urlapi: prevent a terminal `.0x` component to normalize IPv4

Extend test 1560 to verify

Follow-up to 831a1514843bfa4d4d006627

Spotted by Codex Security
Closes #21652

diff --git a/lib/urlapi.c b/lib/urlapi.c
index 71f2756ca034b7cf0236685cb1d25475258bc9dc..dfb106dd2f0ac0d9a15d31996fe2d43eb119a690 100644 (file)
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -523,6 +523,8 @@ UNITTEST int ipv4_normalize(struct dynbuf *host)
       if(c[1] == 'x') {
         c += 2; /* skip the prefix */
         rc = curlx_str_hex(&c, &l, UINT_MAX);
+        if(rc)
+          return HOST_NAME;
       }
       else
         rc = curlx_str_octal(&c, &l, UINT_MAX);

diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c
index 533a44e98376c30cd84e659c5f002acd8aa54094..3eeed6b6943d7004375416d25c964291d0640b2a 100644 (file)
--- a/tests/libtest/lib1560.c
+++ b/tests/libtest/lib1560.c
@@ -625,6 +625,10 @@ static const struct testcase get_parts_list[] = {
 };
 
 static const struct urltestcase get_url_list[] = {
+  {"https://127.1.0x", "https://127.1.0x/", 0, 0, CURLUE_OK},
+  {"https://127.0x", "https://127.0x/", 0, 0, CURLUE_OK},
+  {"https://127.0x.1", "https://127.0x.1/", 0, 0, CURLUE_OK},
+  {"https://127.1.1.0x", "https://127.1.1.0x/", 0, 0, CURLUE_OK},
   {"https://127.1.", "https://127.0.0.1/", 0, 0, CURLUE_OK},
   {"https://127.1.:443", "https://127.0.0.1:443/", 0, 0, CURLUE_OK},
   {"https://127.1.?moo", "https://127.0.0.1/?moo", 0, 0, CURLUE_OK},