URL parser: reject non-numerical port numbers

Test 1281 added to verify

diff --git a/lib/url.c b/lib/url.c
index dd3f62d9c8c4b228541e4cb273c8c69320fdf57a..48016e2ba9d61fb385e9ffa4e111083f33c83b8a 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -5453,11 +5453,16 @@ static CURLcode parse_remote_port(struct Curl_easy *data,
       *portptr = '\0'; /* cut off the name there */
       conn->remote_port = curlx_ultous(port);
     }
-    else
+    else {
+      if(rest[0]) {
+        failf(data, "Illegal port number");
+        return CURLE_URL_MALFORMAT;
+      }
       /* Browser behavior adaptation. If there's a colon with no digits after,
          just cut off the name there which makes us ignore the colon and just
          use the default port. Firefox and Chrome both do that. */
       *portptr = '\0';
+    }
   }
 
   /* only if remote_port was not already parsed off the URL we use the

diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
index 370c3dd455e8ae31a38aa221bb1cd00c743f6ccc..deabaacc5db2292527b5ef5793065717c69ae519 100644 (file)
--- a/tests/data/Makefile.inc
+++ b/tests/data/Makefile.inc
@@ -129,7 +129,7 @@ test1228 test1229 test1230 test1231 test1232 test1233 test1234 test1235 \
 test1236 test1237 test1238 test1239 test1240 test1241 test1242 test1243 \
 test1244 test1245 test1246 test1247 \
 \
-test1280 \
+test1280 test1281 \
 \
 test1300 test1301 test1302 test1303 test1304 test1305 test1306 test1307 \
 test1308 test1309 test1310 test1311 test1312 test1313 test1314 test1315 \

diff --git a/tests/data/test1281 b/tests/data/test1281
new file mode 100644 (file)
index 0000000..6226f86
--- /dev/null
+++ b/tests/data/test1281
@@ -0,0 +1,35 @@
+<testcase>
+<info>
+<keywords>
+URL
+</keywords>
+</info>
+
+#
+# Server-side
+<reply>
+<data>
+</data>
+</reply>
+
+# Client-side
+<client>
+<server>
+none
+</server>
+ <name>
+reject non-numerical port number in URL
+ </name>
+ <command>
+http://%HOSTIP:alpha/beta/1281
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+# 3 == CURLE_URL_MALFORMAT
+<errorcode>
+3
+</errorcode>
+</verify>
+</testcase>