below the + * maximum allowed value. Return PARAM_OK on success, otherwise a parameter + * error enum. ONLY ACCEPTS POSITIVE NUMBERS! + * + * Since this function gets called with the 'nextarg' pointer from within the + * getparameter a lot, we must check it for NULL before accessing the str + * data. + */ + +ParameterError str2unummax(long *val, const char *str, long max) +{ + ParameterError result = str2unum(val, str); + if(result != PARAM_OK) + return result; + if(*val > max) + return PARAM_NUMBER_TOO_LARGE; + + return PARAM_OK; +} + + /* * Parse the string and write the double in the given address. Return PARAM_OK * on success, otherwise a parameter specific error enum. diff --git a/src/tool_paramhlp.h b/src/tool_paramhlp.h index 854f52256..f13a114fd 100644 --- a/src/tool_paramhlp.h +++ b/src/tool_paramhlp.h @@ -7,7 +7,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2017, Daniel Stenberg, , et al. + * Copyright (C) 1998 - 2019, Daniel Stenberg, , et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -33,6 +33,7 @@ void cleanarg(char *str); ParameterError str2num(long *val, const char *str); ParameterError str2unum(long *val, const char *str); +ParameterError str2unummax(long *val, const char *str, long max); ParameterError str2udouble(double *val, const char *str, long max); long proto2num(struct OperationConfig *config, long *val, const char *str); -- cgit v1.2.3