Commit 1890d599 authored by Dan Fandrich's avatar Dan Fandrich
Browse files

tool_writeout: fixed a buffer read overrun on --write-out 

If a % ended the statement, the string's trailing NUL would be skipped
and memory past the end of the buffer would be accessed and potentially
displayed as part of the --write-out output. Added tests 1440 and 1441
to check for this kind of condition.

Reported-by: Brian Carpenter
parent d2bcf1e3

src/tool_writeout.c

+1 −1
Original line number Diff line number Diff line
@@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutStruct *outs, const char *writeinfo) 
  double doubleinfo;



  while(ptr && *ptr) {

    if('%' == *ptr) {

    if('%' == *ptr && ptr[1]) {

      if('%' == ptr[1]) {

        /* an escaped %-letter */

        fputc('%', stream);

tests/data/Makefile.inc

+1 −1
Original line number Diff line number Diff line
@@ -153,7 +153,7 @@ test1408 test1409 test1410 test1411 test1412 test1413 test1414 test1415 \ 
test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \

test1424 \

test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \

test1436 test1437 test1438 test1439 \

test1436 test1437 test1438 test1439 test1440 test1441 \

\

test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \

test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \

tests/data/test1440

0 → 100644
+31 −0
Original line number Diff line number Diff line 
<testcase>

<info>

<keywords>

--write-out

</keywords>

</info>

# Server-side

<reply>

</reply>



# Client-side

<client>

<server>

file

</server>



<name>

Check --write-out with trailing %{

</name>

<command>

file://localhost/%PWD/log/ --write-out '%{'

</command>

</client>



# Verify data

<verify>

<stdout nonewline="yes">

%{

</stdout>

</verify>

</testcase>

tests/data/test1441

0 → 100644
+31 −0
Original line number Diff line number Diff line 
<testcase>

<info>

<keywords>

--write-out

</keywords>

</info>

# Server-side

<reply>

</reply>



# Client-side

<client>

<server>

file

</server>



<name>

Check --write-out with trailing %

</name>

<command>

file://localhost/%PWD/log/ --write-out '%'

</command>

</client>



# Verify data

<verify>

<stdout nonewline="yes">

%

</stdout>

</verify>

</testcase>