Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

curl_version() truncates "Schannel" #5222

Closed
gvanem opened this issue Apr 12, 2020 · 1 comment
Closed

curl_version() truncates "Schannel" #5222

gvanem opened this issue Apr 12, 2020 · 1 comment

Comments

@gvanem
Copy link
Contributor

@gvanem gvanem commented Apr 12, 2020

I did this:

set CURL_SSL_BACKEND=openssl
curl -V
curl 7.70.0-DEV (i386-pc-win32) libcurl/7.70.0-DEV (GnuTLS/3.6.12) OpenSSL/3.0.0 (Schannel zlib/1.2.8
...

Drops the ) after Schannel. And a:

set CURL_SSL_BACKEND=schannel
curl -V
curl 7.70.0-DEV (i386-pc-win32) libcurl/7.70.0-DEV (GnuTLS/3.6.12) (OpenSSL/3.0.0) Schanne zlib/1.2.8

Drops the l in Schannel.

Looks like a problem in the for-loop of Curl_multissl_version().

I built with -DCURL_WITH_MULTI_SSL on Win-10 / MSVC-2019.

@gvanem
Copy link
Contributor Author

@gvanem gvanem commented Apr 12, 2020

Seems the error is in curl_version():

#ifdef USE_SSL
  char ssl_version[40];
#endif

40 bytes is way too small for Curl_multissl_version() that works with up-to 200 characters.
Easy fix:

--- a/version.c 2020-03-31 12:15:20
+++ b/version.c 2020-04-12 17:18:35
@@ -92,7 +92,7 @@
   size_t outlen;
   const char *src[14];
 #ifdef USE_SSL
-  char ssl_version[40];
+  char ssl_version[200];
 #endif

Edit: then out[] should be increased too.

bagder added a commit that referenced this issue Apr 12, 2020
Reported-by: Gisle Vanem
Fixes #5222
@bagder bagder closed this in f62bd9d Apr 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

1 participant
You can’t perform that action at this time.