From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 3 Sep 2025 07:41:29 +0000 (+0200)
Subject: idn: reject conversions that end up as a zero length hostname
X-Git-Tag: curl-8_16_0~41
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=967a626af48aafd37;p=thirdparty%2Fcurl.git

idn: reject conversions that end up as a zero length hostname

Reported-by: RepoRascal on hackerone
Closes #18462
---

diff --git a/lib/idn.c b/lib/idn.c
index 63d2b8645a..28c45d6681 100644
--- a/lib/idn.c
+++ b/lib/idn.c
@@ -323,8 +323,12 @@ CURLcode Curl_idn_decode(const char *input, char **output)
       result = CURLE_OUT_OF_MEMORY;
   }
 #endif
-  if(!result)
-    *output = d;
+  if(!result) {
+    if(!d[0]) /* ended up zero length, not acceptable */
+      result = CURLE_URL_MALFORMAT;
+    else
+      *output = d;
+  }
   return result;
 }