cURL
Haxx ad
libcurl

curl's project page on SourceForge.net

Sponsors:
Haxx

cURL > Mailing List > Monthly Index > Single Mail

curl-tracker mailing list Archives

[ curl-Bugs-2026240 ] CURL_READFUNC_PAUSE leads to buffer overrun

From: SourceForge.net <noreply_at_sourceforge.net>
Date: Wed, 23 Jul 2008 23:50:20 +0000

Bugs item #2026240, was opened at 2008-07-23 19:50
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=2026240&group_id=976

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: libcurl
Group: bad behaviour
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: David Bau (davidbau)
Assigned to: Daniel Stenberg (bagder)
Summary: CURL_READFUNC_PAUSE leads to buffer overrun

Initial Comment:
If you return CURL_READFUNC_PAUSE from a read callback, you end up in transfer.c returning CURLE_OK from Curl_fillreadbuffer, without ever assigning to *nreadp. This leads to buffer overreading and garbage being sent on the socket.

The fix is to make sure *nreadp is assigned before exiting the function.

There is also a second problem with CURL_READFUNC_PAUSE: pausing the read callback should pause socket sends, not socket recv's. I.e., it should set KEEP_WRITE_PAUSE, not KEEP_READ_PAUSE.

A diff fixing both issues is included.

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=2026240&group_id=976
Received on 2008-07-24

These mail archives are generated by hypermail.

donate! Page updated November 12, 2010.
web site info

File upload with ASP.NET