ws: reject curl_ws_recv called with NULL buffer with a buflen

Arguably this is just a bad application.

Reported in Joshua's sarif data

Closes #18656

diff --git a/lib/ws.c b/lib/ws.c
index c840961d10171be4de07642754fcee819acfc584..b6ab28a35ad0accfb0c3c87b84f1e5312e2a3f4f 100644 (file)
--- a/lib/ws.c
+++ b/lib/ws.c
@@ -1502,7 +1502,7 @@ CURLcode curl_ws_recv(CURL *d, void *buffer,
 
   *nread = 0;
   *metap = NULL;
-  if(!GOOD_EASY_HANDLE(data))
+  if(!GOOD_EASY_HANDLE(data) || (buflen && !buffer))
     return CURLE_BAD_FUNCTION_ARGUMENT;
 
   conn = data->conn;