mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
c3e841003c
Tasks 3.3 and 4.1. - vfc curl and openssl-cve-2021-3449 excerpts re-harvested through the shared library: whole functions with upstream_start headers, the vendored key redacted code-safely, no truncated bodies. - vfc/recipes.toml carries mode, fix_path and function anchors; training/manifest.jsonl regenerated. - Juliet CWE-121 strcpy pair gets its buffer declarations back so the vulnerable side is a real overflow again. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
48 lines
1.2 KiB
C
48 lines
1.2 KiB
C
/* Provenance: curl/curl read_data (fixed).
|
|
* repo: curl/curl
|
|
* commit: 6ecdf5136b52af747e7bda08db9a748256b1cd09
|
|
* parent: 2b67a0a1129b20a56ed04859fec8999f5c0c4280
|
|
* commit_url: https://github.com/curl/curl/commit/6ecdf5136b52af747e7bda08db9a748256b1cd09
|
|
* cve: CVE-2022-32208
|
|
* license: curl
|
|
* function: read_data
|
|
* relpath: lib/krb5.c
|
|
* provenance: human
|
|
* mechanism: other
|
|
*/
|
|
|
|
static CURLcode read_data(struct connectdata *conn,
|
|
curl_socket_t fd,
|
|
struct krb5buffer *buf)
|
|
{
|
|
int len;
|
|
CURLcode result;
|
|
int nread;
|
|
|
|
result = socket_read(fd, &len, sizeof(len));
|
|
if(result)
|
|
return result;
|
|
|
|
if(len) {
|
|
/* only realloc if there was a length */
|
|
len = ntohl(len);
|
|
if(len > CURL_MAX_INPUT_LENGTH)
|
|
len = 0;
|
|
else
|
|
buf->data = Curl_saferealloc(buf->data, len);
|
|
}
|
|
if(!len || !buf->data)
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
result = socket_read(fd, buf->data, len);
|
|
if(result)
|
|
return result;
|
|
nread = conn->mech->decode(conn->app_data, buf->data, len,
|
|
conn->data_prot, conn);
|
|
if(nread < 0)
|
|
return CURLE_RECV_ERROR;
|
|
buf->size = (size_t)nread;
|
|
buf->index = 0;
|
|
return CURLE_OK;
|
|
}
|