Commit 01cf1308 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

curl_easy_unescape: deny negative string lengths as input 

CVE-2016-7167

Bug: https://curl.haxx.se/docs/adv_20160914.html
parent 826a9ced

lib/escape.c

+10 −8
Original line number Diff line number Diff line
@@ -217,6 +217,7 @@ char *curl_easy_unescape(struct Curl_easy *data, const char *string, 
                         int length, int *olen)

{

  char *str = NULL;

  if(length >= 0) {

    size_t inputlen = length;

    size_t outputlen;

    CURLcode res = Curl_urldecode(data, string, inputlen, &str, &outputlen,
@@ -225,6 +226,7 @@ char *curl_easy_unescape(struct Curl_easy *data, const char *string, 
      return NULL;

    if(olen)

      *olen = curlx_uztosi(outputlen);

  }

  return str;

}