已合并
fix CVE-2026-3784-6.0release #390
fix CVE-2026-3784-6.0release #390
已合并
hhd227创建于 3月26日
1 个文件变更+6-27
Mlib/url.c+6-27
@@ -743,34 +743,14 @@ proxy_info_matches(const struct proxy_info *data,
743{743{
744 if((data->proxytype == needle->proxytype) &&744 if((data->proxytype == needle->proxytype) &&
745 (data->port == needle->port) &&745 (data->port == needle->port) &&
746- strcasecompare(data->host.name, needle->host.name))746+ strcasecompare(data->host.name, needle->host.name)) {
747+ if(Curl_timestrcmp(data->user, needle->user) ||
748+ Curl_timestrcmp(data->passwd, needle->passwd))
749+ return FALSE;
747 return TRUE;750 return TRUE;
748- 751+ }
749 return FALSE;752 return FALSE;
750}753}
751- 
752-static bool
753-socks_proxy_info_matches(const struct proxy_info *data,
754- const struct proxy_info *needle)
755-{
756- if(!proxy_info_matches(data, needle))
757- return FALSE;
758- 
759- /* the user information is case-sensitive
760- or at least it is not defined as case-insensitive
761- see https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.1 */
762- 
763- /* curl_strequal does a case insensitive comparison,
764- so do not use it here! */
765- if(Curl_timestrcmp(data->user, needle->user) ||
766- Curl_timestrcmp(data->passwd, needle->passwd))
767- return FALSE;
768- return TRUE;
769-}
770-#else
771-/* disabled, won't get called */
772-#define proxy_info_matches(x,y) FALSE
773-#define socks_proxy_info_matches(x,y) FALSE
774#endif754#endif
775 755 
776/* A connection has to have been idle for a shorter time than 'maxage_conn'756/* A connection has to have been idle for a shorter time than 'maxage_conn'
@@ -1105,8 +1085,7 @@ ConnectionExists(struct Curl_easy *data,
1105 continue;1085 continue;
1106 1086 
1107 if(needle->bits.socksproxy &&1087 if(needle->bits.socksproxy &&
1108- !socks_proxy_info_matches(&needle->socks_proxy,1088+ !proxy_info_matches(&needle->socks_proxy, &check->socks_proxy))
1109- &check->socks_proxy))
1110 continue;1089 continue;
1111 1090 
1112 if(needle->bits.httpproxy) {1091 if(needle->bits.httpproxy) {