summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSiddharth Doshi <sdoshi@mvista.com>2024-08-20 14:53:14 +0530
committerSteve Sakoman <steve@sakoman.com>2024-08-28 06:49:22 -0700
commitda7126134444d4cfca8dd869828c9bb4ce4bfaa8 (patch)
treecd580c47571f21e5d37f9bc72700b30b1bfbd2b6
parent784646063bd1ec5f295fe384ffc6b02e8555f7bc (diff)
downloadpoky-da7126134444d4cfca8dd869828c9bb4ce4bfaa8.tar.gz
curl: Security fix for CVE-2024-7264
Upstream-Status: Backport from [https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519] CVE's Fixed: ============ CVE-2024-7264 libcurl: ASN.1 date parser overread (From OE-Core rev: cf0b1ed6c4cd9f61e39befb9c9785b1433777988) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-support/curl/curl/CVE-2024-7264_1.patch66
-rw-r--r--meta/recipes-support/curl/curl/CVE-2024-7264_2.patch320
-rw-r--r--meta/recipes-support/curl/curl_7.82.0.bb2
3 files changed, 388 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2024-7264_1.patch b/meta/recipes-support/curl/curl/CVE-2024-7264_1.patch
new file mode 100644
index 0000000000..2e1d8eeaaa
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2024-7264_1.patch
@@ -0,0 +1,66 @@
1From 3c914bc680155b32178f1f15ca8d47c7f4640afe Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Tue, 30 Jul 2024 10:05:17 +0200
4Subject: [PATCH] x509asn1: clean up GTime2str
5
6Co-authored-by: Stefan Eissing
7Reported-by: Dov Murik
8
9Closes #14307
10
11Note: This patch is needed by the main patch to be backported.
12
13Upstream-Status: Backport from [https://github.com/curl/curl/commit/3c914bc680155b32178f1f15ca8d47c7f4640afe]
14CVE: CVE-2024-7264
15Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
16---
17 lib/vtls/x509asn1.c | 23 ++++++++++++++---------
18 1 file changed, 14 insertions(+), 9 deletions(-)
19
20diff --git a/lib/vtls/x509asn1.c b/lib/vtls/x509asn1.c
21index f64acb8..b538bd9 100644
22--- a/lib/vtls/x509asn1.c
23+++ b/lib/vtls/x509asn1.c
24@@ -539,7 +539,7 @@ static const char *GTime2str(const char *beg, const char *end)
25 /* Convert an ASN.1 Generalized time to a printable string.
26 Return the dynamically allocated string, or NULL if an error occurs. */
27
28- for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
29+ for(fracp = beg; fracp < end && ISDIGIT(*fracp); fracp++)
30 ;
31
32 /* Get seconds digits. */
33@@ -558,17 +558,22 @@ static const char *GTime2str(const char *beg, const char *end)
34 return NULL;
35 }
36
37- /* Scan for timezone, measure fractional seconds. */
38+ /* timezone follows optional fractional seconds. */
39 tzp = fracp;
40- fracl = 0;
41+ fracl = 0; /* no fractional seconds detected so far */
42 if(fracp < end && (*fracp == '.' || *fracp == ',')) {
43- fracp++;
44- do
45+ /* Have fractional seconds, e.g. "[.,]\d+". How many? */
46+ tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
47+ while(tzp < end && ISDIGIT(*tzp))
48 tzp++;
49- while(tzp < end && *tzp >= '0' && *tzp <= '9');
50- /* Strip leading zeroes in fractional seconds. */
51- for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
52- ;
53+ if(tzp == fracp) /* never looped, no digit after [.,] */
54+ return CURLE_BAD_FUNCTION_ARGUMENT;
55+ fracl = tzp - fracp - 1; /* number of fractional sec digits */
56+ DEBUGASSERT(fracl > 0);
57+ /* Strip trailing zeroes in fractional seconds.
58+ * May reduce fracl to 0 if only '0's are present. */
59+ while(fracl && fracp[fracl - 1] == '0')
60+ fracl--;
61 }
62
63 /* Process timezone. */
64--
652.35.7
66
diff --git a/meta/recipes-support/curl/curl/CVE-2024-7264_2.patch b/meta/recipes-support/curl/curl/CVE-2024-7264_2.patch
new file mode 100644
index 0000000000..e8853c1e0c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2024-7264_2.patch
@@ -0,0 +1,320 @@
1From 27959ecce75cdb2809c0bdb3286e60e08fadb519 Mon Sep 17 00:00:00 2001
2From: Stefan Eissing <stefan@eissing.org>
3Date: Tue, 30 Jul 2024 16:40:48 +0200
4Subject: [PATCH] x509asn1: unittests and fixes for gtime2str
5
6Fix issues in GTime2str() and add unit test cases to verify correct
7behaviour.
8
9Follow-up to 3c914bc6801
10
11Closes #14316
12
13Upstream-Status: Backport from [https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519]
14CVE: CVE-2024-7264
15Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
16---
17 lib/vtls/x509asn1.c | 32 +++++++---
18 lib/vtls/x509asn1.h | 11 ++++
19 tests/data/Makefile.inc | 2 +-
20 tests/data/test1656 | 22 +++++++
21 tests/unit/Makefile.inc | 4 +-
22 tests/unit/unit1656.c | 133 ++++++++++++++++++++++++++++++++++++++++
23 6 files changed, 194 insertions(+), 10 deletions(-)
24 create mode 100644 tests/data/test1656
25 create mode 100644 tests/unit/unit1656.c
26
27diff --git a/lib/vtls/x509asn1.c b/lib/vtls/x509asn1.c
28index b538bd9..a25a6e6 100644
29--- a/lib/vtls/x509asn1.c
30+++ b/lib/vtls/x509asn1.c
31@@ -563,12 +563,13 @@ static const char *GTime2str(const char *beg, const char *end)
32 fracl = 0; /* no fractional seconds detected so far */
33 if(fracp < end && (*fracp == '.' || *fracp == ',')) {
34 /* Have fractional seconds, e.g. "[.,]\d+". How many? */
35- tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
36+ fracp++; /* should be a digit char or BAD ARGUMENT */
37+ tzp = fracp;
38 while(tzp < end && ISDIGIT(*tzp))
39 tzp++;
40 if(tzp == fracp) /* never looped, no digit after [.,] */
41 return CURLE_BAD_FUNCTION_ARGUMENT;
42- fracl = tzp - fracp - 1; /* number of fractional sec digits */
43+ fracl = tzp - fracp; /* number of fractional sec digits */
44 DEBUGASSERT(fracl > 0);
45 /* Strip trailing zeroes in fractional seconds.
46 * May reduce fracl to 0 if only '0's are present. */
47@@ -577,18 +578,24 @@ static const char *GTime2str(const char *beg, const char *end)
48 }
49
50 /* Process timezone. */
51- if(tzp >= end)
52- ; /* Nothing to do. */
53+ if(tzp >= end) {
54+ tzp = "";
55+ tzl = 0;
56+ }
57 else if(*tzp == 'Z') {
58- tzp = " GMT";
59- end = tzp + 4;
60+ sep = " ";
61+ tzp = "GMT";
62+ tzl = 3;
63+ }
64+ else if((*tzp == '+') || (*tzp == '-')) {
65+ sep = " UTC";
66+ tzl = end - tzp;
67 }
68 else {
69 sep = " ";
70- tzp++;
71+ tzl = end - tzp;
72 }
73
74- tzl = end - tzp;
75 return curl_maprintf("%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
76 beg, beg + 4, beg + 6,
77 beg + 8, beg + 10, sec1, sec2,
78@@ -596,6 +603,15 @@ static const char *GTime2str(const char *beg, const char *end)
79 sep, (int)tzl, tzp);
80 }
81
82+#ifdef UNITTESTS
83+/* used by unit1656.c */
84+CURLcode Curl_x509_GTime2str(struct dynbuf *store,
85+ const char *beg, const char *end)
86+{
87+ return GTime2str(store, beg, end);
88+}
89+#endif
90+
91 /*
92 * Convert an ASN.1 UTC time to a printable string.
93 * Return the dynamically allocated string, or NULL if an error occurs.
94diff --git a/lib/vtls/x509asn1.h b/lib/vtls/x509asn1.h
95index db7df0e..515cb7e 100644
96--- a/lib/vtls/x509asn1.h
97+++ b/lib/vtls/x509asn1.h
98@@ -73,6 +73,17 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data, int certnum,
99 const char *beg, const char *end);
100 CURLcode Curl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
101 const char *beg, const char *end);
102+
103+#ifdef UNITTESTS
104+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
105+ defined(USE_MBEDTLS)
106+
107+/* used by unit1656.c */
108+CURLcode Curl_x509_GTime2str(struct dynbuf *store,
109+ const char *beg, const char *end);
110+#endif
111+#endif
112+
113 #endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL
114 * or USE_SECTRANSP */
115 #endif /* HEADER_CURL_X509ASN1_H */
116diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
117index 47117b6..5415f37 100644
118--- a/tests/data/Makefile.inc
119+++ b/tests/data/Makefile.inc
120@@ -208,7 +208,7 @@ test1620 test1621 \
121 \
122 test1630 test1631 test1632 test1633 test1634 \
123 \
124-test1650 test1651 test1652 test1653 test1654 test1655 \
125+test1650 test1651 test1652 test1653 test1654 test1655 test1656 \
126 test1660 test1661 \
127 \
128 test1700 test1701 test1702 test1703 \
129diff --git a/tests/data/test1656 b/tests/data/test1656
130new file mode 100644
131index 0000000..2fab21b
132--- /dev/null
133+++ b/tests/data/test1656
134@@ -0,0 +1,22 @@
135+<testcase>
136+<info>
137+<keywords>
138+unittest
139+Curl_x509_GTime2str
140+</keywords>
141+</info>
142+
143+#
144+# Client-side
145+<client>
146+<server>
147+none
148+</server>
149+<features>
150+unittest
151+</features>
152+<name>
153+Curl_x509_GTime2str unit tests
154+</name>
155+</client>
156+</testcase>
157diff --git a/tests/unit/Makefile.inc b/tests/unit/Makefile.inc
158index 7e7844e..b5650b2 100644
159--- a/tests/unit/Makefile.inc
160+++ b/tests/unit/Makefile.inc
161@@ -34,7 +34,7 @@ UNITPROGS = unit1300 unit1301 unit1302 unit1303 unit1304 unit1305 unit1307 \
162 unit1600 unit1601 unit1602 unit1603 unit1604 unit1605 unit1606 unit1607 \
163 unit1608 unit1609 unit1610 unit1611 unit1612 \
164 unit1620 unit1621 \
165- unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 \
166+ unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 unit1656 \
167 unit1660 unit1661
168
169 unit1300_SOURCES = unit1300.c $(UNITFILES)
170@@ -155,6 +155,8 @@ unit1654_CPPFLAGS = $(AM_CPPFLAGS)
171 unit1655_SOURCES = unit1655.c $(UNITFILES)
172 unit1655_CPPFLAGS = $(AM_CPPFLAGS)
173
174+unit1656_SOURCES = unit1656.c $(UNITFILES)
175+
176 unit1660_SOURCES = unit1660.c $(UNITFILES)
177 unit1660_CPPFLAGS = $(AM_CPPFLAGS)
178
179diff --git a/tests/unit/unit1656.c b/tests/unit/unit1656.c
180new file mode 100644
181index 0000000..644e72f
182--- /dev/null
183+++ b/tests/unit/unit1656.c
184@@ -0,0 +1,133 @@
185+/***************************************************************************
186+ * _ _ ____ _
187+ * Project ___| | | | _ \| |
188+ * / __| | | | |_) | |
189+ * | (__| |_| | _ <| |___
190+ * \___|\___/|_| \_\_____|
191+ *
192+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
193+ *
194+ * This software is licensed as described in the file COPYING, which
195+ * you should have received as part of this distribution. The terms
196+ * are also available at https://curl.se/docs/copyright.html.
197+ *
198+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
199+ * copies of the Software, and permit persons to whom the Software is
200+ * furnished to do so, under the terms of the COPYING file.
201+ *
202+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
203+ * KIND, either express or implied.
204+ *
205+ * SPDX-License-Identifier: curl
206+ *
207+ ***************************************************************************/
208+#include "curlcheck.h"
209+
210+#include "vtls/x509asn1.h"
211+
212+static CURLcode unit_setup(void)
213+{
214+ return CURLE_OK;
215+}
216+
217+static void unit_stop(void)
218+{
219+
220+}
221+
222+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
223+ defined(USE_MBEDTLS)
224+
225+#ifndef ARRAYSIZE
226+#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
227+#endif
228+
229+struct test_spec {
230+ const char *input;
231+ const char *exp_output;
232+ CURLcode exp_result;
233+};
234+
235+static struct test_spec test_specs[] = {
236+ { "190321134340", "1903-21-13 43:40:00", CURLE_OK },
237+ { "", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
238+ { "WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
239+ { "0WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
240+ { "19032113434", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
241+ { "19032113434WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
242+ { "190321134340.", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
243+ { "190321134340.1", "1903-21-13 43:40:00.1", CURLE_OK },
244+ { "19032113434017.0", "1903-21-13 43:40:17", CURLE_OK },
245+ { "19032113434017.01", "1903-21-13 43:40:17.01", CURLE_OK },
246+ { "19032113434003.001", "1903-21-13 43:40:03.001", CURLE_OK },
247+ { "19032113434003.090", "1903-21-13 43:40:03.09", CURLE_OK },
248+ { "190321134340Z", "1903-21-13 43:40:00 GMT", CURLE_OK },
249+ { "19032113434017.0Z", "1903-21-13 43:40:17 GMT", CURLE_OK },
250+ { "19032113434017.01Z", "1903-21-13 43:40:17.01 GMT", CURLE_OK },
251+ { "19032113434003.001Z", "1903-21-13 43:40:03.001 GMT", CURLE_OK },
252+ { "19032113434003.090Z", "1903-21-13 43:40:03.09 GMT", CURLE_OK },
253+ { "190321134340CET", "1903-21-13 43:40:00 CET", CURLE_OK },
254+ { "19032113434017.0CET", "1903-21-13 43:40:17 CET", CURLE_OK },
255+ { "19032113434017.01CET", "1903-21-13 43:40:17.01 CET", CURLE_OK },
256+ { "190321134340+02:30", "1903-21-13 43:40:00 UTC+02:30", CURLE_OK },
257+ { "19032113434017.0+02:30", "1903-21-13 43:40:17 UTC+02:30", CURLE_OK },
258+ { "19032113434017.01+02:30", "1903-21-13 43:40:17.01 UTC+02:30", CURLE_OK },
259+ { "190321134340-3", "1903-21-13 43:40:00 UTC-3", CURLE_OK },
260+ { "19032113434017.0-04", "1903-21-13 43:40:17 UTC-04", CURLE_OK },
261+ { "19032113434017.01-01:10", "1903-21-13 43:40:17.01 UTC-01:10", CURLE_OK },
262+};
263+
264+static bool do_test(struct test_spec *spec, size_t i, struct dynbuf *dbuf)
265+{
266+ CURLcode result;
267+ const char *in = spec->input;
268+
269+ Curl_dyn_reset(dbuf);
270+ result = Curl_x509_GTime2str(dbuf, in, in + strlen(in));
271+ if(result != spec->exp_result) {
272+ fprintf(stderr, "test %zu: expect result %d, got %d\n",
273+ i, spec->exp_result, result);
274+ return FALSE;
275+ }
276+ else if(!result && strcmp(spec->exp_output, Curl_dyn_ptr(dbuf))) {
277+ fprintf(stderr, "test %zu: input '%s', expected output '%s', got '%s'\n",
278+ i, in, spec->exp_output, Curl_dyn_ptr(dbuf));
279+ return FALSE;
280+ }
281+
282+ return TRUE;
283+}
284+
285+UNITTEST_START
286+{
287+ size_t i;
288+ struct dynbuf dbuf;
289+ bool all_ok = TRUE;
290+
291+ Curl_dyn_init(&dbuf, 32*1024);
292+
293+ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
294+ fprintf(stderr, "curl_global_init() failed\n");
295+ return TEST_ERR_MAJOR_BAD;
296+ }
297+
298+ for(i = 0; i < ARRAYSIZE(test_specs); ++i) {
299+ if(!do_test(&test_specs[i], i, &dbuf))
300+ all_ok = FALSE;
301+ }
302+ fail_unless(all_ok, "some tests of Curl_x509_GTime2str() fails");
303+
304+ Curl_dyn_free(&dbuf);
305+ curl_global_cleanup();
306+}
307+UNITTEST_STOP
308+
309+#else
310+
311+UNITTEST_START
312+{
313+ puts("not tested since Curl_x509_GTime2str() is not built-in");
314+}
315+UNITTEST_STOP
316+
317+#endif
318--
3192.35.7
320
diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb
index 72d8544e08..81a653b583 100644
--- a/meta/recipes-support/curl/curl_7.82.0.bb
+++ b/meta/recipes-support/curl/curl_7.82.0.bb
@@ -58,6 +58,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
58 file://CVE-2023-46219-0002.patch \ 58 file://CVE-2023-46219-0002.patch \
59 file://CVE-2023-46219-0003.patch \ 59 file://CVE-2023-46219-0003.patch \
60 file://CVE-2024-2398.patch \ 60 file://CVE-2024-2398.patch \
61 file://CVE-2024-7264_1.patch \
62 file://CVE-2024-7264_2.patch \
61 " 63 "
62SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c" 64SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
63 65
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-26 03:06:35 +0000