From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 23 Aug 2023 12:30:17 +0000 (+0200)
Subject: urlapi: setting a blank URL ("") is not an ok URL
X-Git-Tag: curl-8_3_0~117
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=887b998e6e11076fb62ed2726e5d7d700d5f89d8;p=thirdparty%2Fcurl.git

urlapi: setting a blank URL ("") is not an ok URL

Test it in 1560
Fixes #11714
Reported-by: ad0p on github
Closes #11715
---

diff --git a/lib/urlapi.c b/lib/urlapi.c
index c28e67d608..80299e7c0e 100644
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -1816,6 +1816,10 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
     char *oldurl;
     char *redired_url;
 
+    if(!nalloc)
+      /* a blank URL is not a valid URL */
+      return CURLUE_MALFORMED_INPUT;
+
     /* if the new thing is absolute or the old one is not
      * (we could not get an absolute url in 'oldurl'),
      * then replace the existing with the new. */
diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c
index f09f05f03e..2843b41c11 100644
--- a/tests/libtest/lib1560.c
+++ b/tests/libtest/lib1560.c
@@ -151,6 +151,8 @@ struct clearurlcase {
 };
 
 static const struct testcase get_parts_list[] ={
+  {"", "", 0, 0, CURLUE_MALFORMED_INPUT},
+  {" ", "", 0, 0, CURLUE_MALFORMED_INPUT},
   {"1h://example.net", "", 0, 0, CURLUE_BAD_SCHEME},
   {"..://example.net", "", 0, 0, CURLUE_BAD_SCHEME},
   {"-ht://example.net", "", 0, 0, CURLUE_BAD_SCHEME},