summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support/curl/curl/CVE-2018-16840.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-support/curl/curl/CVE-2018-16840.patch')
-rw-r--r--meta/recipes-support/curl/curl/CVE-2018-16840.patch43
1 files changed, 0 insertions, 43 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2018-16840.patch b/meta/recipes-support/curl/curl/CVE-2018-16840.patch
deleted file mode 100644
index 3d086c4d90..0000000000
--- a/meta/recipes-support/curl/curl/CVE-2018-16840.patch
+++ /dev/null
@@ -1,43 +0,0 @@
1From 3c2846bec008e03d456e181d9ab55686da83f140 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 1 Nov 2018 15:33:35 +0800
4Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
5 use-after-free
6
7Regression from b46cfbc (7.59.0)
8CVE-2018-16840
9Reported-by: Brian Carpenter (Geeknik Labs)
10
11Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
12
13Upstream-Status: Backport [https://github.com/curl/curl/commit/
1481d135d67155c5295b1033679c606165d4e28f3f]
15
16CVE: CVE-2018-16840
17
18Signed-off-by: Changqing Li <changqing.li@windriver.com>
19---
20 lib/url.c | 4 +++-
21 1 file changed, 3 insertions(+), 1 deletion(-)
22
23diff --git a/lib/url.c b/lib/url.c
24index 27b2c1e..7ef7c20 100644
25--- a/lib/url.c
26+++ b/lib/url.c
27@@ -320,10 +320,12 @@ CURLcode Curl_close(struct Curl_easy *data)
28 and detach this handle from there. */
29 curl_multi_remove_handle(data->multi, data);
30
31- if(data->multi_easy)
32+ if(data->multi_easy) {
33 /* when curl_easy_perform() is used, it creates its own multi handle to
34 use and this is the one */
35 curl_multi_cleanup(data->multi_easy);
36+ data->multi_easy = NULL;
37+ }
38
39 /* Destroy the timeout list that is held in the easy handle. It is
40 /normally/ done by curl_multi_remove_handle() but this is "just in
41--
422.7.4
43