curl: Security fix for CVE-2017-1000257

IMAP FETCH response out of bounds read

References:
https://curl.haxx.se/docs/adv_20171023.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000257

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>

2 files changed, 40 insertions, 0 deletions

diff --git a/recipes-support/curl/curl/CVE-2017-1000257.patch b/recipes-support/curl/curl/CVE-2017-1000257.patch
new file mode 100644
index 0000000..de0dc3a
--- /dev/null
+++ b/recipes-support/curl/curl/CVE-2017-1000257.patch
@@ -0,0 +1,39 @@
+From 13c9a9ded3ae744a1e11cbc14e9146d9fa427040 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sat, 7 Oct 2017 00:11:31 +0200
+Subject: [PATCH] imap: if a FETCH response has no size, don't call write
+ callback
+
+CVE: CVE-2017-1000257
+Upstream-Status: Backport [https://curl.haxx.se/CVE-2017-1000257.patch]
+
+Reported-by: Brian Carpenter and 0xd34db347
+Also detected by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3586
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ lib/imap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/imap.c b/lib/imap.c
+index 954d18f37..baa31a2f8 100644
+--- a/lib/imap.c
++++ b/lib/imap.c
+@@ -1124,10 +1124,15 @@ static CURLcode imap_state_fetch_resp(struct connectdata *conn, int imapcode,
+ 
+       if(chunk > (size_t)size)
+         /* The conversion from curl_off_t to size_t is always fine here */
+         chunk = (size_t)size;
+ 
++      if(!chunk) {
++        /* no size, we're done with the data */
++        state(conn, IMAP_STOP);
++        return CURLE_OK;
++      }
+       result = Curl_client_write(conn, CLIENTWRITE_BODY, pp->cache, chunk);
+       if(result)
+         return result;
+ 
+       data->req.bytecount += chunk;
+-- 
+2.15.0.rc1
+
diff --git a/recipes-support/curl/curl_%.bbappend b/recipes-support/curl/curl_%.bbappend
index 82db0f7..bc75100 100644
--- a/recipes-support/curl/curl_%.bbappend
+++ b/recipes-support/curl/curl_%.bbappend
@@ -5,4 +5,5 @@ SRC_URI += "file://CVE-2017-7407.patch \
             file://CVE-2017-7468.patch \
             file://CVE-2017-9502.patch \
             file://CVE-2017-1000254.patch \
+            file://CVE-2017-1000257.patch \
            "