diff options
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-support/curl/curl/CVE-2017-1000101.patch | 92 | ||||
-rw-r--r-- | meta/recipes-support/curl/curl_7.53.1.bb | 1 |
2 files changed, 93 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2017-1000101.patch b/meta/recipes-support/curl/curl/CVE-2017-1000101.patch new file mode 100644 index 0000000000..9eef5e2a20 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2017-1000101.patch | |||
@@ -0,0 +1,92 @@ | |||
1 | From 453e7a7a03a2cec749abd3878a48e728c515cca7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Daniel Stenberg <daniel@haxx.se> | ||
3 | Date: Tue, 1 Aug 2017 17:16:07 +0200 | ||
4 | Subject: [PATCH] glob: do not continue parsing after a strtoul() overflow | ||
5 | range | ||
6 | |||
7 | Added test 1289 to verify. | ||
8 | |||
9 | CVE-2017-1000101 | ||
10 | |||
11 | Bug: https://curl.haxx.se/docs/adv_20170809A.html | ||
12 | Reported-by: Brian Carpenter | ||
13 | |||
14 | Upstream-Status: Backport | ||
15 | CVE: CVE-2017-1000101 | ||
16 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
17 | |||
18 | --- | ||
19 | src/tool_urlglob.c | 5 ++++- | ||
20 | tests/data/Makefile.inc | 2 +- | ||
21 | tests/data/test1289 | 35 +++++++++++++++++++++++++++++++++++ | ||
22 | 3 files changed, 40 insertions(+), 2 deletions(-) | ||
23 | create mode 100644 tests/data/test1289 | ||
24 | |||
25 | Index: curl-7.53.1/src/tool_urlglob.c | ||
26 | =================================================================== | ||
27 | --- curl-7.53.1.orig/src/tool_urlglob.c | ||
28 | +++ curl-7.53.1/src/tool_urlglob.c | ||
29 | @@ -269,7 +269,10 @@ static CURLcode glob_range(URLGlob *glob | ||
30 | } | ||
31 | errno = 0; | ||
32 | max_n = strtoul(pattern, &endp, 10); | ||
33 | - if(errno || (*endp == ':')) { | ||
34 | + if(errno) | ||
35 | + /* overflow */ | ||
36 | + endp = NULL; | ||
37 | + else if(*endp == ':') { | ||
38 | pattern = endp+1; | ||
39 | errno = 0; | ||
40 | step_n = strtoul(pattern, &endp, 10); | ||
41 | Index: curl-7.53.1/tests/data/Makefile.inc | ||
42 | =================================================================== | ||
43 | --- curl-7.53.1.orig/tests/data/Makefile.inc | ||
44 | +++ curl-7.53.1/tests/data/Makefile.inc | ||
45 | @@ -131,6 +131,7 @@ test1244 test1245 test1246 test1247 test | ||
46 | test1252 test1253 test1254 test1255 test1256 test1257 test1258 test1259 \ | ||
47 | \ | ||
48 | test1280 test1281 test1282 test1283 test1284 test1285 test1286 \ | ||
49 | +test1289 \ | ||
50 | \ | ||
51 | test1300 test1301 test1302 test1303 test1304 test1305 test1306 test1307 \ | ||
52 | test1308 test1309 test1310 test1311 test1312 test1313 test1314 test1315 \ | ||
53 | Index: curl-7.53.1/tests/data/test1289 | ||
54 | =================================================================== | ||
55 | --- /dev/null | ||
56 | +++ curl-7.53.1/tests/data/test1289 | ||
57 | @@ -0,0 +1,35 @@ | ||
58 | +<testcase> | ||
59 | +<info> | ||
60 | +<keywords> | ||
61 | +HTTP | ||
62 | +HTTP GET | ||
63 | +globbing | ||
64 | +</keywords> | ||
65 | +</info> | ||
66 | + | ||
67 | +# | ||
68 | +# Server-side | ||
69 | +<reply> | ||
70 | +</reply> | ||
71 | + | ||
72 | +# Client-side | ||
73 | +<client> | ||
74 | +<server> | ||
75 | +http | ||
76 | +</server> | ||
77 | +<name> | ||
78 | +globbing with overflow and bad syntxx | ||
79 | +</name> | ||
80 | +<command> | ||
81 | +http://ur%20[0-60000000000000000000 | ||
82 | +</command> | ||
83 | +</client> | ||
84 | + | ||
85 | +# Verify data after the test has been "shot" | ||
86 | +<verify> | ||
87 | +# curl: (3) [globbing] bad range in column | ||
88 | +<errorcode> | ||
89 | +3 | ||
90 | +</errorcode> | ||
91 | +</verify> | ||
92 | +</testcase> | ||
diff --git a/meta/recipes-support/curl/curl_7.53.1.bb b/meta/recipes-support/curl/curl_7.53.1.bb index 72828fe814..c3e1f898a9 100644 --- a/meta/recipes-support/curl/curl_7.53.1.bb +++ b/meta/recipes-support/curl/curl_7.53.1.bb | |||
@@ -14,6 +14,7 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \ | |||
14 | # | 14 | # |
15 | SRC_URI += " file://configure_ac.patch \ | 15 | SRC_URI += " file://configure_ac.patch \ |
16 | file://CVE-2017-1000100.patch \ | 16 | file://CVE-2017-1000100.patch \ |
17 | file://CVE-2017-1000101.patch \ | ||
17 | " | 18 | " |
18 | 19 | ||
19 | SRC_URI[md5sum] = "fb1f03a142236840c1a77c035fa4c542" | 20 | SRC_URI[md5sum] = "fb1f03a142236840c1a77c035fa4c542" |