Skip to content

easy: validate buffer pointer in curl_easy_recv and curl_easy_send - #23063

Closed
filtede98 wants to merge 1 commit into
curl:masterfrom
filtede98:fix-easy-recv-send-null-check
Closed

filtede98 wants to merge 1 commit into
curl:masterfrom
filtede98:fix-easy-recv-send-null-check

Conversation

@filtede98

Copy link
Copy Markdown
Contributor

Summary

Both curl_easy_recv() and curl_easy_send() previously validated !n but did not validate whether buffer is NULL when a non-zero buflen is passed. Calling either function with buflen > 0 and buffer == NULL passed the pointer directly down to network socket or TLS library read/write routines, which can lead to crashes or undefined behavior.

This patch adds (buflen && !buffer) validation to both curl_easy_recv() and curl_easy_send():

  • Returns CURLE_BAD_FUNCTION_ARGUMENT if buffer is NULL while buflen > 0.
  • Keeps behavior consistent with curl_ws_send() and curl_ws_recv().
  • Adds regression assertions in tests/libtest/lib556.c.

Return CURLE_BAD_FUNCTION_ARGUMENT if a positive length is provided with a NULL buffer pointer in curl_easy_recv() and curl_easy_send().

Add regression verification to test 556.
@github-actions github-actions Bot added the tests label Sep 23, 2026
@bagder bagder closed this in f5e43ea Sep 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

2 participants