Hello community, here is the log from the commit of package uriparser for openSUSE:Factory checked in at 2019-01-25 22:41:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/uriparser (Old) and /work/SRC/openSUSE:Factory/.uriparser.new.28833 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "uriparser" Fri Jan 25 22:41:36 2019 rev:5 rq:666491 version:0.9.1 Changes: -------- --- /work/SRC/openSUSE:Factory/uriparser/uriparser.changes 2018-11-20 22:26:07.722822141 +0100 +++ /work/SRC/openSUSE:Factory/.uriparser.new.28833/uriparser.changes 2019-01-25 22:41:38.419355703 +0100 @@ -1,0 +2,17 @@ +Wed Jan 16 14:00:52 UTC 2019 - [email protected] + +- Update to version 0.9.1 + * Fixed Out-of-bounds read in uriParse*Ex* for incomplete URIs + with IPv6 addresses with embedded IPv4 address, e.g. "//[::44.1" + mitigated if passed parameter <afterLast> points to readable + memory containing a '\0' byte. (bsc#1122193, CVE-2018-20721) + * Fixed: When parsing a malformed URI with an IPvFuture address + (e.g. "http://[vA.123456"; missing "]"), errorPos would point + to the first character after "v" than the actual position of the + error (here: the end of the string) + * Fixed: uriToStringCharsRequired* reported 1 more byte than + needed for IPv4 address URIs (GitHub #41); + * Improved: For parse errors, waterproof errorPos <= afterLast + * Soname: 1:24:0 + +------------------------------------------------------------------- Old: ---- uriparser-0.9.0.tar.bz2 New: ---- uriparser-0.9.1.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ uriparser.spec ++++++ --- /var/tmp/diff_new_pack.tfHSYj/_old 2019-01-25 22:41:39.231354703 +0100 +++ /var/tmp/diff_new_pack.tfHSYj/_new 2019-01-25 22:41:39.243354688 +0100 @@ -1,7 +1,7 @@ # # spec file for package uriparser # -# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -20,7 +20,7 @@ %define so_ver 1 Name: uriparser -Version: 0.9.0 +Version: 0.9.1 Release: 0 Summary: A strictly RFC 3986 compliant URI parsing library License: BSD-3-Clause AND LGPL-2.1-or-later ++++++ uriparser-0.9.0.tar.bz2 -> uriparser-0.9.1.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/ChangeLog new/uriparser-0.9.1/ChangeLog --- old/uriparser-0.9.0/ChangeLog 2018-10-27 00:32:21.000000000 +0200 +++ new/uriparser-0.9.1/ChangeLog 2019-01-02 17:54:41.000000000 +0100 @@ -2,16 +2,41 @@ https://github.com/uriparser/uriparser/labels/help%20wanted If you can help, please get in touch. Thanks! +2019-01-02 -- 0.9.1 + +>>>>>>>>>>>>> SECURITY >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> + * Fixed: + Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6 + addresses with embedded IPv4 address, e.g. "//[::44.1"; + mitigated if passed parameter <afterLast> points to readable memory + containing a '\0' byte. + Thanks to Joergen Ibsen for the report! +>>>>>>>>>>>>> SECURITY >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> + * Fixed: When parsing a malformed URI with an IPvFuture address + (e.g. "http://[vA.123456"; missing "]"), errorPos would point to the first + character after "v" than the actual position of the error (here: the end + of the string) + * Fixed: uriToStringCharsRequired* reported 1 more byte than actually needed + for IPv4 address URIs (GitHub #41); Thanks to @gyh007 for the patch! + * Fixed: Compilation with MinGW + Thanks to Sandro Mani for the patch! + * Fixed: Drop use of asprintf from the test suite for MinGW (GitHub #40) + * Improved: For parse errors, waterproof errorPos <= afterLast + * Soname: 1:24:0 + 2018-10-27 -- 0.9.0 >>>>>>>>>>>>> SECURITY >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> - * Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx* + * Fixed: [CVE-2018-19198] + Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx* Commit 864f5d4c127def386dd5cc926ad96934b297f04e Thanks to Google Autofuzz team for the report! - * Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx* + * Fixed: [CVE-2018-19199] + Detect integer overflow in uriComposeQuery* and uriComposeQueryEx* Commit f76275d4a91b28d687250525d3a0c5509bbd666f Thanks to Google Autofuzz team for the report! - * Fixed: Protect uriResetUri* against acting on NULL input + * Fixed: [CVE-2018-19200] + Protect uriResetUri* against acting on NULL input Commit f58c25069cf4a986fe17a80c5b38687e31feb539 >>>>>>>>>>>>> SECURITY >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> * Fixed: Be fully compliant to C89 (Gitub #28) and C++98 in test code diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/Makefile.am new/uriparser-0.9.1/Makefile.am --- old/uriparser-0.9.0/Makefile.am 2018-10-27 00:18:36.000000000 +0200 +++ new/uriparser-0.9.1/Makefile.am 2019-01-02 17:55:00.000000000 +0100 @@ -18,6 +18,9 @@ uriparse_CFLAGS = -Iinclude uriparse_LDADD = $(top_builddir)/liburiparser.la uriparse_DEPENDENCIES = $(top_builddir)/liburiparser.la +if WIN32 +uriparse_LDADD += -lws2_32 +endif pkgconfig_DATA = liburiparser.pc @@ -34,7 +37,7 @@ include/uriparser/UriIp4.h -liburiparser_la_LDFLAGS = -version-info 1:23:0 +liburiparser_la_LDFLAGS = -version-info 1:24:0 if WIN32 liburiparser_la_LDFLAGS += -no-undefined endif diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/Makefile.in new/uriparser-0.9.1/Makefile.in --- old/uriparser-0.9.0/Makefile.in 2018-10-27 00:35:09.000000000 +0200 +++ new/uriparser-0.9.1/Makefile.in 2019-01-02 18:00:11.000000000 +0100 @@ -94,7 +94,8 @@ @URI_TEST_ENABLED_TRUE@check_PROGRAMS = test/uriparser_test$(EXEEXT) @URI_TEST_ENABLED_TRUE@TESTS = test/uriparser_test$(EXEEXT) bin_PROGRAMS = uriparse$(EXEEXT) -@WIN32_TRUE@am__append_1 = -no-undefined +@WIN32_TRUE@am__append_1 = -lws2_32 +@WIN32_TRUE@am__append_2 = -no-undefined subdir = . ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \ @@ -175,6 +176,7 @@ $(test_uriparser_test_LDFLAGS) $(LDFLAGS) -o $@ am_uriparse_OBJECTS = tool/uriparse-uriparse.$(OBJEXT) uriparse_OBJECTS = $(am_uriparse_OBJECTS) +am__DEPENDENCIES_1 = uriparse_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(uriparse_CFLAGS) \ $(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@ @@ -644,7 +646,7 @@ lib_LTLIBRARIES = liburiparser.la uriparse_SOURCES = tool/uriparse.c uriparse_CFLAGS = -Iinclude -uriparse_LDADD = $(top_builddir)/liburiparser.la +uriparse_LDADD = $(top_builddir)/liburiparser.la $(am__append_1) uriparse_DEPENDENCIES = $(top_builddir)/liburiparser.la pkgconfig_DATA = liburiparser.pc pkgconfigdir = $(libdir)/pkgconfig @@ -656,7 +658,7 @@ include/uriparser/UriDefsUnicode.h \ include/uriparser/UriIp4.h -liburiparser_la_LDFLAGS = -version-info 1:23:0 $(am__append_1) +liburiparser_la_LDFLAGS = -version-info 1:24:0 $(am__append_2) liburiparser_la_SOURCES = \ src/UriCommon.c \ src/UriCommon.h \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/configure new/uriparser-0.9.1/configure --- old/uriparser-0.9.0/configure 2018-10-27 00:35:09.000000000 +0200 +++ new/uriparser-0.9.1/configure 2019-01-02 18:00:10.000000000 +0100 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for uriparser 0.9.0. +# Generated by GNU Autoconf 2.69 for uriparser 0.9.1. # # Report bugs to <https://github.com/uriparser/uriparser/issues>. # @@ -590,8 +590,8 @@ # Identity of this package. PACKAGE_NAME='uriparser' PACKAGE_TARNAME='uriparser' -PACKAGE_VERSION='0.9.0' -PACKAGE_STRING='uriparser 0.9.0' +PACKAGE_VERSION='0.9.1' +PACKAGE_STRING='uriparser 0.9.1' PACKAGE_BUGREPORT='https://github.com/uriparser/uriparser/issues' PACKAGE_URL='https://uriparser.github.io/' @@ -1348,7 +1348,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures uriparser 0.9.0 to adapt to many kinds of systems. +\`configure' configures uriparser 0.9.1 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1418,7 +1418,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of uriparser 0.9.0:";; + short | recursive ) echo "Configuration of uriparser 0.9.1:";; esac cat <<\_ACEOF @@ -1548,7 +1548,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -uriparser configure 0.9.0 +uriparser configure 0.9.1 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2038,7 +2038,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by uriparser $as_me 0.9.0, which was +It was created by uriparser $as_me 0.9.1, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2901,7 +2901,7 @@ # Define the identity of the package. PACKAGE='uriparser' - VERSION='0.9.0' + VERSION='0.9.1' cat >>confdefs.h <<_ACEOF @@ -17746,7 +17746,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by uriparser $as_me 0.9.0, which was +This file was extended by uriparser $as_me 0.9.1, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -17813,7 +17813,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -uriparser config.status 0.9.0 +uriparser config.status 0.9.1 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/configure.ac new/uriparser-0.9.1/configure.ac --- old/uriparser-0.9.0/configure.ac 2018-10-27 00:18:36.000000000 +0200 +++ new/uriparser-0.9.1/configure.ac 2019-01-02 17:56:39.000000000 +0100 @@ -1,5 +1,5 @@ AC_PREREQ(2.61) -AC_INIT([uriparser], [0.9.0], [https://github.com/uriparser/uriparser/issues], +AC_INIT([uriparser], [0.9.1], [https://github.com/uriparser/uriparser/issues], [uriparser], [https://uriparser.github.io/]) AC_CONFIG_AUX_DIR([build-aux]) AM_INIT_AUTOMAKE([1.10.1 foreign dist-zip dist-bzip2 no-dist-gzip subdir-objects]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/include/uriparser/Uri.h new/uriparser-0.9.1/include/uriparser/Uri.h --- old/uriparser-0.9.0/include/uriparser/Uri.h 2018-10-27 00:18:36.000000000 +0200 +++ new/uriparser-0.9.1/include/uriparser/Uri.h 2019-01-02 17:56:32.000000000 +0100 @@ -1,4 +1,4 @@ -/* c071c0bd2264218705abd9e6b19250adb67d6fefa4866d705b9d2f2672281001 (0.9.0+) +/* 561572cef718ad662595da3d4a1436cd3c2526234593c4c86e82ba08bfd292d8 (0.9.1+) * * uriparser - RFC 3986 URI parsing library * diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/include/uriparser/UriBase.h new/uriparser-0.9.1/include/uriparser/UriBase.h --- old/uriparser-0.9.0/include/uriparser/UriBase.h 2018-10-27 00:18:36.000000000 +0200 +++ new/uriparser-0.9.1/include/uriparser/UriBase.h 2019-01-02 17:55:48.000000000 +0100 @@ -55,7 +55,7 @@ /* Version */ #define URI_VER_MAJOR 0 #define URI_VER_MINOR 9 -#define URI_VER_RELEASE 0 +#define URI_VER_RELEASE 1 #define URI_VER_SUFFIX_ANSI "" #define URI_VER_SUFFIX_UNICODE URI_ANSI_TO_UNICODE(URI_VER_SUFFIX_ANSI) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/src/UriParse.c new/uriparser-0.9.1/src/UriParse.c --- old/uriparser-0.9.0/src/UriParse.c 2018-10-27 00:18:36.000000000 +0200 +++ new/uriparser-0.9.1/src/UriParse.c 2018-12-08 19:50:07.000000000 +0100 @@ -388,7 +388,7 @@ const URI_CHAR * first, const URI_CHAR * afterLast, UriMemoryManager * memory) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -468,7 +468,7 @@ const URI_CHAR * first, const URI_CHAR * afterLast, UriMemoryManager * memory) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -480,7 +480,7 @@ case _UT('v'): */ if (first + 1 >= afterLast) { - URI_FUNC(StopSyntax)(state, first + 1, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -493,8 +493,11 @@ if (afterHexZero == NULL) { return NULL; } - if ((afterHexZero >= afterLast) - || (*afterHexZero != _UT('.'))) { + if (afterHexZero >= afterLast) { + URI_FUNC(StopSyntax)(state, afterLast, memory); + return NULL; + } + if (*afterHexZero != _UT('.')) { URI_FUNC(StopSyntax)(state, afterHexZero, memory); return NULL; } @@ -532,7 +535,7 @@ URI_TYPE(ParserState) * state, const URI_CHAR * first, const URI_CHAR * afterLast, UriMemoryManager * memory) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -544,9 +547,12 @@ if (afterIpFuture == NULL) { return NULL; } - if ((afterIpFuture >= afterLast) - || (*afterIpFuture != _UT(']'))) { - URI_FUNC(StopSyntax)(state, first, memory); + if (afterIpFuture >= afterLast) { + URI_FUNC(StopSyntax)(state, afterLast, memory); + return NULL; + } + if (*afterIpFuture != _UT(']')) { + URI_FUNC(StopSyntax)(state, afterIpFuture, memory); return NULL; } return afterIpFuture + 1; @@ -589,7 +595,7 @@ for (;;) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -692,6 +698,11 @@ return NULL; } first++; + + if (first >= afterLast) { + URI_FUNC(StopSyntax)(state, afterLast, memory); + return NULL; + } } } else { /* Eat while no dot in sight */ @@ -752,7 +763,7 @@ /* "::"? */ if (first + 1 >= afterLast) { - URI_FUNC(StopSyntax)(state, first + 1, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } if (first[1] == _UT(':')) { @@ -770,7 +781,7 @@ /* ":::+"? */ if (first + 1 >= afterLast) { - URI_FUNC(StopSyntax)(state, first + 1, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; /* No ']' yet */ } if (first[1] == _UT(':')) { @@ -862,7 +873,7 @@ first++; if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; /* No ']' yet */ } } while (walking); @@ -1147,7 +1158,7 @@ URI_TYPE(ParserState) * state, const URI_CHAR * first, const URI_CHAR * afterLast, UriMemoryManager * memory) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -1311,7 +1322,7 @@ URI_TYPE(ParserState) * state, const URI_CHAR * first, const URI_CHAR * afterLast, UriMemoryManager * memory) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -1519,7 +1530,7 @@ const URI_CHAR * first, const URI_CHAR * afterLast, UriMemoryManager * memory) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -1564,7 +1575,7 @@ const URI_CHAR * first, const URI_CHAR * afterLast, UriMemoryManager * memory) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -1576,14 +1587,14 @@ case _UT('%'): */ if (first + 1 >= afterLast) { - URI_FUNC(StopSyntax)(state, first + 1, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } switch (first[1]) { case URI_SET_HEXDIG: if (first + 2 >= afterLast) { - URI_FUNC(StopSyntax)(state, first + 2, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -1621,7 +1632,7 @@ const URI_CHAR * first, const URI_CHAR * afterLast, UriMemoryManager * memory) { if (first >= afterLast) { - URI_FUNC(StopSyntax)(state, first, memory); + URI_FUNC(StopSyntax)(state, afterLast, memory); return NULL; } @@ -2170,10 +2181,18 @@ /* Parse */ afterUriReference = URI_FUNC(ParseUriReference)(state, first, afterLast, memory); if (afterUriReference == NULL) { + /* Waterproof errorPos <= afterLast */ + if (state->errorPos && (state->errorPos > afterLast)) { + state->errorPos = afterLast; + } return state->errorCode; } if (afterUriReference != afterLast) { - URI_FUNC(StopSyntax)(state, afterUriReference, memory); + if (afterUriReference < afterLast) { + URI_FUNC(StopSyntax)(state, afterUriReference, memory); + } else { + URI_FUNC(StopSyntax)(state, afterLast, memory); + } return state->errorCode; } return URI_SUCCESS; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/src/UriRecompose.c new/uriparser-0.9.1/src/UriRecompose.c --- old/uriparser-0.9.0/src/UriRecompose.c 2018-10-17 20:43:43.000000000 +0200 +++ new/uriparser-0.9.1/src/UriRecompose.c 2018-12-08 17:29:56.000000000 +0100 @@ -246,7 +246,7 @@ } } } else { - (*charsRequired) += charsToWrite + 1; + (*charsRequired) += charsToWrite + ((i == 3) ? 0 : 1); } } } else if (uri->hostData.ip6 != NULL) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/test/VersionSuite.cpp new/uriparser-0.9.1/test/VersionSuite.cpp --- old/uriparser-0.9.0/test/VersionSuite.cpp 2018-10-27 00:18:36.000000000 +0200 +++ new/uriparser-0.9.1/test/VersionSuite.cpp 2018-11-28 15:08:44.000000000 +0100 @@ -20,9 +20,6 @@ #include <gtest/gtest.h> -#ifndef _GNU_SOURCE -# define _GNU_SOURCE // for asprintf -#endif #include <stdio.h> @@ -31,8 +28,8 @@ TEST(VersionSuite, EnsureVersionDefinesInSync) { - char * INSIDE_VERSION = NULL; - const int bytes_printed = asprintf(&INSIDE_VERSION, "%d.%d.%d%s", + char INSIDE_VERSION[256]; + const int bytes_printed = sprintf(INSIDE_VERSION, "%d.%d.%d%s", URI_VER_MAJOR, URI_VER_MINOR, URI_VER_RELEASE, URI_VER_SUFFIX_ANSI); ASSERT_TRUE(bytes_printed != -1); @@ -42,6 +39,5 @@ printf(" Tarball version: <%s>\n", PACKAGE_VERSION); printf(" Header defines version: <%s>\n", INSIDE_VERSION); } - free(INSIDE_VERSION); ASSERT_TRUE(equal); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/test/test.cpp new/uriparser-0.9.1/test/test.cpp --- old/uriparser-0.9.0/test/test.cpp 2018-10-27 00:18:36.000000000 +0200 +++ new/uriparser-0.9.1/test/test.cpp 2018-12-08 19:32:31.000000000 +0100 @@ -242,6 +242,19 @@ URI_TEST_IP_SIX_FAIL("g:0:0:0:0:0:0"); } +TEST(UriSuite, TestIpSixOverread) { + UriUriA uri; + const char * errorPos; + + // NOTE: This string is designed to not have a terminator + char uriText[2 + 3 + 2 + 1 + 1]; + strncpy(uriText, "//[::44.1", sizeof(uriText)); + + EXPECT_EQ(uriParseSingleUriExA(&uri, uriText, + uriText + sizeof(uriText), &errorPos), URI_ERROR_SYNTAX); + EXPECT_EQ(errorPos, uriText + sizeof(uriText)); +} + TEST(UriSuite, TestUri) { UriParserStateA stateA; UriParserStateW stateW; @@ -1214,6 +1227,8 @@ return false; } + EXPECT_EQ(charsRequired, wcslen(text)); + // Minimum wchar_t * buffer = new wchar_t[charsRequired + 1]; if (uriToStringW(buffer, &uri, charsRequired + 1, NULL) != 0) { @@ -1236,15 +1251,24 @@ } // namespace TEST(UriSuite, TestToStringCharsRequired) { - ASSERT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/";)); - ASSERT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com:80/";)); - ASSERT_TRUE(testToStringCharsRequiredHelper(L"http://user:[email protected]/";)); - ASSERT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/index.html";)); - ASSERT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/?abc";)); - ASSERT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/#def";)); - ASSERT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/?abc#def";)); - ASSERT_TRUE(testToStringCharsRequiredHelper(L"/test")); - ASSERT_TRUE(testToStringCharsRequiredHelper(L"test")); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://1.1.1.1/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://12.1.1.1/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://123.1.1.1/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://1.12.1.1/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://1.123.1.1/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://1.1.12.1/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://1.1.123.1/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://1.1.1.12/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://1.1.1.123/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com:80/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://user:[email protected]/";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/index.html";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/?abc";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/#def";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"http://www.example.com/?abc#def";)); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"/test")); + EXPECT_TRUE(testToStringCharsRequiredHelper(L"test")); } namespace { @@ -2041,6 +2065,16 @@ "http://example2/x/y/z";); } +TEST(ErrorPosSuite, TestErrorPosIPvFuture) { + UriUriA uri; + const char * errorPos; + + const char * const uriText = "http://[vA.123456";; // missing "]" + EXPECT_EQ(uriParseSingleUriA(&uri, uriText, &errorPos), + URI_ERROR_SYNTAX); + EXPECT_EQ(errorPos, uriText + strlen(uriText)); +} + TEST(UriParseSingleSuite, Success) { UriUriA uri; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/uriparser-0.9.0/tool/uriparse.c new/uriparser-0.9.1/tool/uriparse.c --- old/uriparser-0.9.0/tool/uriparse.c 2018-10-17 20:43:43.000000000 +0200 +++ new/uriparser-0.9.1/tool/uriparse.c 2018-10-31 22:03:45.000000000 +0100 @@ -36,12 +36,20 @@ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. */ -#include <sys/socket.h> #include <stdio.h> #include <stdlib.h> #include <uriparser/Uri.h> -#include <arpa/inet.h> -#include <netinet/in.h> + +#ifdef _WIN32 +# include <winsock2.h> +# include <ws2tcpip.h> +WINSOCK_API_LINKAGE const char WSAAPI inet_ntop( + int af, const void *src, char *dst, socklen_t size); +#else +# include <sys/socket.h> +# include <arpa/inet.h> +# include <netinet/in.h> +#endif #define RANGE(x) (int)((x).afterLast-(x).first), ((x).first) @@ -76,7 +84,8 @@ : (state.errorCode == URI_ERROR_MALLOC) ? "not enough memory" : "liburiparser bug (please report)", - state.errorPos, state.errorPos - argv[i]); + state.errorPos, + (long unsigned int)(state.errorPos - argv[i])); retval = EXIT_FAILURE; } else { if (uri.scheme.first) {
