dnkl/foot
41
2.0k
Fork
You've already forked foot
243

uri-parse: fix out-of-bounds read, and add unit tests #2354

Manually merged
dnkl merged 2 commits from uri-parse-out-of-bounds into master 2026年05月22日 11:06:30 +02:00
Owner
Copy link

If the input URI ends with a trailing % (or a trailing %N), we read outside the provided buffer.

On NULL terminated input, this happened to work out since we'd correctly detect an invalid %-sequence as soon as we read the NULL terminator.

On input that is not NULL terminated, we're out of luck.

This patch fixes this by also checking we have enough input left to even try to read the %-digits.

Also add unit tests for this particular case.

Closes #2353

If the input URI ends with a trailing `%` (or a trailing `%N`), we read outside the provided buffer. On NULL terminated input, this happened to work out since we'd correctly detect an invalid %-sequence as soon as we read the NULL terminator. On input that is not NULL terminated, we're out of luck. This patch fixes this by also checking we have enough input left to even _try_ to read the %-digits. Also add unit tests for this particular case. Closes #2353
uri-parse: fix out-of-bounds read with malformed %-encoded content
All checks were successful
ci/woodpecker/pull_request_metadata/woodpecker Pipeline was successful
ci/woodpecker/pr/woodpecker Pipeline was successful
ci/woodpecker/pull_request_closed/woodpecker Pipeline was successful
builds.sr.ht/freebsd-x64 Job completed
ci/woodpecker/push/woodpecker Pipeline was successful
2eaa7beba1
 
If the input URI ends with a trailing '%' (or a trailing '%N'), we
read outside the provided buffer.
On NULL terminated input, this happened to work out since we'd
correctly detect an invalid %-sequence as soon as we read the NULL
terminator.
On input that is not NULL terminated, we're out of luck.
This patch fixes this by also checking we have enough input left to
even _try_ to read the %-digits.
Also add unit tests for this particular case.
Closes #2353
dnkl manually merged commit 2eaa7beba1 into master 2026年05月22日 11:06:30 +02:00
Sign in to join this conversation.
No reviewers
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
dnkl/foot!2354
Reference in a new issue
dnkl/foot
No description provided.
Delete branch "uri-parse-out-of-bounds"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?