Colin Hogben wrote:
> Dan Fandrich wrote:
>> I'm suggesting first strduping the data as is presently done
>> when the CURLOPT_POSTFIELDS comes in, then copying it again when the size
>> comes in the size is different from what we copied. In the case of a
>> normal C string, the size will be the same and the second copy won't
>> happen.
>>
> I think there is a potential risk if the user wishes to post a small
> amount of binary data which contains no NUL, by setting
> CURLOPT_POSTFIELDS first and then the size later. Trying to strdup it
> will run off the end, maybe for megabytes if there no NUL byte anywhere
> soon after it in memory, or you could reach an address which causes a
> memory exception.
>
Yes your right about this. The proposed solution won't work will it.
Doesn't matter if it's a small or big binary buffer with no nulls. On
manu platforums a trap signal is generated, and it's undefined behaviour
in C if you run off the end of an allocated piece of memory.

Therefore a different fix is required:- that is to copy the address of
the buffer and only extact the data from it when the perform command is
executed. This still seems a "bit risky" becase someone might deallocate
the buffer in the mean time, or at least they might if they read the
current curl documentation. It's also negates all the usefulness of the
data being eventually copied.
Received on 2007-10-12