]> git.ipfire.org Git - thirdparty/curl.git/commit
http: fix crash in rate-limited upload
authorJay Satiro <raysatiro@yahoo.com>
Tue, 29 Jun 2021 15:43:35 +0000 (11:43 -0400)
committerJay Satiro <raysatiro@yahoo.com>
Tue, 29 Jun 2021 19:18:08 +0000 (15:18 -0400)
commitca8893468f3ca1bcd04a61691878e09b5824180c
tree52490c38d7f8c64d16e5b7e7a28c262047953724
parent26317223194e5df9ac6321fb78cbe1a5005dd8b6
http: fix crash in rate-limited upload

- Don't set the size of the piece of data to send to the rate limit if
  that limit is larger than the buffer size that will hold the piece.

Prior to this change if CURLOPT_MAX_SEND_SPEED_LARGE
(curl tool: --limit-rate) was set then it was possible that a temporary
buffer used for uploading could be written to out of bounds. A likely
scenario for this would be a non-trivial amount of post data combined
with a rate limit larger than CURLOPT_UPLOAD_BUFFERSIZE (default 64k).

The bug was introduced in 24e469f which is in releases since 7.76.0.

perl -e "print '0' x 200000" > tmp
curl --limit-rate 128k -d @tmp httpbin.org/post

Reported-by: Richard Marion
Fixes https://github.com/curl/curl/issues/7308
Closes https://github.com/curl/curl/pull/7315
lib/http.c