Download
Browse source Changelog
Documentation
Project   Bug Bounty   Help us   Known bugs   TODO Protocols   CA bundle   HTTP Cookies   HTTP/2   SSL Certs Releases   Security   Version numbers   Vulnerabilities curl tool   man page   Tutorial   HTTP scripting Who and Why
libcurl
ABI API Competitors Examples Features Mailing list Related libs Using libcurl Tutorial Testimonials
Get Help
curl-library curl-users Mailing lists Book: Everything curl Video presentations Report a bug Paid support
Development
Autobuilds Code Style Contribute Deprecate Internals Release Notes Release Procedure Roadmap Run Tests Security Process Specifications Test curl
News
Changelog Release table
curl / Mailing Lists / curl-library / Single Mail
Buy commercial curl support from WolfSSL. We help you work out your issues, debug your libcurl applications, use the API, port to new platforms, add new features and more. With a team lead by the curl founder himself.

Re: Unit test 1655

From: Daniel Stenberg via curl-library <curl-library_at_cool.haxx.se>
Date: Wed, 13 Nov 2019 10:36:23 +0100 (CET)

On Wed, 13 Nov 2019, Niall O'Reilly wrote:

>> Ah! We should probably A) fix that and refuse such names with zero labels
>> and B) update the used host names in the test...
>
> I think I’ve covered item A as a side effect while working on prefix support.
>
> https://github.com/niallor/curl/commit/228633becd613b4c9e329117bb20d850f6418c8a
>
> Is this worth a PR yet? Or an issue?

It might be worth splitting out and fixing in a separate pull-request, sure!

Maybe that check could then also be amended to verify that the input host name
isn't longer than 253 bytes or whatever RFC 1035 dicates.

> For item B, I think a more elaborate test will be needed. I’m not sure
> what’s needed.

I think it primarily needs a valid input name (no zero length labels) that
is longer than the given output buffer, as that test tries to verify that the
boundary checks for that are fine and causes no overwrite. 

-- 
  / daniel.haxx.se | Get the best commercial curl support there is - from me
                   | Private help, bug fixes, support, ports, new features
                   | https://www.wolfssl.com/contact/

-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2019-11-13