libcurl: update to 8.10.0

1 files changed, 20 insertions, 4 deletions

diff --git a/libs/libcurl/src/urlapi.c b/libs/libcurl/src/urlapi.c
index 2179e106de..9e7565c0f7 100644
--- a/libs/libcurl/src/urlapi.c
+++ b/libs/libcurl/src/urlapi.c
@@ -41,13 +41,13 @@
 #include "curl_memory.h"

 #include "memdebug.h"

 

-  /* MSDOS/Windows style drive prefix, eg c: in c:foo */

+  /* MS-DOS/Windows style drive prefix, eg c: in c:foo */

 #define STARTS_WITH_DRIVE_PREFIX(str) \

   ((('a' <= str[0] && str[0] <= 'z') || \

     ('A' <= str[0] && str[0] <= 'Z')) && \

    (str[1] == ':'))

 

-  /* MSDOS/Windows style drive prefix, optionally with

+  /* MS-DOS/Windows style drive prefix, optionally with

    * a '|' instead of ':', followed by a slash or NUL */

 #define STARTS_WITH_URL_DRIVE_PREFIX(str) \

   ((('a' <= (str)[0] && (str)[0] <= 'z') || \

@@ -1121,7 +1121,7 @@ static CURLUcode parseurl(const char *url, CURLU *u, unsigned int flags)
      * This catches both "file:/c:" and "file:c:" */

     if(('/' == path[0] && STARTS_WITH_URL_DRIVE_PREFIX(&path[1])) ||

        STARTS_WITH_URL_DRIVE_PREFIX(path)) {

-      /* File drive letters are only accepted in MSDOS/Windows */

+      /* File drive letters are only accepted in MS-DOS/Windows */

       result = CURLUE_BAD_FILE_URL;

       goto fail;

     }

@@ -1991,7 +1991,23 @@ nomem:
         /* Skip hostname check, it is allowed to be empty. */

       }

       else {

-        if(!n || hostname_check(u, (char *)newp, n)) {

+        bool bad = FALSE;

+        if(!n)

+          bad = TRUE; /* empty hostname is not okay */

+        else if(!urlencode) {

+          /* if the host name part was not URL encoded here, it was set ready

+             URL encoded so we need to decode it to check */

+          size_t dlen;

+          char *decoded = NULL;

+          CURLcode result =

+            Curl_urldecode(newp, n, &decoded, &dlen, REJECT_CTRL);

+          if(result || hostname_check(u, decoded, dlen))

+            bad = TRUE;

+          free(decoded);

+        }

+        else if(hostname_check(u, (char *)newp, n))

+          bad = TRUE;

+        if(bad) {

           Curl_dyn_free(&enc);

           return CURLUE_BAD_HOSTNAME;

         }