summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
diff options
context:
space:
mode:
authorChangqing Li <changqing.li@windriver.com>2018-11-02 14:07:49 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-11-07 23:08:54 +0000
commitc67e7d1eb3d26d04bfe426d93f56a8b3a85dae93 (patch)
treec3ba9ed640c2a5ddc8aca4ae49afe445f80ef47b /meta/recipes-support
parentfaacc5048746c5bd0366881cdf46470bfeef4300 (diff)
downloadpoky-c67e7d1eb3d26d04bfe426d93f56a8b3a85dae93.tar.gz
curl: fix for CVE-2018-16839/CVE-2018-16840/CVE-2018-16842
(From OE-Core rev: 0f0db9fc8512a0ecd0cdba3304a195cd925a5029) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-support')
-rw-r--r--meta/recipes-support/curl/curl/CVE-2018-16839.patch35
-rw-r--r--meta/recipes-support/curl/curl/CVE-2018-16840.patch43
-rw-r--r--meta/recipes-support/curl/curl/CVE-2018-16842.patch35
3 files changed, 113 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2018-16839.patch b/meta/recipes-support/curl/curl/CVE-2018-16839.patch
new file mode 100644
index 0000000000..bf972d2ed7
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2018-16839.patch
@@ -0,0 +1,35 @@
1From 55b90532f9190dce40a325b3312d014c66dc3ae1 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 1 Nov 2018 15:27:35 +0800
4Subject: [PATCH] Curl_auth_create_plain_message: fix too-large-input-check
5
6CVE-2018-16839
7Reported-by: Harry Sintonen
8Bug: https://curl.haxx.se/docs/CVE-2018-16839.html
9
10Upstream-Status: Backport [https://github.com/curl/curl/commit
11/f3a24d7916b9173c69a3e0ee790102993833d6c5?diff=unified]
12
13CVE: CVE-2018-16839
14
15Signed-off-by: Changqing Li <changqing.li@windriver.com>
16---
17 lib/vauth/cleartext.c | 2 +-
18 1 file changed, 1 insertion(+), 1 deletion(-)
19
20diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c
21index 5d61ce6..1367143 100644
22--- a/lib/vauth/cleartext.c
23+++ b/lib/vauth/cleartext.c
24@@ -74,7 +74,7 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,
25 plen = strlen(passwdp);
26
27 /* Compute binary message length. Check for overflows. */
28- if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))
29+ if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))
30 return CURLE_OUT_OF_MEMORY;
31 plainlen = 2 * ulen + plen + 2;
32
33--
342.7.4
35
diff --git a/meta/recipes-support/curl/curl/CVE-2018-16840.patch b/meta/recipes-support/curl/curl/CVE-2018-16840.patch
new file mode 100644
index 0000000000..3d086c4d90
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2018-16840.patch
@@ -0,0 +1,43 @@
1From 3c2846bec008e03d456e181d9ab55686da83f140 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 1 Nov 2018 15:33:35 +0800
4Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
5 use-after-free
6
7Regression from b46cfbc (7.59.0)
8CVE-2018-16840
9Reported-by: Brian Carpenter (Geeknik Labs)
10
11Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
12
13Upstream-Status: Backport [https://github.com/curl/curl/commit/
1481d135d67155c5295b1033679c606165d4e28f3f]
15
16CVE: CVE-2018-16840
17
18Signed-off-by: Changqing Li <changqing.li@windriver.com>
19---
20 lib/url.c | 4 +++-
21 1 file changed, 3 insertions(+), 1 deletion(-)
22
23diff --git a/lib/url.c b/lib/url.c
24index 27b2c1e..7ef7c20 100644
25--- a/lib/url.c
26+++ b/lib/url.c
27@@ -320,10 +320,12 @@ CURLcode Curl_close(struct Curl_easy *data)
28 and detach this handle from there. */
29 curl_multi_remove_handle(data->multi, data);
30
31- if(data->multi_easy)
32+ if(data->multi_easy) {
33 /* when curl_easy_perform() is used, it creates its own multi handle to
34 use and this is the one */
35 curl_multi_cleanup(data->multi_easy);
36+ data->multi_easy = NULL;
37+ }
38
39 /* Destroy the timeout list that is held in the easy handle. It is
40 /normally/ done by curl_multi_remove_handle() but this is "just in
41--
422.7.4
43
diff --git a/meta/recipes-support/curl/curl/CVE-2018-16842.patch b/meta/recipes-support/curl/curl/CVE-2018-16842.patch
new file mode 100644
index 0000000000..82e7557063
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2018-16842.patch
@@ -0,0 +1,35 @@
1From 0e4a6058b130f07cfa52fde8a3cb6f2abfe4c700 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 1 Nov 2018 15:30:56 +0800
4Subject: [PATCH] voutf: fix bad arethmetic when outputting warnings to stderr
5
6CVE-2018-16842
7Reported-by: Brian Carpenter
8Bug: https://curl.haxx.se/docs/CVE-2018-16842.html
9
10Upstream-Status: Backport [https://github.com/curl/curl/commit
11/d530e92f59ae9bb2d47066c3c460b25d2ffeb211]
12
13CVE: CVE-2018-16842
14
15Signed-off-by: Changqing Li <changqing.li@windriver.com>
16---
17 src/tool_msgs.c | 2 +-
18 1 file changed, 1 insertion(+), 1 deletion(-)
19
20diff --git a/src/tool_msgs.c b/src/tool_msgs.c
21index 9cce806..05bec39 100644
22--- a/src/tool_msgs.c
23+++ b/src/tool_msgs.c
24@@ -67,7 +67,7 @@ static void voutf(struct GlobalConfig *config,
25 (void)fwrite(ptr, cut + 1, 1, config->errors);
26 fputs("\n", config->errors);
27 ptr += cut + 1; /* skip the space too */
28- len -= cut;
29+ len -= cut + 1;
30 }
31 else {
32 fputs(ptr, config->errors);
33--
342.7.4
35