You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.
I found this when adding support to the HSTS options on node-libcurl and adding some tests.
I expected the CURLOPT_HSTSREADFUNCTION callback to not be called when CURLOPT_HSTS_CTRL is not set, as the docs say that just setting the option is not going to enable HSTS support, but it seems that libcurl still tries to call function anyway.
hsts_pull is called by Curl_hsts_loadcb during Curl_pretransfer, but it is only checking if data->set.hsts_read is set, however, Curl_easy->hsts is only initialized when CURLOPT_HSTS_CTRL is set:
I did this
Created a new easy handle and set the options
CURLOPT_URL
andCURLOPT_HSTSREADFUNCTION
.Calling
curl_easy_perform
on that easy handle triggers the following assertion failure:I expected the following
I found this when adding support to the
HSTS
options onnode-libcurl
and adding some tests.I expected the
CURLOPT_HSTSREADFUNCTION
callback to not be called whenCURLOPT_HSTS_CTRL
is not set, as the docs say that just setting the option is not going to enable HSTS support, but it seems that libcurl still tries to call function anyway.The assertion is coming from this line:
curl/lib/hsts.c
Line 431 in 1c1d9f1
hsts_pull
is called byCurl_hsts_loadcb
duringCurl_pretransfer
, but it is only checking ifdata->set.hsts_read
is set, however,Curl_easy->hsts
is only initialized whenCURLOPT_HSTS_CTRL
is set:curl/lib/setopt.c
Lines 2972 to 2983 in de1004e
Not setting it causes the assertion failure inside
hsts_pull
, ash
points to non-initialized memory.The
Curl_hsts_save
function handles this in a different way, ifh
is not set, it just returns:curl/lib/hsts.c
Lines 331 to 333 in 1c1d9f1
So I suppose
CURLOPT_HSTSWRITEFUNCTION
does not have this issue, but I have not tested it yet.curl/libcurl version
operating system
(Ubuntu running under WSL2 on Windows)
The text was updated successfully, but these errors were encountered: