idn: fix WinIDN null ptr deref on bad host

- Return CURLE_URL_MALFORMAT if IDN hostname cannot be converted from
  UTF-8 to UTF-16.

Prior to this change a failed conversion erroneously returned CURLE_OK
which meant 'decoded' pointer (what would normally point to the
punycode) would not be written to, remain NULL and be dereferenced
causing an access violation.

Closes https://github.com/curl/curl/pull/11983

diff --git a/lib/idn.c b/lib/idn.c
index 475d9c9bebe15779dd814012292b7af8e04a0ef8..a024691d1f59a57a5ede790cc3f762cdb5b5a0ff 100644 (file)
--- a/lib/idn.c
+++ b/lib/idn.c
@@ -91,6 +91,8 @@ static CURLcode win32_idn_to_ascii(const char *in, char **out)
     else
       return CURLE_URL_MALFORMAT;
   }
+  else
+    return CURLE_URL_MALFORMAT;
 
   return CURLE_OK;
 }