summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAdrian Bunk <bunk@stusta.de>2020-01-17 17:14:28 (GMT)
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-01-28 11:15:01 (GMT)
commit057dcb3ee3f85e69323c7d7ebe5426b2b3656c39 (patch)
treeb4ee77e8ef79c1fa56ee19af0a3be73ee383c221
parentef2bec784ba91d7f7a2bfe5565cdc78727d2c77a (diff)
downloadpoky-057dcb3ee3f85e69323c7d7ebe5426b2b3656c39.tar.gz
lighttpd: Backport the CVE-2019-11072 fix
(From OE-Core rev: abc2d1fad91f1378be3946e35d8f8f450823599e) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-extended/lighttpd/lighttpd/0001-core-fix-abort-in-http-parseopts-fixes-2945.patch54
-rw-r--r--meta/recipes-extended/lighttpd/lighttpd_1.4.53.bb1
2 files changed, 55 insertions, 0 deletions
diff --git a/meta/recipes-extended/lighttpd/lighttpd/0001-core-fix-abort-in-http-parseopts-fixes-2945.patch b/meta/recipes-extended/lighttpd/lighttpd/0001-core-fix-abort-in-http-parseopts-fixes-2945.patch
new file mode 100644
index 0000000..123bb94
--- /dev/null
+++ b/meta/recipes-extended/lighttpd/lighttpd/0001-core-fix-abort-in-http-parseopts-fixes-2945.patch
@@ -0,0 +1,54 @@
1From 32120d5b8b3203fc21ccb9eafb0eaf824bb59354 Mon Sep 17 00:00:00 2001
2From: Glenn Strauss <gstrauss@gluelogic.com>
3Date: Wed, 10 Apr 2019 11:28:10 -0400
4Subject: [core] fix abort in http-parseopts (fixes #2945)
5
6fix abort in server.http-parseopts with url-path-2f-decode enabled
7
8(thx stze)
9
10x-ref:
11 "Security - SIGABRT during GET request handling with url-path-2f-decode enabled"
12 https://redmine.lighttpd.net/issues/2945
13
14CVE: CVE-2019-11072
15Upstream-Status: Backport
16Signed-off-by: Adrian Bunk <bunk@stusta.de>
17---
18 src/burl.c | 6 ++++--
19 src/t/test_burl.c | 2 ++
20 2 files changed, 6 insertions(+), 2 deletions(-)
21
22diff --git a/src/burl.c b/src/burl.c
23index 51182628..c4b928fd 100644
24--- a/src/burl.c
25+++ b/src/burl.c
26@@ -252,8 +252,10 @@ static int burl_normalize_2F_to_slash_fix (buffer *b, int qs, int i)
27 }
28 }
29 if (qs >= 0) {
30- memmove(s+j, s+qs, blen - qs);
31- j += blen - qs;
32+ const int qslen = blen - qs;
33+ memmove(s+j, s+qs, (size_t)qslen);
34+ qs = j;
35+ j += qslen;
36 }
37 buffer_string_set_length(b, j);
38 return qs;
39diff --git a/src/t/test_burl.c b/src/t/test_burl.c
40index 7be9be50..f7a16815 100644
41--- a/src/t/test_burl.c
42+++ b/src/t/test_burl.c
43@@ -97,6 +97,8 @@ static void test_burl_normalize (void) {
44 flags |= HTTP_PARSEOPT_URL_NORMALIZE_PATH_2F_DECODE;
45 run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("/a/b?c=/"), CONST_STR_LEN("/a/b?c=/"));
46 run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("/a/b?c=%2f"), CONST_STR_LEN("/a/b?c=/"));
47+ run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("%2f?"), CONST_STR_LEN("/?"));
48+ run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("/%2f?"), CONST_STR_LEN("//?"));
49 run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("/a%2fb"), CONST_STR_LEN("/a/b"));
50 run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("/a%2Fb"), CONST_STR_LEN("/a/b"));
51 run_burl_normalize(psrc, ptmp, flags, __LINE__, CONST_STR_LEN("/a%2fb?c=/"), CONST_STR_LEN("/a/b?c=/"));
52--
532.17.1
54
diff --git a/meta/recipes-extended/lighttpd/lighttpd_1.4.53.bb b/meta/recipes-extended/lighttpd/lighttpd_1.4.53.bb
index a0b350f..1259e63 100644
--- a/meta/recipes-extended/lighttpd/lighttpd_1.4.53.bb
+++ b/meta/recipes-extended/lighttpd/lighttpd_1.4.53.bb
@@ -17,6 +17,7 @@ SRC_URI = "http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-${PV}.t
17 file://lighttpd.conf \ 17 file://lighttpd.conf \
18 file://lighttpd \ 18 file://lighttpd \
19 file://0001-Use-pkg-config-for-pcre-dependency-instead-of-config.patch \ 19 file://0001-Use-pkg-config-for-pcre-dependency-instead-of-config.patch \
20 file://0001-core-fix-abort-in-http-parseopts-fixes-2945.patch \
20 " 21 "
21 22
22SRC_URI[md5sum] = "f93436d8d400b2b0e26ee4bcc60b9ac7" 23SRC_URI[md5sum] = "f93436d8d400b2b0e26ee4bcc60b9ac7"