urlapi: setting a blank URL ("") is not an ok URL

Test it in 1560
Fixes #11714
Reported-by: ad0p on github
Closes #11715

diff --git a/lib/urlapi.c b/lib/urlapi.c
index c28e67d60888938c5dc11f83ae82cc523bfd5519..80299e7c0e2b0ec37e861a68186c22a66ba56754 100644 (file)
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -1816,6 +1816,10 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
     char *oldurl;
     char *redired_url;
 
+    if(!nalloc)
+      /* a blank URL is not a valid URL */
+      return CURLUE_MALFORMED_INPUT;
+
     /* if the new thing is absolute or the old one is not
      * (we could not get an absolute url in 'oldurl'),
      * then replace the existing with the new. */

diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c
index f09f05f03ed41523fa42723d18b73dabe3f32b3f..2843b41c11e1fdf2015f7e203ab97ccda9d3a20b 100644 (file)
--- a/tests/libtest/lib1560.c
+++ b/tests/libtest/lib1560.c
@@ -151,6 +151,8 @@ struct clearurlcase {
 };
 
 static const struct testcase get_parts_list[] ={
+  {"", "", 0, 0, CURLUE_MALFORMED_INPUT},
+  {" ", "", 0, 0, CURLUE_MALFORMED_INPUT},
   {"1h://example.net", "", 0, 0, CURLUE_BAD_SCHEME},
   {"..://example.net", "", 0, 0, CURLUE_BAD_SCHEME},
   {"-ht://example.net", "", 0, 0, CURLUE_BAD_SCHEME},