]> granicus.if.org Git - curl/commit
CURL_MAX_INPUT_LENGTH: largest acceptable string input size
authorDaniel Stenberg <daniel@haxx.se>
Mon, 29 Apr 2019 06:00:49 +0000 (08:00 +0200)
committerDaniel Stenberg <daniel@haxx.se>
Mon, 29 Apr 2019 06:02:44 +0000 (08:02 +0200)
commit5fc28510a4664f46459d9a40187d81cc08571e60
treeb6d15dac4952967aecf54af92f5a0f5ca10fcb66
parent2fe2da9f1a6b059f94c28e963032539790dbcae5
CURL_MAX_INPUT_LENGTH: largest acceptable string input size

This limits all accepted input strings passed to libcurl to be less than
CURL_MAX_INPUT_LENGTH (8000000) bytes, for these API calls:
curl_easy_setopt() and curl_url_set().

The 8000000 number is arbitrary picked and is meant to detect mistakes
or abuse, not to limit actual practical use cases. By limiting the
acceptable string lengths we also reduce the risk of integer overflows
all over.

NOTE: This does not apply to `CURLOPT_POSTFIELDS`.

Test 1559 verifies.

Closes #3805
lib/setopt.c
lib/urlapi.c
lib/urldata.h
tests/data/Makefile.inc
tests/data/test1559 [new file with mode: 0644]
tests/libtest/Makefile.inc
tests/libtest/lib1559.c [new file with mode: 0644]