From 26e464767ab53cb78e4ede10c77fe12907a7daad Mon Sep 17 00:00:00 2001 From: Thiruvadi Rajaraman Date: Sat, 4 Nov 2017 08:08:25 -0700 Subject: curl: Security fix for CVE-2016-8624 Affected versions: curl 7.1 to and including 7.50.3 Not affected versions: curl >= 7.51.0 Signed-off-by: Thiruvadi Rajaraman Signed-off-by: Armin Kuster --- meta/recipes-support/curl/curl/CVE-2016-8624.patch | 68 ++++++++++++++++++++++ meta/recipes-support/curl/curl_7.50.1.bb | 1 + 2 files changed, 69 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2016-8624.patch (limited to 'meta/recipes-support') diff --git a/meta/recipes-support/curl/curl/CVE-2016-8624.patch b/meta/recipes-support/curl/curl/CVE-2016-8624.patch new file mode 100644 index 0000000000..b9e000ecb5 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2016-8624.patch @@ -0,0 +1,68 @@ +From 44ab42e55bbe329777ee05d50aea1ee059221652 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Tue, 11 Oct 2016 00:48:35 +0200 +Subject: [PATCH] urlparse: accept '#' as end of host name + +'http://example.com#@127.0.0.1/x.txt' equals a request to example.com +for the '/' document with the rest of the URL being a fragment. + +Upstream-Status: Backport + +CVE: CVE-2016-8624 +Signed-off-by: Thiruvadi Rajaraman + +--- + lib/url.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/lib/url.c b/lib/url.c +index 74e9bf5..ce94281 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -4159,11 +4159,11 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data, + /* clear path */ + char slashbuf[4]; + path[0]=0; + + rc = sscanf(data->change.url, +- "%15[^\n:]:%3[/]%[^\n/?]%[^\n]", ++ "%15[^\n:]:%3[/]%[^\n/?#]%[^\n]", + protobuf, slashbuf, conn->host.name, path); + if(2 == rc) { + failf(data, "Bad URL"); + return CURLE_URL_MALFORMAT; + } +@@ -4171,11 +4171,11 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data, + + /* + * The URL was badly formatted, let's try the browser-style _without_ + * protocol specified like 'http://'. + */ +- rc = sscanf(data->change.url, "%[^\n/?]%[^\n]", conn->host.name, path); ++ rc = sscanf(data->change.url, "%[^\n/?#]%[^\n]", conn->host.name, path); + if(1 > rc) { + /* + * We couldn't even get this format. + * djgpp 2.04 has a sscanf() bug where 'conn->host.name' is + * assigned, but the return value is EOF! +@@ -4276,14 +4276,14 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data, + strcpy(path, "/"); + rebuild_url = TRUE; + } + + /* If the URL is malformatted (missing a '/' after hostname before path) we +- * insert a slash here. The only letter except '/' we accept to start a path +- * is '?'. ++ * insert a slash here. The only letters except '/' that can start a path is ++ * '?' and '#' - as controlled by the two sscanf() patterns above. + */ +- if(path[0] == '?') { ++ if(path[0] != '/') { + /* We need this function to deal with overlapping memory areas. We know + that the memory area 'path' points to is 'urllen' bytes big and that + is bigger than the path. Use +1 to move the zero byte too. */ + memmove(&path[1], path, strlen(path)+1); + path[0] = '/'; +-- +2.9.3 + diff --git a/meta/recipes-support/curl/curl_7.50.1.bb b/meta/recipes-support/curl/curl_7.50.1.bb index ad7d83dac7..bdf5d73b31 100644 --- a/meta/recipes-support/curl/curl_7.50.1.bb +++ b/meta/recipes-support/curl/curl_7.50.1.bb @@ -20,6 +20,7 @@ SRC_URI += " file://configure_ac.patch \ file://CVE-2016-8621.patch \ file://CVE-2016-8623.patch \ file://CVE-2016-8617.patch \ + file://CVE-2016-8624.patch \ " SRC_URI[md5sum] = "015f6a0217ca6f2c5442ca406476920b" -- cgit 1.2.3-korg