urlapi: avoid null deref if setting blank host to url encode

Reported-by: kirbyn17 on hackerone
Closes #12240

diff --git a/lib/urlapi.c b/lib/urlapi.c
index 91f615c3bc34db9d0e27cd91ec5964206d913f6a..be27b02332419cf7e0a1570bf4be5e5635285d61 100644 (file)
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -1931,8 +1931,8 @@ nomem:
       }
     }
 
-    if(what == CURLUPART_HOST) {
-      size_t n = strlen(newp);
+    else if(what == CURLUPART_HOST) {
+      size_t n = Curl_dyn_len(&enc);
       if(!n && (flags & CURLU_NO_AUTHORITY)) {
         /* Skip hostname check, it's allowed to be empty. */
       }