From 02c6b984cb7a2e01f290544a53a24d30fc7ab32e Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Thu, 3 Oct 2019 13:24:43 +0200 Subject: urlapi: fix use-after-free bug Follow-up from 2c20109a9b5d04 Added test 663 to verify. Reported by OSS-Fuzz Bug: https://crbug.com/oss-fuzz/17954 Closes #4453 --- tests/data/test663 | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 tests/data/test663 (limited to 'tests/data/test663') diff --git a/tests/data/test663 b/tests/data/test663 new file mode 100644 index 000000000..b9648fd70 --- /dev/null +++ b/tests/data/test663 @@ -0,0 +1,79 @@ +# +# This test is crafted to reproduce oss-fuzz bug +# https://crbug.com/oss-fuzz/17954 +# + + + +HTTP +HTTP GET +followlocation + + +# +# Server-side + + +HTTP/1.1 302 OK +Location: http://example.net/there/it/is/../../tes t case=/6630002? yes no +Date: Thu, 09 Nov 2010 14:49:00 GMT +Content-Length: 0 + + + +HTTP/1.1 200 OK +Location: this should be ignored +Date: Thu, 09 Nov 2010 14:49:00 GMT +Content-Length: 5 + +body + + +HTTP/1.1 302 OK +Location: http://example.net/there/it/is/../../tes t case=/6630002? yes no +Date: Thu, 09 Nov 2010 14:49:00 GMT +Content-Length: 0 + +HTTP/1.1 200 OK +Location: this should be ignored +Date: Thu, 09 Nov 2010 14:49:00 GMT +Content-Length: 5 + +body + + + +# +# Client-side + + +http + + +HTTP redirect with dotdots and whitespaces in absolute Location: URL + + +http://example.com/please/../gimme/663?foobar#hello -L -x http://%HOSTIP:%HTTPPORT + + + +# +# Verify data after the test has been "shot" + + +^User-Agent:.* + + +GET http://example.com/gimme/663?foobar HTTP/1.1 +Host: example.com +Accept: */* +Proxy-Connection: Keep-Alive + +GET http://example.net/there/tes%20t%20case=/6630002?+yes+no HTTP/1.1 +Host: example.net +Accept: */* +Proxy-Connection: Keep-Alive + + + + -- cgit v1.2.3