Menu

#1267 Integer overflow in number of globbed URLs ignored or incorrectly handled

closed-fixed
None
5
2014-08-16
2013-08-15
Will Dietz
No

Silently ignoring overflow:

The following invocations cause integer overflows in curl resulting in curl doing nothing and immediately returning success (instead of performing the desired operation or reporting an error).

Overflow within single range expression:

$ curl "http://1/[0-2147483647]"
$ echo $?
0

Overflow by combining range expressions:

$ curl "http://1/[1-65536][1-32768]"
$ echo $?
0

This is due to an integer overflow while computing the total number of URL's at various locations in src/tool_urlglob.c.

Performing wrong operation instead:

$ curl "http://1/[1-65536][1-65537]"

performs the equivalent of

$ curl "http://1/1[1-65536]"

As it only goes through the first 65536 URL's instead of the total 65536*65537 URL's.

Discussion

  • Daniel Stenberg

    Daniel Stenberg - 2013-08-16

    Thanks and confirmed. I have a fix for this pending together with the other globbing fixes.

     
  • Daniel Stenberg

    Daniel Stenberg - 2013-08-16
    • status: open --> open-confirmed
    • assigned_to: Daniel Stenberg
     
  • Daniel Stenberg

    Daniel Stenberg - 2013-08-18

    Fixed in git, commit f15a88f2b25ee

     
  • Daniel Stenberg

    Daniel Stenberg - 2013-08-18
    • status: open-confirmed --> closed-fixed