diff options
| author | Kamil Dudka <kdudka@redhat.com> | 2016-06-03 11:26:20 +0200 |
|---|---|---|
| committer | Kamil Dudka <kdudka@redhat.com> | 2016-06-03 13:07:22 +0200 |
| commit | 584d0121c353ed855115c39f6cbc009854018029 (patch) | |
| tree | cb61f1ffb7f1a9ebf04d08ad133517622b9ef0ce /src | |
| parent | 873b4346bafdec388fa4bd61ebdee0161da661a0 (diff) | |
| download | gnurl-584d0121c353ed855115c39f6cbc009854018029.tar.gz gnurl-584d0121c353ed855115c39f6cbc009854018029.tar.bz2 gnurl-584d0121c353ed855115c39f6cbc009854018029.zip | |
tool_urlglob: fix off-by-one error in glob_parse()
... causing SIGSEGV while parsing URL with too many globs.
Minimal example:
$ curl $(for i in $(seq 101); do printf '{a}'; done)
Reported-by: Romain Coltel
Bug: https://bugzilla.redhat.com/1340757
Diffstat (limited to 'src')
| -rw-r--r-- | src/tool_urlglob.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/tool_urlglob.c b/src/tool_urlglob.c index 70d17fed1..a357b8b56 100644 --- a/src/tool_urlglob.c +++ b/src/tool_urlglob.c @@ -401,7 +401,7 @@ static CURLcode glob_parse(URLGlob *glob, char *pattern, } } - if(++glob->size > GLOB_PATTERN_NUM) + if(++glob->size >= GLOB_PATTERN_NUM) return GLOBERROR("too many globs", pos, CURLE_URL_MALFORMAT); } return res; |