- **status**: open-confirmed --> closed-fixed

---
** [bugs:#1267] Integer overflow in number of globbed URLs ignored or incorrectly handled**
**Status:** closed-fixed
**Created:** Thu Aug 15, 2013 01:53 AM UTC by Will Dietz
**Last Updated:** Fri Aug 16, 2013 09:42 AM UTC
**Owner:** Daniel Stenberg
Silently ignoring overflow:
----------------------------
The following invocations cause integer overflows in curl resulting in curl doing nothing and immediately returning success (instead of performing the desired operation or reporting an error).
Overflow within single range expression:
~~~~
:::sh
$ curl "http://1/[0-2147483647]"
$ echo $?
0
~~~~
Overflow by combining range expressions:
~~~~
:::sh
$ curl "http://1/[1-65536][1-32768]"
$ echo $?
0
~~~~
This is due to an integer overflow while computing the total number of URL's at various locations in src/tool_urlglob.c.
Performing wrong operation instead:
-----------------------------------
~~~~
:::sh
$ curl "http://1/[1-65536][1-65537]"
~~~~
performs the equivalent of
~~~~
:::sh
$ curl "http://1/1[1-65536]"
~~~~
As it only goes through the first 65536 URL's instead of the total 65536*65537 URL's.
---
Sent from sourceforge.net because curl-tracker@cool.haxx.se is subscribed to https://sourceforge.net/p/curl/bugs/
To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/curl/admin/bugs/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.