curl: Upgrade 7.47.1 -> 7.53.1

Security vulnerabilities fixed between 7.47.1 and 7.53.1 versions:
=================================================================
TLS session resumption client cert bypass (again): CVE-2017-XXXX
--write-out out of buffer read: CVE-2017-7407
SSL_VERIFYSTATUS ignored: CVE-2017-2629
uninitialized random: CVE-2016-9594
printf floating point buffer overflow: CVE-2016-9586
Win CE schannel cert wildcard matches too much: CVE-2016-9952
Win CE schannel cert name out of buffer read: CVE-2016-9953
cookie injection for other servers: CVE-2016-8615
case insensitive password comparison: CVE-2016-8616
OOB write via unchecked multiplication: CVE-2016-8617
double-free in curl_maprintf: CVE-2016-8618
double-free in krb5 code: CVE-2016-8619
glob parser write/read out of bounds: CVE-2016-8620
curl_getdate read out of bounds: CVE-2016-8621
URL unescape heap overflow via integer truncation: CVE-2016-8622
Use-after-free via shared cookies: CVE-2016-8623
invalid URL parsing with '#': CVE-2016-8624
IDNA 2003 makes curl use wrong host: CVE-2016-8625
curl escape and unescape integer overflows: CVE-2016-7167
Incorrect reuse of client certificates: CVE-2016-7141
TLS session resumption client cert bypass: CVE-2016-5419
Re-using connections with wrong client cert: CVE-2016-5420
use of connection struct after free: CVE-2016-5421
Windows DLL hijacking: CVE-2016-4802
TLS certificate check bypass with mbedTLS/PolarSSL: CVE-2016-3739

Reference:
https://curl.haxx.se/docs/security.html
https://curl.haxx.se/changes.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>

1 files changed, 0 insertions, 94 deletions

diff --git a/meta/recipes-support/curl/curl/CVE-2016-8622.patch b/meta/recipes-support/curl/curl/CVE-2016-8622.patch
deleted file mode 100644
index 8edad0184e..0000000000
--- a/meta/recipes-support/curl/curl/CVE-2016-8622.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 53e71e47d6b81650d26ec33a58d0dca24c7ffb2c Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Tue, 4 Oct 2016 18:56:45 +0200
-Subject: [PATCH] unescape: avoid integer overflow
-
-CVE: CVE-2016-8622
-Upstream-Status: Backport
-
-Bug: https://curl.haxx.se/docs/adv_20161102H.html
-Reported-by: Cure53
-
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
-
-diff -ruN a/docs/libcurl/curl_easy_unescape.3 b/docs/libcurl/curl_easy_unescape.3
---- a/docs/libcurl/curl_easy_unescape.3 2016-02-03 00:08:02.000000000 +0100
-+++ b/docs/libcurl/curl_easy_unescape.3 2016-11-07 09:25:45.999933275 +0100
-@@ -5,7 +5,7 @@
- .\" *                            | (__| |_| |  _ <| |___
- .\" *                             \___|\___/|_| \_\_____|
- .\" *
--.\" * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
-+.\" * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
- .\" *
- .\" * This software is licensed as described in the file COPYING, which
- .\" * you should have received as part of this distribution. The terms
-@@ -40,7 +40,10 @@
- 
- If \fBoutlength\fP is non-NULL, the function will write the length of the
- returned string in the integer it points to. This allows an escaped string
--containing %00 to still get used properly after unescaping.
-+containing %00 to still get used properly after unescaping. Since this is a
-+pointer to an \fIint\fP type, it can only return a value up to INT_MAX so no
-+longer string can be unescaped if the string length is returned in this
-+parameter.
- 
- You must \fIcurl_free(3)\fP the returned string when you're done with it.
- .SH AVAILABILITY
-diff -ruN a/lib/dict.c b/lib/dict.c
---- a/lib/dict.c        2016-02-03 00:02:44.000000000 +0100
-+++ b/lib/dict.c        2016-11-07 09:25:45.999933275 +0100
-@@ -5,7 +5,7 @@
-  *                            | (__| |_| |  _ <| |___
-  *                             \___|\___/|_| \_\_____|
-  *
-- * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
-+ * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
-  *
-  * This software is licensed as described in the file COPYING, which
-  * you should have received as part of this distribution. The terms
-@@ -52,7 +52,7 @@
- #include <curl/curl.h>
- #include "transfer.h"
- #include "sendf.h"
--
-+#include "escape.h"
- #include "progress.h"
- #include "strequal.h"
- #include "dict.h"
-@@ -96,12 +96,12 @@
-   char *newp;
-   char *dictp;
-   char *ptr;
--  int len;
-+  size_t len;
-   char ch;
-   int olen=0;
- 
--  newp = curl_easy_unescape(data, inputbuff, 0, &len);
--  if(!newp)
-+  CURLcode result = Curl_urldecode(data, inputbuff, 0, &newp, &len, FALSE);
-+  if(!newp || result)
-     return NULL;
- 
-   dictp = malloc(((size_t)len)*2 + 1); /* add one for terminating zero */
-diff -ruN a/lib/escape.c b/lib/escape.c
---- a/lib/escape.c      2016-02-05 10:02:03.000000000 +0100
-+++ b/lib/escape.c      2016-11-07 09:29:43.073671606 +0100
-@@ -217,8 +217,14 @@
-                                 FALSE);
-   if(res)
-     return NULL;
--  if(olen)
--    *olen = curlx_uztosi(outputlen);
-+
-+    if(olen) {
-+      if(outputlen <= (size_t) INT_MAX)
-+        *olen = curlx_uztosi(outputlen);
-+      else
-+        /* too large to return in an int, fail! */
-+        Curl_safefree(str);
-+    }
-   return str;
- }
-