Skip to content

formdata: reject a negative content length in curl_formadd - #22996

Closed
MegaManSec wants to merge 1 commit into
curl:masterfrom
MegaManSec:formadd-negative-length
Closed

formdata: reject a negative content length in curl_formadd#22996
MegaManSec wants to merge 1 commit into
curl:masterfrom
MegaManSec:formadd-negative-length

Conversation

@MegaManSec

@MegaManSec MegaManSec commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

curl_formadd() accepted a negative CURLFORM_CONTENTSLENGTH /
CURLFORM_CONTENTLEN. The value reaches
forminfo_copyfield(&form->value, (size_t)form->contentslength) and the mime
conversion as a near-SIZE_MAX length. Reject it with
CURL_FORMADD_INCOMPLETE.

@MegaManSec
formdata: reject a negative content length in curl_formadd
18b5e4e 
CURLFORM_CONTENTSLENGTH and CURLFORM_CONTENTLEN accepted a negative
length, which reached forminfo_copyfield() and the mime conversion as a
near-SIZE_MAX size_t. Return CURL_FORMADD_INCOMPLETE instead.
@github-actions github-actions Bot added the MIME label Sep 18, 2026
@MegaManSec

MegaManSec commented Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

Note: this is a hardening, obviously, and caller misuse.

@bagder bagder closed this in 7f41af8 Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bagder bagder bagder approved these changes

Assignees

No one assigned

Labels

MIME

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MegaManSec @bagder