From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 22 Dec 2025 10:36:42 +0000 (+0100)
Subject: content_encoding: avoid strcpy
X-Git-Url: https://git.feebdaed.xyz/?a=commitdiff_plain;h=6b9c75e219cdcfd3e17e7858e8ac3b59eb386ade;p=0xmirror%2Fcurl.git

content_encoding: avoid strcpy

Build list with dynbuf.

Closes #20072
---

diff --git a/lib/content_encoding.c b/lib/content_encoding.c
index 3139c5384c..d878bb49ac 100644
--- a/lib/content_encoding.c
+++ b/lib/content_encoding.c
@@ -25,6 +25,7 @@
 #include "curl_setup.h"
 
 #include "urldata.h"
+#include "curlx/dynbuf.h"
 
 #ifdef HAVE_LIBZ
 #include <zlib.h>
@@ -607,41 +608,27 @@ static const struct Curl_cwtype * const transfer_unencoders[] = {
   NULL
 };
 
-/* Provide a list of comma-separated names of supported encodings.
+/* Return the list of comma-separated names of supported encodings.
  */
-void Curl_all_content_encodings(char *buf, size_t blen)
+char *Curl_get_content_encodings(void)
 {
-  size_t len = 0;
+  struct dynbuf enc;
   const struct Curl_cwtype * const *cep;
-  const struct Curl_cwtype *ce;
-
-  DEBUGASSERT(buf);
-  DEBUGASSERT(blen);
-  buf[0] = 0;
-
-  for(cep = general_unencoders; *cep; cep++) {
-    ce = *cep;
-    if(!curl_strequal(ce->name, CONTENT_ENCODING_DEFAULT))
-      len += strlen(ce->name) + 2;
-  }
+  CURLcode result = CURLE_OK;
+  curlx_dyn_init(&enc, 255);
 
-  if(!len) {
-    if(blen >= sizeof(CONTENT_ENCODING_DEFAULT))
-      strcpy(buf, CONTENT_ENCODING_DEFAULT);
-  }
-  else if(blen > len) {
-    char *p = buf;
-    for(cep = general_unencoders; *cep; cep++) {
-      ce = *cep;
-      if(!curl_strequal(ce->name, CONTENT_ENCODING_DEFAULT)) {
-        strcpy(p, ce->name);
-        p += strlen(p);
-        *p++ = ',';
-        *p++ = ' ';
-      }
+  for(cep = general_unencoders; *cep && !result; cep++) {
+    const struct Curl_cwtype *ce = *cep;
+    if(!curl_strequal(ce->name, CONTENT_ENCODING_DEFAULT)) {
+      if(curlx_dyn_len(&enc))
+        result = curlx_dyn_addn(&enc, ", ", 2);
+      if(!result)
+        result = curlx_dyn_add(&enc, ce->name);
     }
-    p[-2] = '\0';
   }
+  if(!result)
+    return curlx_dyn_ptr(&enc);
+  return NULL;
 }
 
 /* Deferred error dummy writer. */
@@ -663,12 +650,7 @@ static CURLcode error_do_write(struct Curl_easy *data,
 
   if(!(type & CLIENTWRITE_BODY) || !nbytes)
     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
-  else {
-    char all[256];
-    (void)Curl_all_content_encodings(all, sizeof(all));
-    failf(data, "Unrecognized content encoding type. "
-          "libcurl understands %s content encodings.", all);
-  }
+  failf(data, "Unrecognized content encoding type");
   return CURLE_BAD_CONTENT_ENCODING;
 }
 
@@ -835,14 +817,9 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
   return CURLE_NOT_BUILT_IN;
 }
 
-void Curl_all_content_encodings(char *buf, size_t blen)
+char *Curl_get_content_encodings(void)
 {
-  DEBUGASSERT(buf);
-  DEBUGASSERT(blen);
-  if(blen < sizeof(CONTENT_ENCODING_DEFAULT))
-    buf[0] = 0;
-  else
-    strcpy(buf, CONTENT_ENCODING_DEFAULT);
+  return curlx_strdup(CONTENT_ENCODING_DEFAULT);
 }
 
 #endif /* CURL_DISABLE_HTTP */
diff --git a/lib/content_encoding.h b/lib/content_encoding.h
index 1addf230bb..e84a739761 100644
--- a/lib/content_encoding.h
+++ b/lib/content_encoding.h
@@ -27,7 +27,8 @@
 
 struct Curl_cwriter;
 
-void Curl_all_content_encodings(char *buf, size_t blen);
+/* returns an allocated string or NULL */
+char *Curl_get_content_encodings(void);
 
 CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
                                      const char *enclist, int is_transfer);
diff --git a/lib/setopt.c b/lib/setopt.c
index 118c4d0555..e3b5146b77 100644
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -1726,9 +1726,12 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      *
      */
     if(ptr && !*ptr) {
-      char all[256];
-      Curl_all_content_encodings(all, sizeof(all));
-      return Curl_setstropt(&s->str[STRING_ENCODING], all);
+      ptr = Curl_get_content_encodings();
+      if(ptr)
+        s->str[STRING_ENCODING] = ptr;
+      else
+        result = CURLE_OUT_OF_MEMORY;
+      return result;
     }
     return Curl_setstropt(&s->str[STRING_ENCODING], ptr);