summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
diff options
context:
space:
mode:
authorHitendra Prajapati <hprajapati@mvista.com>2023-03-28 10:55:45 +0530
committerSteve Sakoman <steve@sakoman.com>2023-04-14 05:44:12 -1000
commitba7aa1547386037d84024c672e7b690a2f86342f (patch)
tree725999ccb5ce8b6fc7bc0c9094be9c538baa2429 /meta/recipes-support
parenta307ef21c1acd999f67af0fc6cccffab7cc564b5 (diff)
downloadpoky-ba7aa1547386037d84024c672e7b690a2f86342f.tar.gz
curl: CVE-2023-23916 HTTP multi-header compression denial of service
Upstream-Status: Backport from https://github.com/curl/curl/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9 (From OE-Core rev: b121b59cf6f642f46c97c96f3c4cf4cd84ff2af5) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-support')
-rw-r--r--meta/recipes-support/curl/curl/CVE-2023-23916.patch231
-rw-r--r--meta/recipes-support/curl/curl_7.69.1.bb1
2 files changed, 232 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2023-23916.patch b/meta/recipes-support/curl/curl/CVE-2023-23916.patch
new file mode 100644
index 0000000000..054615963e
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-23916.patch
@@ -0,0 +1,231 @@
1From 119fb187192a9ea13dc90d9d20c215fc82799ab9 Mon Sep 17 00:00:00 2001
2From: Patrick Monnerat <patrick@monnerat.net>
3Date: Mon, 13 Feb 2023 08:33:09 +0100
4Subject: [PATCH] content_encoding: do not reset stage counter for each header
5
6Test 418 verifies
7
8Closes #10492
9
10Upstream-Status: Backport [https://github.com/curl/curl/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9]
11CVE: CVE-2023-23916
12Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
13---
14 lib/content_encoding.c | 7 +-
15 lib/urldata.h | 1 +
16 tests/data/Makefile.inc | 2 +-
17 tests/data/test418 | 152 ++++++++++++++++++++++++++++++++++++++++
18 4 files changed, 157 insertions(+), 5 deletions(-)
19 create mode 100644 tests/data/test418
20
21diff --git a/lib/content_encoding.c b/lib/content_encoding.c
22index 91e621f..7e098a5 100644
23--- a/lib/content_encoding.c
24+++ b/lib/content_encoding.c
25@@ -944,7 +944,6 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
26 {
27 struct Curl_easy *data = conn->data;
28 struct SingleRequest *k = &data->req;
29- int counter = 0;
30
31 do {
32 const char *name;
33@@ -979,9 +978,9 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
34 if(!encoding)
35 encoding = &error_encoding; /* Defer error at stack use. */
36
37- if(++counter >= MAX_ENCODE_STACK) {
38- failf(data, "Reject response due to %u content encodings",
39- counter);
40+ if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
41+ failf(data, "Reject response due to more than %u content encodings",
42+ MAX_ENCODE_STACK);
43 return CURLE_BAD_CONTENT_ENCODING;
44 }
45 /* Stack the unencoding stage. */
46diff --git a/lib/urldata.h b/lib/urldata.h
47index ad0ef8f..168f874 100644
48--- a/lib/urldata.h
49+++ b/lib/urldata.h
50@@ -648,6 +648,7 @@ struct SingleRequest {
51 #ifndef CURL_DISABLE_DOH
52 struct dohdata doh; /* DoH specific data for this request */
53 #endif
54+ unsigned char writer_stack_depth; /* Unencoding stack depth. */
55 BIT(header); /* incoming data has HTTP header */
56 BIT(content_range); /* set TRUE if Content-Range: was found */
57 BIT(upload_done); /* set to TRUE when doing chunked transfer-encoding
58diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
59index 60e8176..40de8bc 100644
60--- a/tests/data/Makefile.inc
61+++ b/tests/data/Makefile.inc
62@@ -63,7 +63,7 @@ test350 test351 test352 test353 test354 test355 test356 test357 \
63 test393 test394 test395 \
64 \
65 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
66-test409 \
67+test409 test418 \
68 \
69 test490 test491 test492 \
70 \
71diff --git a/tests/data/test418 b/tests/data/test418
72new file mode 100644
73index 0000000..50e974e
74--- /dev/null
75+++ b/tests/data/test418
76@@ -0,0 +1,152 @@
77+<testcase>
78+<info>
79+<keywords>
80+HTTP
81+gzip
82+</keywords>
83+</info>
84+
85+#
86+# Server-side
87+<reply>
88+<data nocheck="yes">
89+HTTP/1.1 200 OK
90+Transfer-Encoding: gzip
91+Transfer-Encoding: gzip
92+Transfer-Encoding: gzip
93+Transfer-Encoding: gzip
94+Transfer-Encoding: gzip
95+Transfer-Encoding: gzip
96+Transfer-Encoding: gzip
97+Transfer-Encoding: gzip
98+Transfer-Encoding: gzip
99+Transfer-Encoding: gzip
100+Transfer-Encoding: gzip
101+Transfer-Encoding: gzip
102+Transfer-Encoding: gzip
103+Transfer-Encoding: gzip
104+Transfer-Encoding: gzip
105+Transfer-Encoding: gzip
106+Transfer-Encoding: gzip
107+Transfer-Encoding: gzip
108+Transfer-Encoding: gzip
109+Transfer-Encoding: gzip
110+Transfer-Encoding: gzip
111+Transfer-Encoding: gzip
112+Transfer-Encoding: gzip
113+Transfer-Encoding: gzip
114+Transfer-Encoding: gzip
115+Transfer-Encoding: gzip
116+Transfer-Encoding: gzip
117+Transfer-Encoding: gzip
118+Transfer-Encoding: gzip
119+Transfer-Encoding: gzip
120+Transfer-Encoding: gzip
121+Transfer-Encoding: gzip
122+Transfer-Encoding: gzip
123+Transfer-Encoding: gzip
124+Transfer-Encoding: gzip
125+Transfer-Encoding: gzip
126+Transfer-Encoding: gzip
127+Transfer-Encoding: gzip
128+Transfer-Encoding: gzip
129+Transfer-Encoding: gzip
130+Transfer-Encoding: gzip
131+Transfer-Encoding: gzip
132+Transfer-Encoding: gzip
133+Transfer-Encoding: gzip
134+Transfer-Encoding: gzip
135+Transfer-Encoding: gzip
136+Transfer-Encoding: gzip
137+Transfer-Encoding: gzip
138+Transfer-Encoding: gzip
139+Transfer-Encoding: gzip
140+Transfer-Encoding: gzip
141+Transfer-Encoding: gzip
142+Transfer-Encoding: gzip
143+Transfer-Encoding: gzip
144+Transfer-Encoding: gzip
145+Transfer-Encoding: gzip
146+Transfer-Encoding: gzip
147+Transfer-Encoding: gzip
148+Transfer-Encoding: gzip
149+Transfer-Encoding: gzip
150+Transfer-Encoding: gzip
151+Transfer-Encoding: gzip
152+Transfer-Encoding: gzip
153+Transfer-Encoding: gzip
154+Transfer-Encoding: gzip
155+Transfer-Encoding: gzip
156+Transfer-Encoding: gzip
157+Transfer-Encoding: gzip
158+Transfer-Encoding: gzip
159+Transfer-Encoding: gzip
160+Transfer-Encoding: gzip
161+Transfer-Encoding: gzip
162+Transfer-Encoding: gzip
163+Transfer-Encoding: gzip
164+Transfer-Encoding: gzip
165+Transfer-Encoding: gzip
166+Transfer-Encoding: gzip
167+Transfer-Encoding: gzip
168+Transfer-Encoding: gzip
169+Transfer-Encoding: gzip
170+Transfer-Encoding: gzip
171+Transfer-Encoding: gzip
172+Transfer-Encoding: gzip
173+Transfer-Encoding: gzip
174+Transfer-Encoding: gzip
175+Transfer-Encoding: gzip
176+Transfer-Encoding: gzip
177+Transfer-Encoding: gzip
178+Transfer-Encoding: gzip
179+Transfer-Encoding: gzip
180+Transfer-Encoding: gzip
181+Transfer-Encoding: gzip
182+Transfer-Encoding: gzip
183+Transfer-Encoding: gzip
184+Transfer-Encoding: gzip
185+Transfer-Encoding: gzip
186+Transfer-Encoding: gzip
187+Transfer-Encoding: gzip
188+Transfer-Encoding: gzip
189+Transfer-Encoding: gzip
190+
191+-foo-
192+</data>
193+</reply>
194+
195+#
196+# Client-side
197+<client>
198+<server>
199+http
200+</server>
201+ <name>
202+Response with multiple Transfer-Encoding headers
203+ </name>
204+ <command>
205+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
206+</command>
207+</client>
208+
209+#
210+# Verify data after the test has been "shot"
211+<verify>
212+<protocol crlf="yes">
213+GET /%TESTNUMBER HTTP/1.1
214+Host: %HOSTIP:%HTTPPORT
215+User-Agent: curl/%VERSION
216+Accept: */*
217+
218+</protocol>
219+
220+# CURLE_BAD_CONTENT_ENCODING is 61
221+<errorcode>
222+61
223+</errorcode>
224+<stderr mode="text">
225+curl: (61) Reject response due to more than 5 content encodings
226+</stderr>
227+</verify>
228+</testcase>
229--
2302.25.1
231
diff --git a/meta/recipes-support/curl/curl_7.69.1.bb b/meta/recipes-support/curl/curl_7.69.1.bb
index 899daf8eac..64e4fb5809 100644
--- a/meta/recipes-support/curl/curl_7.69.1.bb
+++ b/meta/recipes-support/curl/curl_7.69.1.bb
@@ -42,6 +42,7 @@ SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \
42 file://CVE-2022-32221.patch \ 42 file://CVE-2022-32221.patch \
43 file://CVE-2022-35260.patch \ 43 file://CVE-2022-35260.patch \
44 file://CVE-2022-43552.patch \ 44 file://CVE-2022-43552.patch \
45 file://CVE-2023-23916.patch \
45" 46"
46 47
47SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42" 48SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-16 18:34:54 +0000