idn: reject conversions that end up as a zero length hostname

Reported-by: RepoRascal on hackerone
Closes #18462

diff --git a/lib/idn.c b/lib/idn.c
index 63d2b8645a70a06d16a1fe7bc2bc8ade03c02327..28c45d66818436dfa2edccdb7c31e3668e1d31d3 100644 (file)
--- a/lib/idn.c
+++ b/lib/idn.c
@@ -323,8 +323,12 @@ CURLcode Curl_idn_decode(const char *input, char **output)
       result = CURLE_OUT_OF_MEMORY;
   }
 #endif
-  if(!result)
-    *output = d;
+  if(!result) {
+    if(!d[0]) /* ended up zero length, not acceptable */
+      result = CURLE_URL_MALFORMAT;
+    else
+      *output = d;
+  }
   return result;
 }