diff options
Diffstat (limited to 'meta/recipes-support/curl/curl/CVE-2014-3707.patch')
-rw-r--r-- | meta/recipes-support/curl/curl/CVE-2014-3707.patch | 416 |
1 files changed, 416 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2014-3707.patch b/meta/recipes-support/curl/curl/CVE-2014-3707.patch new file mode 100644 index 0000000000..7ff38a65e8 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2014-3707.patch | |||
@@ -0,0 +1,416 @@ | |||
1 | From 3696fc1ba79d9b34660c44150be5e93ecf87dd9e Mon Sep 17 00:00:00 2001 | ||
2 | From: Daniel Stenberg <daniel@haxx.se> | ||
3 | Date: Fri, 17 Oct 2014 12:59:32 +0200 | ||
4 | Subject: [PATCH] curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of | ||
5 | bounds | ||
6 | |||
7 | When duplicating a handle, the data to post was duplicated using | ||
8 | strdup() when it could be binary and contain zeroes and it was not even | ||
9 | zero terminated! This caused read out of bounds crashes/segfaults. | ||
10 | |||
11 | Since the lib/strdup.c file no longer is easily shared with the curl | ||
12 | tool with this change, it now uses its own version instead. | ||
13 | |||
14 | Bug: http://curl.haxx.se/docs/adv_20141105.html | ||
15 | CVE: CVE-2014-3707 | ||
16 | Reported-By: Symeon Paraschoudis | ||
17 | --- | ||
18 | lib/formdata.c | 52 +++++++++------------------------------------------- | ||
19 | lib/strdup.c | 32 +++++++++++++++++++++++++++----- | ||
20 | lib/strdup.h | 3 ++- | ||
21 | lib/url.c | 22 +++++++++++++++++----- | ||
22 | lib/urldata.h | 11 +++++++++-- | ||
23 | src/Makefile.inc | 4 ++-- | ||
24 | src/tool_setup.h | 5 ++--- | ||
25 | src/tool_strdup.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++ | ||
26 | src/tool_strdup.h | 30 ++++++++++++++++++++++++++++++ | ||
27 | 9 files changed, 145 insertions(+), 61 deletions(-) | ||
28 | create mode 100644 src/tool_strdup.c | ||
29 | create mode 100644 src/tool_strdup.h | ||
30 | |||
31 | Index: curl-7.37.1/lib/formdata.c | ||
32 | =================================================================== | ||
33 | --- curl-7.37.1.orig/lib/formdata.c | ||
34 | +++ curl-7.37.1/lib/formdata.c | ||
35 | @@ -36,6 +36,7 @@ | ||
36 | #include "strequal.h" | ||
37 | #include "curl_memory.h" | ||
38 | #include "sendf.h" | ||
39 | +#include "strdup.h" | ||
40 | |||
41 | #define _MPRINTF_REPLACE /* use our functions only */ | ||
42 | #include <curl/mprintf.h> | ||
43 | @@ -214,46 +215,6 @@ static const char *ContentTypeForFilenam | ||
44 | |||
45 | /*************************************************************************** | ||
46 | * | ||
47 | - * memdup() | ||
48 | - * | ||
49 | - * Copies the 'source' data to a newly allocated buffer buffer (that is | ||
50 | - * returned). Uses buffer_length if not null, else uses strlen to determine | ||
51 | - * the length of the buffer to be copied | ||
52 | - * | ||
53 | - * Returns the new pointer or NULL on failure. | ||
54 | - * | ||
55 | - ***************************************************************************/ | ||
56 | -static char *memdup(const char *src, size_t buffer_length) | ||
57 | -{ | ||
58 | - size_t length; | ||
59 | - bool add = FALSE; | ||
60 | - char *buffer; | ||
61 | - | ||
62 | - if(buffer_length) | ||
63 | - length = buffer_length; | ||
64 | - else if(src) { | ||
65 | - length = strlen(src); | ||
66 | - add = TRUE; | ||
67 | - } | ||
68 | - else | ||
69 | - /* no length and a NULL src pointer! */ | ||
70 | - return strdup(""); | ||
71 | - | ||
72 | - buffer = malloc(length+add); | ||
73 | - if(!buffer) | ||
74 | - return NULL; /* fail */ | ||
75 | - | ||
76 | - memcpy(buffer, src, length); | ||
77 | - | ||
78 | - /* if length unknown do null termination */ | ||
79 | - if(add) | ||
80 | - buffer[length] = '\0'; | ||
81 | - | ||
82 | - return buffer; | ||
83 | -} | ||
84 | - | ||
85 | -/*************************************************************************** | ||
86 | - * | ||
87 | * FormAdd() | ||
88 | * | ||
89 | * Stores a formpost parameter and builds the appropriate linked list. | ||
90 | @@ -682,9 +643,12 @@ CURLFORMcode FormAdd(struct curl_httppos | ||
91 | (form == first_form) ) { | ||
92 | /* Note that there's small risk that form->name is NULL here if the | ||
93 | app passed in a bad combo, so we better check for that first. */ | ||
94 | - if(form->name) | ||
95 | + if(form->name) { | ||
96 | /* copy name (without strdup; possibly contains null characters) */ | ||
97 | - form->name = memdup(form->name, form->namelength); | ||
98 | + form->name = Curl_memdup(form->name, form->namelength? | ||
99 | + form->namelength: | ||
100 | + strlen(form->name)+1); | ||
101 | + } | ||
102 | if(!form->name) { | ||
103 | return_value = CURL_FORMADD_MEMORY; | ||
104 | break; | ||
105 | @@ -695,7 +659,7 @@ CURLFORMcode FormAdd(struct curl_httppos | ||
106 | HTTPPOST_PTRCONTENTS | HTTPPOST_PTRBUFFER | | ||
107 | HTTPPOST_CALLBACK)) ) { | ||
108 | /* copy value (without strdup; possibly contains null characters) */ | ||
109 | - form->value = memdup(form->value, form->contentslength); | ||
110 | + form->value = Curl_memdup(form->value, form->contentslength); | ||
111 | if(!form->value) { | ||
112 | return_value = CURL_FORMADD_MEMORY; | ||
113 | break; | ||
114 | Index: curl-7.37.1/lib/strdup.c | ||
115 | =================================================================== | ||
116 | --- curl-7.37.1.orig/lib/strdup.c | ||
117 | +++ curl-7.37.1/lib/strdup.c | ||
118 | @@ -5,7 +5,7 @@ | ||
119 | * | (__| |_| | _ <| |___ | ||
120 | * \___|\___/|_| \_\_____| | ||
121 | * | ||
122 | - * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al. | ||
123 | + * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al. | ||
124 | * | ||
125 | * This software is licensed as described in the file COPYING, which | ||
126 | * you should have received as part of this distribution. The terms | ||
127 | @@ -19,12 +19,12 @@ | ||
128 | * KIND, either express or implied. | ||
129 | * | ||
130 | ***************************************************************************/ | ||
131 | -/* | ||
132 | - * This file is 'mem-include-scan' clean. See test 1132. | ||
133 | - */ | ||
134 | #include "curl_setup.h" | ||
135 | - | ||
136 | #include "strdup.h" | ||
137 | +#include "curl_memory.h" | ||
138 | + | ||
139 | +/* The last #include file should be: */ | ||
140 | +#include "memdebug.h" | ||
141 | |||
142 | #ifndef HAVE_STRDUP | ||
143 | char *curlx_strdup(const char *str) | ||
144 | @@ -50,3 +50,25 @@ char *curlx_strdup(const char *str) | ||
145 | |||
146 | } | ||
147 | #endif | ||
148 | + | ||
149 | +/*************************************************************************** | ||
150 | + * | ||
151 | + * Curl_memdup(source, length) | ||
152 | + * | ||
153 | + * Copies the 'source' data to a newly allocated buffer (that is | ||
154 | + * returned). Copies 'length' bytes. | ||
155 | + * | ||
156 | + * Returns the new pointer or NULL on failure. | ||
157 | + * | ||
158 | + ***************************************************************************/ | ||
159 | +char *Curl_memdup(const char *src, size_t length) | ||
160 | +{ | ||
161 | + char *buffer = malloc(length); | ||
162 | + if(!buffer) | ||
163 | + return NULL; /* fail */ | ||
164 | + | ||
165 | + memcpy(buffer, src, length); | ||
166 | + | ||
167 | + /* if length unknown do null termination */ | ||
168 | + return buffer; | ||
169 | +} | ||
170 | Index: curl-7.37.1/lib/strdup.h | ||
171 | =================================================================== | ||
172 | --- curl-7.37.1.orig/lib/strdup.h | ||
173 | +++ curl-7.37.1/lib/strdup.h | ||
174 | @@ -7,7 +7,7 @@ | ||
175 | * | (__| |_| | _ <| |___ | ||
176 | * \___|\___/|_| \_\_____| | ||
177 | * | ||
178 | - * Copyright (C) 1998 - 2010, Daniel Stenberg, <daniel@haxx.se>, et al. | ||
179 | + * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al. | ||
180 | * | ||
181 | * This software is licensed as described in the file COPYING, which | ||
182 | * you should have received as part of this distribution. The terms | ||
183 | @@ -26,5 +26,6 @@ | ||
184 | #ifndef HAVE_STRDUP | ||
185 | extern char *curlx_strdup(const char *str); | ||
186 | #endif | ||
187 | +char *Curl_memdup(const char *src, size_t buffer_length); | ||
188 | |||
189 | #endif /* HEADER_CURL_STRDUP_H */ | ||
190 | Index: curl-7.37.1/lib/url.c | ||
191 | =================================================================== | ||
192 | --- curl-7.37.1.orig/lib/url.c | ||
193 | +++ curl-7.37.1/lib/url.c | ||
194 | @@ -125,6 +125,7 @@ int curl_win32_idn_to_ascii(const char * | ||
195 | #include "multihandle.h" | ||
196 | #include "pipeline.h" | ||
197 | #include "dotdot.h" | ||
198 | +#include "strdup.h" | ||
199 | |||
200 | #define _MPRINTF_REPLACE /* use our functions only */ | ||
201 | #include <curl/mprintf.h> | ||
202 | @@ -270,8 +271,9 @@ void Curl_freeset(struct SessionHandle * | ||
203 | { | ||
204 | /* Free all dynamic strings stored in the data->set substructure. */ | ||
205 | enum dupstring i; | ||
206 | - for(i=(enum dupstring)0; i < STRING_LAST; i++) | ||
207 | + for(i=(enum dupstring)0; i < STRING_LAST; i++) { | ||
208 | Curl_safefree(data->set.str[i]); | ||
209 | + } | ||
210 | |||
211 | if(data->change.referer_alloc) { | ||
212 | Curl_safefree(data->change.referer); | ||
213 | @@ -356,14 +358,24 @@ CURLcode Curl_dupset(struct SessionHandl | ||
214 | memset(dst->set.str, 0, STRING_LAST * sizeof(char *)); | ||
215 | |||
216 | /* duplicate all strings */ | ||
217 | - for(i=(enum dupstring)0; i< STRING_LAST; i++) { | ||
218 | + for(i=(enum dupstring)0; i< STRING_LASTZEROTERMINATED; i++) { | ||
219 | r = setstropt(&dst->set.str[i], src->set.str[i]); | ||
220 | if(r != CURLE_OK) | ||
221 | - break; | ||
222 | + return r; | ||
223 | } | ||
224 | |||
225 | - /* If a failure occurred, freeing has to be performed externally. */ | ||
226 | - return r; | ||
227 | + /* duplicate memory areas pointed to */ | ||
228 | + i = STRING_COPYPOSTFIELDS; | ||
229 | + if(src->set.postfieldsize && src->set.str[i]) { | ||
230 | + /* postfieldsize is curl_off_t, Curl_memdup() takes a size_t ... */ | ||
231 | + dst->set.str[i] = Curl_memdup(src->set.str[i], src->set.postfieldsize); | ||
232 | + if(!dst->set.str[i]) | ||
233 | + return CURLE_OUT_OF_MEMORY; | ||
234 | + /* point to the new copy */ | ||
235 | + dst->set.postfields = dst->set.str[i]; | ||
236 | + } | ||
237 | + | ||
238 | + return CURLE_OK; | ||
239 | } | ||
240 | |||
241 | /* | ||
242 | Index: curl-7.37.1/lib/urldata.h | ||
243 | =================================================================== | ||
244 | --- curl-7.37.1.orig/lib/urldata.h | ||
245 | +++ curl-7.37.1/lib/urldata.h | ||
246 | @@ -1359,7 +1359,6 @@ enum dupstring { | ||
247 | STRING_KRB_LEVEL, /* krb security level */ | ||
248 | STRING_NETRC_FILE, /* if not NULL, use this instead of trying to find | ||
249 | $HOME/.netrc */ | ||
250 | - STRING_COPYPOSTFIELDS, /* if POST, set the fields' values here */ | ||
251 | STRING_PROXY, /* proxy to use */ | ||
252 | STRING_SET_RANGE, /* range, if used */ | ||
253 | STRING_SET_REFERER, /* custom string for the HTTP referer field */ | ||
254 | @@ -1401,7 +1400,15 @@ enum dupstring { | ||
255 | |||
256 | STRING_BEARER, /* <bearer>, if used */ | ||
257 | |||
258 | - /* -- end of strings -- */ | ||
259 | + /* -- end of zero-terminated strings -- */ | ||
260 | + | ||
261 | + STRING_LASTZEROTERMINATED, | ||
262 | + | ||
263 | + /* -- below this are pointers to binary data that cannot be strdup'ed. | ||
264 | + Each such pointer must be added manually to Curl_dupset() --- */ | ||
265 | + | ||
266 | + STRING_COPYPOSTFIELDS, /* if POST, set the fields' values here */ | ||
267 | + | ||
268 | STRING_LAST /* not used, just an end-of-list marker */ | ||
269 | }; | ||
270 | |||
271 | Index: curl-7.37.1/src/Makefile.inc | ||
272 | =================================================================== | ||
273 | --- curl-7.37.1.orig/src/Makefile.inc | ||
274 | +++ curl-7.37.1/src/Makefile.inc | ||
275 | @@ -11,7 +11,6 @@ | ||
276 | # the official API, but we re-use the code here to avoid duplication. | ||
277 | CURLX_CFILES = \ | ||
278 | ../lib/strtoofft.c \ | ||
279 | - ../lib/strdup.c \ | ||
280 | ../lib/rawstr.c \ | ||
281 | ../lib/nonblock.c \ | ||
282 | ../lib/warnless.c | ||
283 | @@ -19,7 +18,6 @@ CURLX_CFILES = \ | ||
284 | CURLX_HFILES = \ | ||
285 | ../lib/curl_setup.h \ | ||
286 | ../lib/strtoofft.h \ | ||
287 | - ../lib/strdup.h \ | ||
288 | ../lib/rawstr.h \ | ||
289 | ../lib/nonblock.h \ | ||
290 | ../lib/warnless.h | ||
291 | @@ -55,6 +53,7 @@ CURL_CFILES = \ | ||
292 | tool_panykey.c \ | ||
293 | tool_paramhlp.c \ | ||
294 | tool_parsecfg.c \ | ||
295 | + tool_strdup.c \ | ||
296 | tool_setopt.c \ | ||
297 | tool_sleep.c \ | ||
298 | tool_urlglob.c \ | ||
299 | @@ -99,6 +98,7 @@ CURL_HFILES = \ | ||
300 | tool_setopt.h \ | ||
301 | tool_setup.h \ | ||
302 | tool_sleep.h \ | ||
303 | + tool_strdup.h \ | ||
304 | tool_urlglob.h \ | ||
305 | tool_util.h \ | ||
306 | tool_version.h \ | ||
307 | Index: curl-7.37.1/src/tool_setup.h | ||
308 | =================================================================== | ||
309 | --- curl-7.37.1.orig/src/tool_setup.h | ||
310 | +++ curl-7.37.1/src/tool_setup.h | ||
311 | @@ -7,7 +7,7 @@ | ||
312 | * | (__| |_| | _ <| |___ | ||
313 | * \___|\___/|_| \_\_____| | ||
314 | * | ||
315 | - * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al. | ||
316 | + * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al. | ||
317 | * | ||
318 | * This software is licensed as described in the file COPYING, which | ||
319 | * you should have received as part of this distribution. The terms | ||
320 | @@ -67,8 +67,7 @@ | ||
321 | #endif | ||
322 | |||
323 | #ifndef HAVE_STRDUP | ||
324 | -# include "strdup.h" | ||
325 | -# define strdup(ptr) curlx_strdup(ptr) | ||
326 | +# include "tool_strdup.h" | ||
327 | #endif | ||
328 | |||
329 | #endif /* HEADER_CURL_TOOL_SETUP_H */ | ||
330 | Index: curl-7.37.1/src/tool_strdup.c | ||
331 | =================================================================== | ||
332 | --- /dev/null | ||
333 | +++ curl-7.37.1/src/tool_strdup.c | ||
334 | @@ -0,0 +1,47 @@ | ||
335 | +/*************************************************************************** | ||
336 | + * _ _ ____ _ | ||
337 | + * Project ___| | | | _ \| | | ||
338 | + * / __| | | | |_) | | | ||
339 | + * | (__| |_| | _ <| |___ | ||
340 | + * \___|\___/|_| \_\_____| | ||
341 | + * | ||
342 | + * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al. | ||
343 | + * | ||
344 | + * This software is licensed as described in the file COPYING, which | ||
345 | + * you should have received as part of this distribution. The terms | ||
346 | + * are also available at http://curl.haxx.se/docs/copyright.html. | ||
347 | + * | ||
348 | + * You may opt to use, copy, modify, merge, publish, distribute and/or sell | ||
349 | + * copies of the Software, and permit persons to whom the Software is | ||
350 | + * furnished to do so, under the terms of the COPYING file. | ||
351 | + * | ||
352 | + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY | ||
353 | + * KIND, either express or implied. | ||
354 | + * | ||
355 | + ***************************************************************************/ | ||
356 | +#include "strdup.h" | ||
357 | + | ||
358 | +#ifndef HAVE_STRDUP | ||
359 | +char *strdup(const char *str) | ||
360 | +{ | ||
361 | + size_t len; | ||
362 | + char *newstr; | ||
363 | + | ||
364 | + if(!str) | ||
365 | + return (char *)NULL; | ||
366 | + | ||
367 | + len = strlen(str); | ||
368 | + | ||
369 | + if(len >= ((size_t)-1) / sizeof(char)) | ||
370 | + return (char *)NULL; | ||
371 | + | ||
372 | + newstr = malloc((len+1)*sizeof(char)); | ||
373 | + if(!newstr) | ||
374 | + return (char *)NULL; | ||
375 | + | ||
376 | + memcpy(newstr,str,(len+1)*sizeof(char)); | ||
377 | + | ||
378 | + return newstr; | ||
379 | + | ||
380 | +} | ||
381 | +#endif | ||
382 | Index: curl-7.37.1/src/tool_strdup.h | ||
383 | =================================================================== | ||
384 | --- /dev/null | ||
385 | +++ curl-7.37.1/src/tool_strdup.h | ||
386 | @@ -0,0 +1,30 @@ | ||
387 | +#ifndef HEADER_TOOL_STRDUP_H | ||
388 | +#define HEADER_TOOL_STRDUP_H | ||
389 | +/*************************************************************************** | ||
390 | + * _ _ ____ _ | ||
391 | + * Project ___| | | | _ \| | | ||
392 | + * / __| | | | |_) | | | ||
393 | + * | (__| |_| | _ <| |___ | ||
394 | + * \___|\___/|_| \_\_____| | ||
395 | + * | ||
396 | + * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al. | ||
397 | + * | ||
398 | + * This software is licensed as described in the file COPYING, which | ||
399 | + * you should have received as part of this distribution. The terms | ||
400 | + * are also available at http://curl.haxx.se/docs/copyright.html. | ||
401 | + * | ||
402 | + * You may opt to use, copy, modify, merge, publish, distribute and/or sell | ||
403 | + * copies of the Software, and permit persons to whom the Software is | ||
404 | + * furnished to do so, under the terms of the COPYING file. | ||
405 | + * | ||
406 | + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY | ||
407 | + * KIND, either express or implied. | ||
408 | + * | ||
409 | + ***************************************************************************/ | ||
410 | +#include "tool_setup.h" | ||
411 | + | ||
412 | +#ifndef HAVE_STRDUP | ||
413 | +extern char *strdup(const char *str); | ||
414 | +#endif | ||
415 | + | ||
416 | +#endif /* HEADER_TOOL_STRDUP_H */ | ||