summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
diff options
context:
space:
mode:
authorMingli Yu <mingli.yu@windriver.com>2023-06-12 17:29:19 +0800
committerSteve Sakoman <steve@sakoman.com>2023-06-21 06:50:49 -1000
commit925be0b930535bc5ad4f10eacb8bf78bd62f94ac (patch)
tree7e2843dc70df2a26c856f9f5202a911bf154c969 /meta/recipes-support
parentfc25449687d0283a327c7b4fb1e618b275b3a871 (diff)
downloadpoky-925be0b930535bc5ad4f10eacb8bf78bd62f94ac.tar.gz
curl: fix CVE-2023-28319 through CVE-2023-28322
Backport patches to fix the below CVEs: CVE-2023-28319 CVE-2023-28320 CVE-2023-28321 CVE-2023-28322 (From OE-Core rev: 6612ec59d6680f845f9a96598522aa4d6605690b) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-support')
-rw-r--r--meta/recipes-support/curl/curl/CVE-2023-28319.patch38
-rw-r--r--meta/recipes-support/curl/curl/CVE-2023-28320.patch88
-rw-r--r--meta/recipes-support/curl/curl/CVE-2023-28321.patch111
-rw-r--r--meta/recipes-support/curl/curl/CVE-2023-28322.patch441
-rw-r--r--meta/recipes-support/curl/curl_8.0.1.bb4
5 files changed, 682 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2023-28319.patch b/meta/recipes-support/curl/curl/CVE-2023-28319.patch
new file mode 100644
index 0000000000..c843a18174
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-28319.patch
@@ -0,0 +1,38 @@
1From 8e21b1a05f3c0ee098dbcb6c3d84cb61f102a122 Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Mon, 8 May 2023 14:33:54 +0200
4Subject: [PATCH] libssh2: free fingerprint better
5
6Reported-by: Wei Chong Tan
7Closes #11088
8
9CVE: CVE-2023-28319
10
11Upstream-Status: Backport [https://github.com/curl/curl/commit/8e21b1a05f3c0ee098dbcb6c]
12
13Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
14
15---
16 lib/vssh/libssh2.c | 3 +--
17 1 file changed, 1 insertion(+), 2 deletions(-)
18
19diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
20index bfcc94e16..dd39a844c 100644
21--- a/lib/vssh/libssh2.c
22+++ b/lib/vssh/libssh2.c
23@@ -728,11 +728,10 @@ static CURLcode ssh_check_fingerprint(struct Curl_easy *data)
24 */
25 if((pub_pos != b64_pos) ||
26 strncmp(fingerprint_b64, pubkey_sha256, pub_pos)) {
27- free(fingerprint_b64);
28-
29 failf(data,
30 "Denied establishing ssh session: mismatch sha256 fingerprint. "
31 "Remote %s is not equal to %s", fingerprint_b64, pubkey_sha256);
32+ free(fingerprint_b64);
33 state(data, SSH_SESSION_FREE);
34 sshc->actualcode = CURLE_PEER_FAILED_VERIFICATION;
35 return sshc->actualcode;
36--
372.25.1
38
diff --git a/meta/recipes-support/curl/curl/CVE-2023-28320.patch b/meta/recipes-support/curl/curl/CVE-2023-28320.patch
new file mode 100644
index 0000000000..c7cfd6a42f
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-28320.patch
@@ -0,0 +1,88 @@
1From 13718030ad4b3209a7583b4f27f683cd3a6fa5f2 Mon Sep 17 00:00:00 2001
2From: Harry Sintonen <sintonen@iki.fi>
3Date: Tue, 25 Apr 2023 09:22:26 +0200
4Subject: [PATCH] hostip: add locks around use of global buffer for alarm()
5
6When building with the sync name resolver and timeout ability we now
7require thread-safety to be present to enable it.
8
9Closes #11030
10
11CVE: CVE-2023-28320
12
13Upstream-Status: Backport [https://github.com/curl/curl/commit/13718030ad4b3209a7583b]
14
15Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
16---
17 lib/hostip.c | 19 +++++++++++++++----
18 1 file changed, 15 insertions(+), 4 deletions(-)
19
20diff --git a/lib/hostip.c b/lib/hostip.c
21index 2381290fd..e410cda69 100644
22--- a/lib/hostip.c
23+++ b/lib/hostip.c
24@@ -70,12 +70,19 @@
25 #include <SystemConfiguration/SCDynamicStoreCopySpecific.h>
26 #endif
27
28-#if defined(CURLRES_SYNCH) && \
29- defined(HAVE_ALARM) && defined(SIGALRM) && defined(HAVE_SIGSETJMP)
30+#if defined(CURLRES_SYNCH) && \
31+ defined(HAVE_ALARM) && \
32+ defined(SIGALRM) && \
33+ defined(HAVE_SIGSETJMP) && \
34+ defined(GLOBAL_INIT_IS_THREADSAFE)
35 /* alarm-based timeouts can only be used with all the dependencies satisfied */
36 #define USE_ALARM_TIMEOUT
37 #endif
38
39+#ifdef USE_ALARM_TIMEOUT
40+#include "easy_lock.h"
41+#endif
42+
43 #define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */
44
45 /*
46@@ -254,11 +261,12 @@ void Curl_hostcache_prune(struct Curl_easy *data)
47 Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
48 }
49
50-#ifdef HAVE_SIGSETJMP
51+#ifdef USE_ALARM_TIMEOUT
52 /* Beware this is a global and unique instance. This is used to store the
53 return address that we can jump back to from inside a signal handler. This
54 is not thread-safe stuff. */
55 sigjmp_buf curl_jmpenv;
56+curl_simple_lock curl_jmpenv_lock;
57 #endif
58
59 /* lookup address, returns entry if found and not stale */
60@@ -832,7 +840,6 @@ enum resolve_t Curl_resolv(struct Curl_easy *data,
61 static
62 void alarmfunc(int sig)
63 {
64- /* this is for "-ansi -Wall -pedantic" to stop complaining! (rabe) */
65 (void)sig;
66 siglongjmp(curl_jmpenv, 1);
67 }
68@@ -912,6 +919,8 @@ enum resolve_t Curl_resolv_timeout(struct Curl_easy *data,
69 This should be the last thing we do before calling Curl_resolv(),
70 as otherwise we'd have to worry about variables that get modified
71 before we invoke Curl_resolv() (and thus use "volatile"). */
72+ curl_simple_lock_lock(&curl_jmpenv_lock);
73+
74 if(sigsetjmp(curl_jmpenv, 1)) {
75 /* this is coming from a siglongjmp() after an alarm signal */
76 failf(data, "name lookup timed out");
77@@ -980,6 +989,8 @@ clean_up:
78 #endif
79 #endif /* HAVE_SIGACTION */
80
81+ curl_simple_lock_unlock(&curl_jmpenv_lock);
82+
83 /* switch back the alarm() to either zero or to what it was before minus
84 the time we spent until now! */
85 if(prev_alarm) {
86--
872.25.1
88
diff --git a/meta/recipes-support/curl/curl/CVE-2023-28321.patch b/meta/recipes-support/curl/curl/CVE-2023-28321.patch
new file mode 100644
index 0000000000..d328d83afa
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-28321.patch
@@ -0,0 +1,111 @@
1From 199f2d440d8659b42670c1b796220792b01a97bf Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Mon, 24 Apr 2023 21:07:02 +0200
4Subject: [PATCH] hostcheck: fix host name wildcard checking
5
6The leftmost "label" of the host name can now only match against single
7'*'. Like the browsers have worked for a long time.
8
9Reported-by: Hiroki Kurosawa
10Closes #11018
11
12CVE: CVE-2023-28321
13
14Upstream-Status: Backport [https://github.com/curl/curl/commit/199f2d440d8659b42]
15
16Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
17---
18 lib/vtls/hostcheck.c | 50 +++++++--------
19 1 file changed, 202 insertions(+), 180 deletions(-)
20
21diff --git a/lib/vtls/hostcheck.c b/lib/vtls/hostcheck.c
22index e827dc58f..d061c6356 100644
23--- a/lib/vtls/hostcheck.c
24+++ b/lib/vtls/hostcheck.c
25@@ -71,7 +71,12 @@ static bool pmatch(const char *hostname, size_t hostlen,
26 * apparent distinction between a name and an IP. We need to detect the use of
27 * an IP address and not wildcard match on such names.
28 *
29+ * Only match on "*" being used for the leftmost label, not "a*", "a*b" nor
30+ * "*b".
31+ *
32 * Return TRUE on a match. FALSE if not.
33+ *
34+ * @unittest: 1397
35 */
36
37 static bool hostmatch(const char *hostname,
38@@ -79,53 +84,42 @@ static bool hostmatch(const char *hostname,
39 const char *pattern,
40 size_t patternlen)
41 {
42- const char *pattern_label_end, *wildcard, *hostname_label_end;
43- size_t prefixlen, suffixlen;
44+ const char *pattern_label_end;
45
46- /* normalize pattern and hostname by stripping off trailing dots */
47+ DEBUGASSERT(pattern);
48 DEBUGASSERT(patternlen);
49+ DEBUGASSERT(hostname);
50+ DEBUGASSERT(hostlen);
51+
52+ /* normalize pattern and hostname by stripping off trailing dots */
53 if(hostname[hostlen-1]=='.')
54 hostlen--;
55 if(pattern[patternlen-1]=='.')
56 patternlen--;
57
58- wildcard = memchr(pattern, '*', patternlen);
59- if(!wildcard)
60+ if(strncmp(pattern, "*.", 2))
61 return pmatch(hostname, hostlen, pattern, patternlen);
62
63 /* detect IP address as hostname and fail the match if so */
64- if(Curl_host_is_ipnum(hostname))
65+ else if(Curl_host_is_ipnum(hostname))
66 return FALSE;
67
68 /* We require at least 2 dots in the pattern to avoid too wide wildcard
69 match. */
70 pattern_label_end = memchr(pattern, '.', patternlen);
71 if(!pattern_label_end ||
72- (memrchr(pattern, '.', patternlen) == pattern_label_end) ||
73- strncasecompare(pattern, "xn--", 4))
74+ (memrchr(pattern, '.', patternlen) == pattern_label_end))
75 return pmatch(hostname, hostlen, pattern, patternlen);
76-
77- hostname_label_end = memchr(hostname, '.', hostlen);
78- if(!hostname_label_end)
79- return FALSE;
80 else {
81- size_t skiphost = hostname_label_end - hostname;
82- size_t skiplen = pattern_label_end - pattern;
83- if(!pmatch(hostname_label_end, hostlen - skiphost,
84- pattern_label_end, patternlen - skiplen))
85- return FALSE;
86+ const char *hostname_label_end = memchr(hostname, '.', hostlen);
87+ if(hostname_label_end) {
88+ size_t skiphost = hostname_label_end - hostname;
89+ size_t skiplen = pattern_label_end - pattern;
90+ return pmatch(hostname_label_end, hostlen - skiphost,
91+ pattern_label_end, patternlen - skiplen);
92+ }
93 }
94- /* The wildcard must match at least one character, so the left-most
95- label of the hostname is at least as large as the left-most label
96- of the pattern. */
97- if(hostname_label_end - hostname < pattern_label_end - pattern)
98- return FALSE;
99-
100- prefixlen = wildcard - pattern;
101- suffixlen = pattern_label_end - (wildcard + 1);
102- return strncasecompare(pattern, hostname, prefixlen) &&
103- strncasecompare(wildcard + 1, hostname_label_end - suffixlen,
104- suffixlen) ? TRUE : FALSE;
105+ return FALSE;
106 }
107
108 /*
109--
1102.25.1
111
diff --git a/meta/recipes-support/curl/curl/CVE-2023-28322.patch b/meta/recipes-support/curl/curl/CVE-2023-28322.patch
new file mode 100644
index 0000000000..d0786d7a4b
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-28322.patch
@@ -0,0 +1,441 @@
1From 7815647d6582c0a4900be2e1de6c5e61272c496b Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Tue, 25 Apr 2023 08:28:01 +0200
4Subject: [PATCH] lib: unify the upload/method handling
5
6By making sure we set state.upload based on the set.method value and not
7independently as set.upload, we reduce confusion and mixup risks, both
8internally and externally.
9
10Closes #11017
11
12CVE: CVE-2023-28322
13
14Upstream-Status: Backport [https://github.com/curl/curl/commit/7815647d6582c0a4900be2e1de]
15
16Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
17
18---
19 lib/curl_rtmp.c | 4 ++--
20 lib/file.c | 4 ++--
21 lib/ftp.c | 8 ++++----
22 lib/http.c | 4 ++--
23 lib/imap.c | 6 +++---
24 lib/rtsp.c | 4 ++--
25 lib/setopt.c | 6 ++----
26 lib/smb.c | 6 +++---
27 lib/smtp.c | 4 ++--
28 lib/tftp.c | 8 ++++----
29 lib/transfer.c | 4 ++--
30 lib/urldata.h | 2 +-
31 lib/vssh/libssh.c | 6 +++---
32 lib/vssh/libssh2.c | 6 +++---
33 lib/vssh/wolfssh.c | 2 +-
34 15 files changed, 36 insertions(+), 38 deletions(-)
35
36diff --git a/lib/curl_rtmp.c b/lib/curl_rtmp.c
37index 2679a2cdc..406fb42ac 100644
38--- a/lib/curl_rtmp.c
39+++ b/lib/curl_rtmp.c
40@@ -231,7 +231,7 @@ static CURLcode rtmp_connect(struct Curl_easy *data, bool *done)
41 /* We have to know if it's a write before we send the
42 * connect request packet
43 */
44- if(data->set.upload)
45+ if(data->state.upload)
46 r->Link.protocol |= RTMP_FEATURE_WRITE;
47
48 /* For plain streams, use the buffer toggle trick to keep data flowing */
49@@ -263,7 +263,7 @@ static CURLcode rtmp_do(struct Curl_easy *data, bool *done)
50 if(!RTMP_ConnectStream(r, 0))
51 return CURLE_FAILED_INIT;
52
53- if(data->set.upload) {
54+ if(data->state.upload) {
55 Curl_pgrsSetUploadSize(data, data->state.infilesize);
56 Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
57 }
58diff --git a/lib/file.c b/lib/file.c
59index 51c5d07ce..c751e8861 100644
60--- a/lib/file.c
61+++ b/lib/file.c
62@@ -240,7 +240,7 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done)
63 file->freepath = real_path; /* free this when done */
64
65 file->fd = fd;
66- if(!data->set.upload && (fd == -1)) {
67+ if(!data->state.upload && (fd == -1)) {
68 failf(data, "Couldn't open file %s", data->state.up.path);
69 file_done(data, CURLE_FILE_COULDNT_READ_FILE, FALSE);
70 return CURLE_FILE_COULDNT_READ_FILE;
71@@ -422,7 +422,7 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
72
73 Curl_pgrsStartNow(data);
74
75- if(data->set.upload)
76+ if(data->state.upload)
77 return file_upload(data);
78
79 file = data->req.p.file;
80diff --git a/lib/ftp.c b/lib/ftp.c
81index f50d7baf6..4ff68cc45 100644
82--- a/lib/ftp.c
83+++ b/lib/ftp.c
84@@ -1348,7 +1348,7 @@ static CURLcode ftp_state_prepare_transfer(struct Curl_easy *data)
85 data->set.str[STRING_CUSTOMREQUEST]?
86 data->set.str[STRING_CUSTOMREQUEST]:
87 (data->state.list_only?"NLST":"LIST"));
88- else if(data->set.upload)
89+ else if(data->state.upload)
90 result = Curl_pp_sendf(data, &ftpc->pp, "PRET STOR %s",
91 conn->proto.ftpc.file);
92 else
93@@ -3384,7 +3384,7 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
94 /* the response code from the transfer showed an error already so no
95 use checking further */
96 ;
97- else if(data->set.upload) {
98+ else if(data->state.upload) {
99 if((-1 != data->state.infilesize) &&
100 (data->state.infilesize != data->req.writebytecount) &&
101 !data->set.crlf &&
102@@ -3640,7 +3640,7 @@ static CURLcode ftp_do_more(struct Curl_easy *data, int *completep)
103 connected back to us */
104 }
105 }
106- else if(data->set.upload) {
107+ else if(data->state.upload) {
108 result = ftp_nb_type(data, conn, data->state.prefer_ascii,
109 FTP_STOR_TYPE);
110 if(result)
111@@ -4225,7 +4225,7 @@ CURLcode ftp_parse_url_path(struct Curl_easy *data)
112 ftpc->file = NULL; /* instead of point to a zero byte,
113 we make it a NULL pointer */
114
115- if(data->set.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
116+ if(data->state.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
117 /* We need a file name when uploading. Return error! */
118 failf(data, "Uploading to a URL without a file name");
119 free(rawPath);
120diff --git a/lib/http.c b/lib/http.c
121index 80e43f6f3..bffdd3468 100644
122--- a/lib/http.c
123+++ b/lib/http.c
124@@ -2112,7 +2112,7 @@ void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
125 Curl_HttpReq httpreq = (Curl_HttpReq)data->state.httpreq;
126 const char *request;
127 if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
128- data->set.upload)
129+ data->state.upload)
130 httpreq = HTTPREQ_PUT;
131
132 /* Now set the 'request' pointer to the proper request string */
133@@ -2423,7 +2423,7 @@ CURLcode Curl_http_body(struct Curl_easy *data, struct connectdata *conn,
134 if((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
135 (((httpreq == HTTPREQ_POST_MIME || httpreq == HTTPREQ_POST_FORM) &&
136 http->postsize < 0) ||
137- ((data->set.upload || httpreq == HTTPREQ_POST) &&
138+ ((data->state.upload || httpreq == HTTPREQ_POST) &&
139 data->state.infilesize == -1))) {
140 if(conn->bits.authneg)
141 /* don't enable chunked during auth neg */
142diff --git a/lib/imap.c b/lib/imap.c
143index c2f675d4b..1952e66a1 100644
144--- a/lib/imap.c
145+++ b/lib/imap.c
146@@ -1511,11 +1511,11 @@ static CURLcode imap_done(struct Curl_easy *data, CURLcode status,
147 result = status; /* use the already set error code */
148 }
149 else if(!data->set.connect_only && !imap->custom &&
150- (imap->uid || imap->mindex || data->set.upload ||
151+ (imap->uid || imap->mindex || data->state.upload ||
152 data->set.mimepost.kind != MIMEKIND_NONE)) {
153 /* Handle responses after FETCH or APPEND transfer has finished */
154
155- if(!data->set.upload && data->set.mimepost.kind == MIMEKIND_NONE)
156+ if(!data->state.upload && data->set.mimepost.kind == MIMEKIND_NONE)
157 state(data, IMAP_FETCH_FINAL);
158 else {
159 /* End the APPEND command first by sending an empty line */
160@@ -1581,7 +1581,7 @@ static CURLcode imap_perform(struct Curl_easy *data, bool *connected,
161 selected = TRUE;
162
163 /* Start the first command in the DO phase */
164- if(data->set.upload || data->set.mimepost.kind != MIMEKIND_NONE)
165+ if(data->state.upload || data->set.mimepost.kind != MIMEKIND_NONE)
166 /* APPEND can be executed directly */
167 result = imap_perform_append(data);
168 else if(imap->custom && (selected || !imap->mailbox))
169diff --git a/lib/rtsp.c b/lib/rtsp.c
170index ea99d720e..ccd7264b0 100644
171--- a/lib/rtsp.c
172+++ b/lib/rtsp.c
173@@ -493,7 +493,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
174 rtspreq == RTSPREQ_SET_PARAMETER ||
175 rtspreq == RTSPREQ_GET_PARAMETER) {
176
177- if(data->set.upload) {
178+ if(data->state.upload) {
179 putsize = data->state.infilesize;
180 data->state.httpreq = HTTPREQ_PUT;
181
182@@ -512,7 +512,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
183 result =
184 Curl_dyn_addf(&req_buffer,
185 "Content-Length: %" CURL_FORMAT_CURL_OFF_T"\r\n",
186- (data->set.upload ? putsize : postsize));
187+ (data->state.upload ? putsize : postsize));
188 if(result)
189 return result;
190 }
191diff --git a/lib/setopt.c b/lib/setopt.c
192index 38f5711e4..0c3b9634d 100644
193--- a/lib/setopt.c
194+++ b/lib/setopt.c
195@@ -333,8 +333,8 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
196 * We want to sent data to the remote host. If this is HTTP, that equals
197 * using the PUT request.
198 */
199- data->set.upload = (0 != va_arg(param, long)) ? TRUE : FALSE;
200- if(data->set.upload) {
201+ arg = va_arg(param, long);
202+ if(arg) {
203 /* If this is HTTP, PUT is what's needed to "upload" */
204 data->set.method = HTTPREQ_PUT;
205 data->set.opt_no_body = FALSE; /* this is implied */
206@@ -664,7 +664,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
207 }
208 else
209 data->set.method = HTTPREQ_GET;
210- data->set.upload = FALSE;
211 break;
212
213 #ifndef CURL_DISABLE_MIME
214@@ -888,7 +887,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
215 */
216 if(va_arg(param, long)) {
217 data->set.method = HTTPREQ_GET;
218- data->set.upload = FALSE; /* switch off upload */
219 data->set.opt_no_body = FALSE; /* this is implied */
220 }
221 break;
222diff --git a/lib/smb.c b/lib/smb.c
223index a1e444ee6..d68222135 100644
224--- a/lib/smb.c
225+++ b/lib/smb.c
226@@ -530,7 +530,7 @@ static CURLcode smb_send_open(struct Curl_easy *data)
227 byte_count = strlen(req->path);
228 msg.name_length = smb_swap16((unsigned short)byte_count);
229 msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
230- if(data->set.upload) {
231+ if(data->state.upload) {
232 msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
233 msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
234 }
235@@ -762,7 +762,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
236 void *msg = NULL;
237 const struct smb_nt_create_response *smb_m;
238
239- if(data->set.upload && (data->state.infilesize < 0)) {
240+ if(data->state.upload && (data->state.infilesize < 0)) {
241 failf(data, "SMB upload needs to know the size up front");
242 return CURLE_SEND_ERROR;
243 }
244@@ -813,7 +813,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
245 smb_m = (const struct smb_nt_create_response*) msg;
246 req->fid = smb_swap16(smb_m->fid);
247 data->req.offset = 0;
248- if(data->set.upload) {
249+ if(data->state.upload) {
250 data->req.size = data->state.infilesize;
251 Curl_pgrsSetUploadSize(data, data->req.size);
252 next_state = SMB_UPLOAD;
253diff --git a/lib/smtp.c b/lib/smtp.c
254index 7a030308d..c182cace7 100644
255--- a/lib/smtp.c
256+++ b/lib/smtp.c
257@@ -1419,7 +1419,7 @@ static CURLcode smtp_done(struct Curl_easy *data, CURLcode status,
258 result = status; /* use the already set error code */
259 }
260 else if(!data->set.connect_only && data->set.mail_rcpt &&
261- (data->set.upload || data->set.mimepost.kind)) {
262+ (data->state.upload || data->set.mimepost.kind)) {
263 /* Calculate the EOB taking into account any terminating CRLF from the
264 previous line of the email or the CRLF of the DATA command when there
265 is "no mail data". RFC-5321, sect. 4.1.1.4.
266@@ -1511,7 +1511,7 @@ static CURLcode smtp_perform(struct Curl_easy *data, bool *connected,
267 smtp->eob = 2;
268
269 /* Start the first command in the DO phase */
270- if((data->set.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
271+ if((data->state.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
272 /* MAIL transfer */
273 result = smtp_perform_mail(data);
274 else
275diff --git a/lib/tftp.c b/lib/tftp.c
276index 164d3c723..8ed1b887b 100644
277--- a/lib/tftp.c
278+++ b/lib/tftp.c
279@@ -370,7 +370,7 @@ static CURLcode tftp_parse_option_ack(struct tftp_state_data *state,
280
281 /* tsize should be ignored on upload: Who cares about the size of the
282 remote file? */
283- if(!data->set.upload) {
284+ if(!data->state.upload) {
285 if(!tsize) {
286 failf(data, "invalid tsize -:%s:- value in OACK packet", value);
287 return CURLE_TFTP_ILLEGAL;
288@@ -451,7 +451,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
289 return result;
290 }
291
292- if(data->set.upload) {
293+ if(data->state.upload) {
294 /* If we are uploading, send an WRQ */
295 setpacketevent(&state->spacket, TFTP_EVENT_WRQ);
296 state->data->req.upload_fromhere =
297@@ -486,7 +486,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
298 if(!data->set.tftp_no_options) {
299 char buf[64];
300 /* add tsize option */
301- if(data->set.upload && (data->state.infilesize != -1))
302+ if(data->state.upload && (data->state.infilesize != -1))
303 msnprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
304 data->state.infilesize);
305 else
306@@ -540,7 +540,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
307 break;
308
309 case TFTP_EVENT_OACK:
310- if(data->set.upload) {
311+ if(data->state.upload) {
312 result = tftp_connect_for_tx(state, event);
313 }
314 else {
315diff --git a/lib/transfer.c b/lib/transfer.c
316index e9ab8fbf0..cb69f3365 100644
317--- a/lib/transfer.c
318+++ b/lib/transfer.c
319@@ -1293,6 +1293,7 @@ void Curl_init_CONNECT(struct Curl_easy *data)
320 {
321 data->state.fread_func = data->set.fread_func_set;
322 data->state.in = data->set.in_set;
323+ data->state.upload = (data->state.httpreq == HTTPREQ_PUT);
324 }
325
326 /*
327@@ -1732,7 +1733,6 @@ CURLcode Curl_follow(struct Curl_easy *data,
328 data->state.httpreq != HTTPREQ_POST_MIME) ||
329 !(data->set.keep_post & CURL_REDIR_POST_303))) {
330 data->state.httpreq = HTTPREQ_GET;
331- data->set.upload = false;
332 infof(data, "Switch to %s",
333 data->req.no_body?"HEAD":"GET");
334 }
335@@ -1770,7 +1770,7 @@ CURLcode Curl_retry_request(struct Curl_easy *data, char **url)
336
337 /* if we're talking upload, we can't do the checks below, unless the protocol
338 is HTTP as when uploading over HTTP we will still get a response */
339- if(data->set.upload &&
340+ if(data->state.upload &&
341 !(conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_RTSP)))
342 return CURLE_OK;
343
344diff --git a/lib/urldata.h b/lib/urldata.h
345index cca992a02..a8580bdb6 100644
346--- a/lib/urldata.h
347+++ b/lib/urldata.h
348@@ -1462,6 +1462,7 @@ struct UrlState {
349 BIT(rewindbeforesend);/* TRUE when the sending couldn't be stopped even
350 though it will be discarded. We must call the data
351 rewind callback before trying to send again. */
352+ BIT(upload); /* upload request */
353 };
354
355 /*
356@@ -1838,7 +1839,6 @@ struct UserDefined {
357 BIT(http_auto_referer); /* set "correct" referer when following
358 location: */
359 BIT(opt_no_body); /* as set with CURLOPT_NOBODY */
360- BIT(upload); /* upload request */
361 BIT(verbose); /* output verbosity */
362 BIT(krb); /* Kerberos connection requested */
363 BIT(reuse_forbid); /* forbidden to be reused, close after use */
364diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
365index b31f741ba..d60edaa30 100644
366--- a/lib/vssh/libssh.c
367+++ b/lib/vssh/libssh.c
368@@ -1209,7 +1209,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
369 }
370
371 case SSH_SFTP_TRANS_INIT:
372- if(data->set.upload)
373+ if(data->state.upload)
374 state(data, SSH_SFTP_UPLOAD_INIT);
375 else {
376 if(protop->path[strlen(protop->path)-1] == '/')
377@@ -1802,7 +1802,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
378 /* Functions from the SCP subsystem cannot handle/return SSH_AGAIN */
379 ssh_set_blocking(sshc->ssh_session, 1);
380
381- if(data->set.upload) {
382+ if(data->state.upload) {
383 if(data->state.infilesize < 0) {
384 failf(data, "SCP requires a known file size for upload");
385 sshc->actualcode = CURLE_UPLOAD_FAILED;
386@@ -1907,7 +1907,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
387 break;
388 }
389 case SSH_SCP_DONE:
390- if(data->set.upload)
391+ if(data->state.upload)
392 state(data, SSH_SCP_SEND_EOF);
393 else
394 state(data, SSH_SCP_CHANNEL_FREE);
395diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
396index f1154dc47..f2e5352d1 100644
397--- a/lib/vssh/libssh2.c
398+++ b/lib/vssh/libssh2.c
399@@ -2019,7 +2019,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
400 }
401
402 case SSH_SFTP_TRANS_INIT:
403- if(data->set.upload)
404+ if(data->state.upload)
405 state(data, SSH_SFTP_UPLOAD_INIT);
406 else {
407 if(sshp->path[strlen(sshp->path)-1] == '/')
408@@ -2691,7 +2691,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
409 break;
410 }
411
412- if(data->set.upload) {
413+ if(data->state.upload) {
414 if(data->state.infilesize < 0) {
415 failf(data, "SCP requires a known file size for upload");
416 sshc->actualcode = CURLE_UPLOAD_FAILED;
417@@ -2831,7 +2831,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
418 break;
419
420 case SSH_SCP_DONE:
421- if(data->set.upload)
422+ if(data->state.upload)
423 state(data, SSH_SCP_SEND_EOF);
424 else
425 state(data, SSH_SCP_CHANNEL_FREE);
426diff --git a/lib/vssh/wolfssh.c b/lib/vssh/wolfssh.c
427index 17d59ecd2..2ca91b736 100644
428--- a/lib/vssh/wolfssh.c
429+++ b/lib/vssh/wolfssh.c
430@@ -557,7 +557,7 @@ static CURLcode wssh_statemach_act(struct Curl_easy *data, bool *block)
431 }
432 break;
433 case SSH_SFTP_TRANS_INIT:
434- if(data->set.upload)
435+ if(data->state.upload)
436 state(data, SSH_SFTP_UPLOAD_INIT);
437 else {
438 if(sftp_scp->path[strlen(sftp_scp->path)-1] == '/')
439--
4402.25.1
441
diff --git a/meta/recipes-support/curl/curl_8.0.1.bb b/meta/recipes-support/curl/curl_8.0.1.bb
index 5cf044615f..ecef173df2 100644
--- a/meta/recipes-support/curl/curl_8.0.1.bb
+++ b/meta/recipes-support/curl/curl_8.0.1.bb
@@ -13,6 +13,10 @@ SRC_URI = " \
13 https://curl.se/download/${BP}.tar.xz \ 13 https://curl.se/download/${BP}.tar.xz \
14 file://run-ptest \ 14 file://run-ptest \
15 file://disable-tests \ 15 file://disable-tests \
16 file://CVE-2023-28322.patch \
17 file://CVE-2023-28319.patch \
18 file://CVE-2023-28320.patch \
19 file://CVE-2023-28321.patch \
16" 20"
17SRC_URI[sha256sum] = "0a381cd82f4d00a9a334438b8ca239afea5bfefcfa9a1025f2bf118e79e0b5f0" 21SRC_URI[sha256sum] = "0a381cd82f4d00a9a334438b8ca239afea5bfefcfa9a1025f2bf118e79e0b5f0"
18 22
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-23 01:42:15 +0000