generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixed a NULL pointer dereference in form posting

Browse Source 
It was introduced in commit eeb2cb05 along with the -F type=
change. Also fixed a typo in the name of the magic filename=
parameter. Tweaked tests 39 and 173 to better test this path.
This commit is contained in:
Dan Fandrich
2010-08-24 16:45:31 -07:00
parent bed311eda2
commit 77ba147e76
3 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/main.c
View File

@@ -1210,8 +1210,13 @@ static int formparse(struct Configurable *config,
specified and if not we simply assume that it is text that specified and if not we simply assume that it is text that
the user wants included in the type and include that too up the user wants included in the type and include that too up
to the next zero or semicolon. */ to the next zero or semicolon. */
if((*sep==';') && !curlx_strnequal(";filname=", sep, 9)) if((*sep==';') && !curlx_strnequal(";filename=", sep, 10)) {
sep = strchr(sep+1, ';'); sep2 = strchr(sep+1, ';');
if (sep2)
sep = sep2;
else
sep = sep+strlen(sep); /* point to end of string */
}
if(*sep) { if(*sep) {
*sep=0; /* zero terminate type string */ *sep=0; /* zero terminate type string */

13
tests/data/test173
View File

@@ -1,4 +1,11 @@
<testcase> <testcase>
<info>
<keywords>
HTTP
HTTP POST
</keywords>
</info>
# Server-side # Server-side
<reply> <reply>
<data> <data>
@@ -21,7 +28,7 @@ http
HTTP RFC1867-formpost a file from stdin with "faked" filename HTTP RFC1867-formpost a file from stdin with "faked" filename
</name> </name>
<command> <command>
http://%HOSTIP:%HTTPPORT/we/want/173 -F field1=contents1 -F "fileupload=@-;filename=/dev/null" http://%HOSTIP:%HTTPPORT/we/want/173 -F field1=contents1 -F "fileupload=@-;filename=/dev/null;type=text/x-null;format=x-curl"
</command> </command>
<stdin> <stdin>
@@ -46,7 +53,7 @@ POST /we/want/173 HTTP/1.1
User-Agent: curl/7.12.1-CVS (i686-pc-linux-gnu) libcurl/7.12.1-CVS OpenSSL/0.9.6b ipv6 zlib/1.1.4 GSS libidn/0.4.6 User-Agent: curl/7.12.1-CVS (i686-pc-linux-gnu) libcurl/7.12.1-CVS OpenSSL/0.9.6b ipv6 zlib/1.1.4 GSS libidn/0.4.6
Host: %HOSTIP:%HTTPPORT Host: %HOSTIP:%HTTPPORT
Accept: */* Accept: */*
Content-Length: 359 Content-Length: 360
Expect: 100-continue Expect: 100-continue
Content-Type: multipart/form-data; boundary=----------------------------5dbea401cd8c Content-Type: multipart/form-data; boundary=----------------------------5dbea401cd8c
@@ -56,7 +63,7 @@ Content-Disposition: form-data; name="field1"
contents1 contents1
------------------------------5dbea401cd8c ------------------------------5dbea401cd8c
Content-Disposition: form-data; name="fileupload"; filename="/dev/null" Content-Disposition: form-data; name="fileupload"; filename="/dev/null"
Content-Type: application/octet-stream Content-Type: text/x-null;format=x-curl
line1 line1
line2 line2

2
tests/data/test39
View File

@@ -26,7 +26,7 @@ http
HTTP RFC1867-type formposting with filename= and type= HTTP RFC1867-type formposting with filename= and type=
</name> </name>
<command> <command>
http://%HOSTIP:%HTTPPORT/we/want/39 -F name=daniel -F tool=curl --form-string "str1=@literal" --form-string "str2=<verbatim;type=xxx/yyy" -F "file=@log/test39.txt;filename=fakerfile;type=moo/foobar" -F file2=@log/test39.txt http://%HOSTIP:%HTTPPORT/we/want/39 -F name=daniel -F tool=curl --form-string "str1=@literal" --form-string "str2=<verbatim;type=xxx/yyy" -F "file=@log/test39.txt;type=moo/foobar;filename=fakerfile" -F file2=@log/test39.txt
</command> </command>
# We create this file before the command is invoked! # We create this file before the command is invoked!
<file name="log/test39.txt"> <file name="log/test39.txt">