From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 8 Sep 2016 20:59:54 +0000 (+0200)
Subject: curl_easy_escape: deny negative string lengths as input
X-Git-Tag: curl-7_50_3~4
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=826a9ced2bed217155e34065ef4048931f327b1e;p=curl

curl_easy_escape: deny negative string lengths as input

CVE-2016-7167

Bug: https://curl.haxx.se/docs/adv_20160914.html
---

diff --git a/lib/escape.c b/lib/escape.c
index 04230b4ca..63edd84fa 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -78,15 +78,21 @@ char *curl_unescape(const char *string, int length)
 char *curl_easy_escape(struct Curl_easy *data, const char *string,
                        int inlength)
 {
-  size_t alloc = (inlength?(size_t)inlength:strlen(string))+1;
+  size_t alloc;
   char *ns;
   char *testing_ptr = NULL;
   unsigned char in; /* we need to treat the characters unsigned */
-  size_t newlen = alloc;
+  size_t newlen;
   size_t strindex=0;
   size_t length;
   CURLcode result;
 
+  if(inlength < 0)
+    return NULL;
+
+  alloc = (inlength?(size_t)inlength:strlen(string))+1;
+  newlen = alloc;
+
   ns = malloc(alloc);
   if(!ns)
     return NULL;