tool_urlglob: make globbing error reported for correct position

Reported by Codex Security

Closes #21561

diff --git a/src/tool_urlglob.c b/src/tool_urlglob.c
index 305efdeeccb6fe241a6065e9f1579d6dbbfeb170..72893fe661853b2f4742f84ae8688fb650cf4d95 100644 (file)
--- a/src/tool_urlglob.c
+++ b/src/tool_urlglob.c
@@ -99,7 +99,6 @@ static CURLcode glob_set(struct URLGlob *glob, const char **patternp,
   bool done = FALSE;
   const char *pattern = *patternp;
   const char *opattern = pattern;
-  size_t opos = *posp - 1;
   CURLcode result = CURLE_OK;
   size_t size = 0;
   char **elem = NULL;
@@ -109,7 +108,7 @@ static CURLcode glob_set(struct URLGlob *glob, const char **patternp,
   while(!done) {
     switch(*pattern) {
     case '\0':                  /* URL ended while set was still open */
-      result = globerror(glob, "unmatched brace", opos, CURLE_URL_MALFORMAT);
+      result = globerror(glob, "unmatched brace", *posp, CURLE_URL_MALFORMAT);
       goto error;
 
     case '{':
@@ -527,6 +526,7 @@ static CURLcode glob_parse(struct URLGlob *glob, const char *pattern,
           if(p)
             return globerror(glob, "Duplicate glob name", 2 + start - ipattern,
                              CURLE_URL_MALFORMAT);
+          pos += (pattern - start);
         }
         if(set)
           result = glob_set(glob, &pattern, &pos, amount, globindex++, &name);