Conversation
Missing ferror handling in Curl_get_line causes infinite loops on I/O errors, leading to denial-of-service hangs for config/cache file loads. Follow-up to 769ccb4 Pointed out by Codex Security
There was a problem hiding this comment.
Pull request overview
Fixes a read-error hang in Curl_get_line() by returning an error when fgets() fails due to an underlying I/O error, preventing infinite loops during config/cache file loading.
Changes:
- Detect
fgets()returningNULLwithferror()set and returnCURLE_READ_ERROR.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
|
Analysis of PR #20958 at e9f3f889: Test ../../tests/http/test_05_errors.py::TestErrors::test_05_01_partial_1[h3] failed, but it has been 1.8% flaky lately, so it's probably NOT a fault of the PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them). Generated by Testclutch |
The previous problem was related to opening and reading a directory instead of a file, which probably is caught by this on most platforms but as noted before not on (Net)BSD - so we still need something like that. |
Missing ferror handling in Curl_get_line causes infinite loops on I/O errors, leading to denial-of-service hangs for config/cache file loads. Follow-up to 769ccb4 Pointed out by Codex Security Closes curl#20958
Missing ferror handling in Curl_get_line causes infinite loops on I/O errors, leading to denial-of-service hangs for config/cache file loads.
Follow-up to 769ccb4
Pointed out by Codex Security