authorgravatar for hong@hspak.comHong Shick Pak <hong@hspak.com> 2023-11-21 23:40:30-08:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-11-22 07:40:30+00:00
log994e191643f60fa2c6d6e79377340f8fad1d711b
tree9fdf11391bba5bf506ddd42c30a83f3b7be823da
parentea4a07701e15f1417aa1229235db1ca80cbda4ef
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

std.Uri: fix parsing edge case panic

1 files changed, 12 insertions(+), 0 deletions(-)

lib/std/Uri.zig+12
...@@ -176,6 +176,11 @@ pub fn parseWithoutScheme(text: []const u8) ParseError!Uri {...@@ -176,6 +176,11 @@ pub fn parseWithoutScheme(text: []const u8) ParseError!Uri {
176176
177 var end_of_host: usize = authority.len;177 var end_of_host: usize = authority.len;
178178
179 // if we see `]` first without `@`
180 if (authority[start_of_host] == ']') {
181 return error.InvalidFormat;
182 }
183
179 if (authority.len > start_of_host and authority[start_of_host] == '[') { // IPv6184 if (authority.len > start_of_host and authority[start_of_host] == '[') { // IPv6
180 end_of_host = std.mem.lastIndexOf(u8, authority, "]") orelse return error.InvalidFormat;185 end_of_host = std.mem.lastIndexOf(u8, authority, "]") orelse return error.InvalidFormat;
181 end_of_host += 1;186 end_of_host += 1;
...@@ -193,6 +198,7 @@ pub fn parseWithoutScheme(text: []const u8) ParseError!Uri {...@@ -193,6 +198,7 @@ pub fn parseWithoutScheme(text: []const u8) ParseError!Uri {
193 }198 }
194 }199 }
195200
201 if (start_of_host >= end_of_host) return error.InvalidFormat;
196 uri.host = authority[start_of_host..end_of_host];202 uri.host = authority[start_of_host..end_of_host];
197 }203 }
198204
...@@ -780,3 +786,9 @@ test "format" {...@@ -780,3 +786,9 @@ test "format" {
780 try uri.format(":/?#", .{}, buf.writer());786 try uri.format(":/?#", .{}, buf.writer());
781 try std.testing.expectEqualSlices(u8, "file:/foo/bar/baz", buf.items);787 try std.testing.expectEqualSlices(u8, "file:/foo/bar/baz", buf.items);
782}788}
789
790test "URI malformed input" {
791 try std.testing.expectError(error.InvalidFormat, std.Uri.parse("http://]["));
792 try std.testing.expectError(error.InvalidFormat, std.Uri.parse("http://]@["));
793 try std.testing.expectError(error.InvalidFormat, std.Uri.parse("http://lo]s\x85hc@[/8\x10?0Q"));
794}