summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-support/curl/curl/CVE-2023-28322-1.patch84
-rw-r--r--meta/recipes-support/curl/curl/CVE-2023-28322-2.patch436
-rw-r--r--meta/recipes-support/curl/curl_7.82.0.bb2
3 files changed, 522 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2023-28322-1.patch b/meta/recipes-support/curl/curl/CVE-2023-28322-1.patch
new file mode 100644
index 0000000000..547127001d
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-28322-1.patch
@@ -0,0 +1,84 @@
1From efbf02111aa66bda9288506b7d5cc0226bf5453e Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Sun, 12 Feb 2023 13:24:08 +0100
4Subject: [PATCH] smb: return error on upload without size
5
6The protocol needs to know the size ahead of time, this is now a known
7restriction and not a bug.
8
9Also output a clearer error if the URL path does not contain proper
10share.
11
12Ref: #7896
13Closes #10484
14
15CVE: CVE-2023-28322
16Upstream-Status: Backport [https://github.com/curl/curl/commit/efbf02111aa66bda9288506b7d5cc0226bf5453e]
17Comments: Hunks refreshed
18Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
19---
20 docs/KNOWN_BUGS | 5 -----
21 docs/URL-SYNTAX.md | 3 +++
22 lib/smb.c | 6 ++++++
23 3 files changed, 9 insertions(+), 5 deletions(-)
24
25diff --git a/docs/KNOWN_BUGS b/docs/KNOWN_BUGS
26index cbf5be352a279..a515e7a59bdfd 100644
27--- a/docs/KNOWN_BUGS
28+++ b/docs/KNOWN_BUGS
29@@ -58,7 +58,6 @@
30 5.7 Visual Studio project gaps
31 5.8 configure finding libs in wrong directory
32 5.9 Utilize Requires.private directives in libcurl.pc
33- 5.10 curl hangs on SMB upload over stdin
34 5.11 configure --with-gssapi with Heimdal is ignored on macOS
35 5.12 flaky Windows CI builds
36
37@@ -332,10 +331,6 @@ problems may have been fixed or changed somewhat since this was written.
38
39 https://github.com/curl/curl/issues/864
40
41-5.10 curl hangs on SMB upload over stdin
42-
43- See https://github.com/curl/curl/issues/7896
44-
45 5.11 configure --with-gssapi with Heimdal is ignored on macOS
46
47 ... unless you also pass --with-gssapi-libs
48diff --git a/docs/URL-SYNTAX.md b/docs/URL-SYNTAX.md
49index 691fcceacd66c..802bbdef96979 100644
50--- a/docs/URL-SYNTAX.md
51+++ b/docs/URL-SYNTAX.md
52@@ -360,6 +360,9 @@ share and directory or the share to upload to and as such, may not be omitted.
53 If the user name is embedded in the URL then it must contain the domain name
54 and as such, the backslash must be URL encoded as %2f.
55
56+When uploading to SMB, the size of the file needs to be known ahead of time,
57+meaning that you can upload a file passed to curl over a pipe like stdin.
58+
59 curl supports SMB version 1 (only)
60
61 ## SMTP
62diff --git a/lib/smb.c b/lib/smb.c
63index 8a76763c157ce..dc0abe784bcee 100644
64--- a/lib/smb.c
65+++ b/lib/smb.c
66@@ -763,6 +763,11 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
67 void *msg = NULL;
68 const struct smb_nt_create_response *smb_m;
69
70+ if(data->set.upload && (data->state.infilesize < 0)) {
71+ failf(data, "SMB upload needs to know the size up front");
72+ return CURLE_SEND_ERROR;
73+ }
74+
75 /* Start the request */
76 if(req->state == SMB_REQUESTING) {
77 result = smb_send_tree_connect(data);
78@@ -993,6 +998,7 @@ static CURLcode smb_parse_url_path(struct Curl_easy *data,
79 /* The share must be present */
80 if(!slash) {
81 Curl_safefree(smbc->share);
82+ failf(data, "missing share in URL path for SMB");
83 return CURLE_URL_MALFORMAT;
84 }
diff --git a/meta/recipes-support/curl/curl/CVE-2023-28322-2.patch b/meta/recipes-support/curl/curl/CVE-2023-28322-2.patch
new file mode 100644
index 0000000000..f2134dd1c3
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-28322-2.patch
@@ -0,0 +1,436 @@
1From 7815647d6582c0a4900be2e1de6c5e61272c496b Mon Sep 17 00:00:00 2001
2From: Daniel Stenberg <daniel@haxx.se>
3Date: Tue, 25 Apr 2023 08:28:01 +0200
4Subject: [PATCH] lib: unify the upload/method handling
5
6By making sure we set state.upload based on the set.method value and not
7independently as set.upload, we reduce confusion and mixup risks, both
8internally and externally.
9
10Closes #11017
11
12CVE: CVE-2023-28322
13Upstream-Status: Backport [https://github.com/curl/curl/commit/7815647d6582c0a4900be2e1de]
14Comments: Hunks refreshed
15Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
16---
17 lib/curl_rtmp.c | 4 ++--
18 lib/file.c | 4 ++--
19 lib/ftp.c | 8 ++++----
20 lib/http.c | 4 ++--
21 lib/imap.c | 6 +++---
22 lib/rtsp.c | 4 ++--
23 lib/setopt.c | 6 ++----
24 lib/smb.c | 6 +++---
25 lib/smtp.c | 4 ++--
26 lib/tftp.c | 8 ++++----
27 lib/transfer.c | 4 ++--
28 lib/urldata.h | 2 +-
29 lib/vssh/libssh.c | 6 +++---
30 lib/vssh/libssh2.c | 6 +++---
31 lib/vssh/wolfssh.c | 2 +-
32 15 files changed, 36 insertions(+), 38 deletions(-)
33
34diff --git a/lib/curl_rtmp.c b/lib/curl_rtmp.c
35index 2679a2cdc1afe..406fb42ac0f44 100644
36--- a/lib/curl_rtmp.c
37+++ b/lib/curl_rtmp.c
38@@ -231,7 +231,7 @@ static CURLcode rtmp_connect(struct Curl_easy *data, bool *done)
39 /* We have to know if it's a write before we send the
40 * connect request packet
41 */
42- if(data->set.upload)
43+ if(data->state.upload)
44 r->Link.protocol |= RTMP_FEATURE_WRITE;
45
46 /* For plain streams, use the buffer toggle trick to keep data flowing */
47@@ -263,7 +263,7 @@ static CURLcode rtmp_do(struct Curl_easy *data, bool *done)
48 if(!RTMP_ConnectStream(r, 0))
49 return CURLE_FAILED_INIT;
50
51- if(data->set.upload) {
52+ if(data->state.upload) {
53 Curl_pgrsSetUploadSize(data, data->state.infilesize);
54 Curl_setup_transfer(data, -1, -1, FALSE, FIRSTSOCKET);
55 }
56diff --git a/lib/file.c b/lib/file.c
57index 51c5d07ce40ab..c751e8861a99b 100644
58--- a/lib/file.c
59+++ b/lib/file.c
60@@ -240,7 +240,7 @@ static CURLcode file_connect(struct Curl_easy *data, bool *done)
61 file->freepath = real_path; /* free this when done */
62
63 file->fd = fd;
64- if(!data->set.upload && (fd == -1)) {
65+ if(!data->state.upload && (fd == -1)) {
66 failf(data, "Couldn't open file %s", data->state.up.path);
67 file_done(data, CURLE_FILE_COULDNT_READ_FILE, FALSE);
68 return CURLE_FILE_COULDNT_READ_FILE;
69@@ -422,7 +422,7 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
70
71 Curl_pgrsStartNow(data);
72
73- if(data->set.upload)
74+ if(data->state.upload)
75 return file_upload(data);
76
77 file = data->req.p.file;
78diff --git a/lib/ftp.c b/lib/ftp.c
79index f50d7baf622f8..4ff68cc454cbc 100644
80--- a/lib/ftp.c
81+++ b/lib/ftp.c
82@@ -1348,7 +1348,7 @@ static CURLcode ftp_state_prepare_transfer(struct Curl_easy *data)
83 data->set.str[STRING_CUSTOMREQUEST]?
84 data->set.str[STRING_CUSTOMREQUEST]:
85 (data->state.list_only?"NLST":"LIST"));
86- else if(data->set.upload)
87+ else if(data->state.upload)
88 result = Curl_pp_sendf(data, &ftpc->pp, "PRET STOR %s",
89 conn->proto.ftpc.file);
90 else
91@@ -3384,7 +3384,7 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
92 /* the response code from the transfer showed an error already so no
93 use checking further */
94 ;
95- else if(data->set.upload) {
96+ else if(data->state.upload) {
97 if((-1 != data->state.infilesize) &&
98 (data->state.infilesize != data->req.writebytecount) &&
99 !data->set.crlf &&
100@@ -3640,7 +3640,7 @@ static CURLcode ftp_do_more(struct Curl_easy *data, int *completep)
101 connected back to us */
102 }
103 }
104- else if(data->set.upload) {
105+ else if(data->state.upload) {
106 result = ftp_nb_type(data, conn, data->state.prefer_ascii,
107 FTP_STOR_TYPE);
108 if(result)
109@@ -4233,7 +4233,7 @@
110 ftpc->file = NULL; /* instead of point to a zero byte,
111 we make it a NULL pointer */
112
113- if(data->set.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
114+ if(data->state.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
115 /* We need a file name when uploading. Return error! */
116 failf(data, "Uploading to a URL without a file name!");
117 free(rawPath);
118diff --git a/lib/http.c b/lib/http.c
119index 80e43f6f361e8..bffdd3468536d 100644
120--- a/lib/http.c
121+++ b/lib/http.c
122@@ -2033,7 +2033,7 @@
123 Curl_HttpReq httpreq = data->state.httpreq;
124 const char *request;
125 if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
126- data->set.upload)
127+ data->state.upload)
128 httpreq = HTTPREQ_PUT;
129
130 /* Now set the 'request' pointer to the proper request string */
131@@ -2423,7 +2423,7 @@ CURLcode Curl_http_body(struct Curl_easy *data, struct connectdata *conn,
132 if((conn->handler->protocol & PROTO_FAMILY_HTTP) &&
133 (((httpreq == HTTPREQ_POST_MIME || httpreq == HTTPREQ_POST_FORM) &&
134 http->postsize < 0) ||
135- ((data->set.upload || httpreq == HTTPREQ_POST) &&
136+ ((data->state.upload || httpreq == HTTPREQ_POST) &&
137 data->state.infilesize == -1))) {
138 if(conn->bits.authneg)
139 /* don't enable chunked during auth neg */
140diff --git a/lib/imap.c b/lib/imap.c
141index c2f675d4b2618..1952e66a1efcd 100644
142--- a/lib/imap.c
143+++ b/lib/imap.c
144@@ -1511,11 +1511,11 @@ static CURLcode imap_done(struct Curl_easy *data, CURLcode status,
145 result = status; /* use the already set error code */
146 }
147 else if(!data->set.connect_only && !imap->custom &&
148- (imap->uid || imap->mindex || data->set.upload ||
149+ (imap->uid || imap->mindex || data->state.upload ||
150 data->set.mimepost.kind != MIMEKIND_NONE)) {
151 /* Handle responses after FETCH or APPEND transfer has finished */
152
153- if(!data->set.upload && data->set.mimepost.kind == MIMEKIND_NONE)
154+ if(!data->state.upload && data->set.mimepost.kind == MIMEKIND_NONE)
155 state(data, IMAP_FETCH_FINAL);
156 else {
157 /* End the APPEND command first by sending an empty line */
158@@ -1581,7 +1581,7 @@ static CURLcode imap_perform(struct Curl_easy *data, bool *connected,
159 selected = TRUE;
160
161 /* Start the first command in the DO phase */
162- if(data->set.upload || data->set.mimepost.kind != MIMEKIND_NONE)
163+ if(data->state.upload || data->set.mimepost.kind != MIMEKIND_NONE)
164 /* APPEND can be executed directly */
165 result = imap_perform_append(data);
166 else if(imap->custom && (selected || !imap->mailbox))
167diff --git a/lib/rtsp.c b/lib/rtsp.c
168index ea99d720ec4eb..ccd7264b00e74 100644
169--- a/lib/rtsp.c
170+++ b/lib/rtsp.c
171@@ -493,7 +493,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
172 rtspreq == RTSPREQ_SET_PARAMETER ||
173 rtspreq == RTSPREQ_GET_PARAMETER) {
174
175- if(data->set.upload) {
176+ if(data->state.upload) {
177 putsize = data->state.infilesize;
178 data->state.httpreq = HTTPREQ_PUT;
179
180@@ -512,7 +512,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
181 result =
182 Curl_dyn_addf(&req_buffer,
183 "Content-Length: %" CURL_FORMAT_CURL_OFF_T"\r\n",
184- (data->set.upload ? putsize : postsize));
185+ (data->state.upload ? putsize : postsize));
186 if(result)
187 return result;
188 }
189diff --git a/lib/setopt.c b/lib/setopt.c
190index 38f5711e44191..0c3b9634d1192 100644
191--- a/lib/setopt.c
192+++ b/lib/setopt.c
193@@ -333,8 +333,8 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
194 * We want to sent data to the remote host. If this is HTTP, that equals
195 * using the PUT request.
196 */
197- data->set.upload = (0 != va_arg(param, long)) ? TRUE : FALSE;
198- if(data->set.upload) {
199+ arg = va_arg(param, long);
200+ if(arg) {
201 /* If this is HTTP, PUT is what's needed to "upload" */
202 data->set.method = HTTPREQ_PUT;
203 data->set.opt_no_body = FALSE; /* this is implied */
204@@ -625,7 +625,6 @@
205 }
206 else
207 data->set.method = HTTPREQ_GET;
208- data->set.upload = FALSE;
209 break;
210
211 case CURLOPT_HTTPPOST:
212@@ -888,7 +887,6 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
213 */
214 if(va_arg(param, long)) {
215 data->set.method = HTTPREQ_GET;
216- data->set.upload = FALSE; /* switch off upload */
217 data->set.opt_no_body = FALSE; /* this is implied */
218 }
219 break;
220diff --git a/lib/smb.c b/lib/smb.c
221index a1e444ee6b97e..d6822213529bc 100644
222--- a/lib/smb.c
223+++ b/lib/smb.c
224@@ -530,7 +530,7 @@ static CURLcode smb_send_open(struct Curl_easy *data)
225 byte_count = strlen(req->path);
226 msg.name_length = smb_swap16((unsigned short)byte_count);
227 msg.share_access = smb_swap32(SMB_FILE_SHARE_ALL);
228- if(data->set.upload) {
229+ if(data->state.upload) {
230 msg.access = smb_swap32(SMB_GENERIC_READ | SMB_GENERIC_WRITE);
231 msg.create_disposition = smb_swap32(SMB_FILE_OVERWRITE_IF);
232 }
233@@ -762,7 +762,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
234 void *msg = NULL;
235 const struct smb_nt_create_response *smb_m;
236
237- if(data->set.upload && (data->state.infilesize < 0)) {
238+ if(data->state.upload && (data->state.infilesize < 0)) {
239 failf(data, "SMB upload needs to know the size up front");
240 return CURLE_SEND_ERROR;
241 }
242@@ -813,7 +813,7 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
243 smb_m = (const struct smb_nt_create_response*) msg;
244 req->fid = smb_swap16(smb_m->fid);
245 data->req.offset = 0;
246- if(data->set.upload) {
247+ if(data->state.upload) {
248 data->req.size = data->state.infilesize;
249 Curl_pgrsSetUploadSize(data, data->req.size);
250 next_state = SMB_UPLOAD;
251diff --git a/lib/smtp.c b/lib/smtp.c
252index 7a030308d4689..c182cace742d7 100644
253--- a/lib/smtp.c
254+++ b/lib/smtp.c
255@@ -1419,7 +1419,7 @@ static CURLcode smtp_done(struct Curl_easy *data, CURLcode status,
256 result = status; /* use the already set error code */
257 }
258 else if(!data->set.connect_only && data->set.mail_rcpt &&
259- (data->set.upload || data->set.mimepost.kind)) {
260+ (data->state.upload || data->set.mimepost.kind)) {
261 /* Calculate the EOB taking into account any terminating CRLF from the
262 previous line of the email or the CRLF of the DATA command when there
263 is "no mail data". RFC-5321, sect. 4.1.1.4.
264@@ -1511,7 +1511,7 @@ static CURLcode smtp_perform(struct Curl_easy *data, bool *connected,
265 smtp->eob = 2;
266
267 /* Start the first command in the DO phase */
268- if((data->set.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
269+ if((data->state.upload || data->set.mimepost.kind) && data->set.mail_rcpt)
270 /* MAIL transfer */
271 result = smtp_perform_mail(data);
272 else
273diff --git a/lib/tftp.c b/lib/tftp.c
274index 164d3c723c5b9..8ed1b887b4d21 100644
275--- a/lib/tftp.c
276+++ b/lib/tftp.c
277@@ -370,7 +370,7 @@ static CURLcode tftp_parse_option_ack(struct tftp_state_data *state,
278
279 /* tsize should be ignored on upload: Who cares about the size of the
280 remote file? */
281- if(!data->set.upload) {
282+ if(!data->state.upload) {
283 if(!tsize) {
284 failf(data, "invalid tsize -:%s:- value in OACK packet", value);
285 return CURLE_TFTP_ILLEGAL;
286@@ -451,7 +451,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
287 return result;
288 }
289
290- if(data->set.upload) {
291+ if(data->state.upload) {
292 /* If we are uploading, send an WRQ */
293 setpacketevent(&state->spacket, TFTP_EVENT_WRQ);
294 state->data->req.upload_fromhere =
295@@ -486,7 +486,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
296 if(!data->set.tftp_no_options) {
297 char buf[64];
298 /* add tsize option */
299- if(data->set.upload && (data->state.infilesize != -1))
300+ if(data->state.upload && (data->state.infilesize != -1))
301 msnprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
302 data->state.infilesize);
303 else
304@@ -540,7 +540,7 @@ static CURLcode tftp_send_first(struct tftp_state_data *state,
305 break;
306
307 case TFTP_EVENT_OACK:
308- if(data->set.upload) {
309+ if(data->state.upload) {
310 result = tftp_connect_for_tx(state, event);
311 }
312 else {
313diff --git a/lib/transfer.c b/lib/transfer.c
314index e9ab8fbf09510..cb69f3365855a 100644
315--- a/lib/transfer.c
316+++ b/lib/transfer.c
317@@ -1293,6 +1293,7 @@ void Curl_init_CONNECT(struct Curl_easy *data)
318 {
319 data->state.fread_func = data->set.fread_func_set;
320 data->state.in = data->set.in_set;
321+ data->state.upload = (data->state.httpreq == HTTPREQ_PUT);
322 }
323
324 /*
325@@ -1767,7 +1767,6 @@
326 data->state.httpreq != HTTPREQ_POST_MIME) ||
327 !(data->set.keep_post & CURL_REDIR_POST_303))) {
328 data->state.httpreq = HTTPREQ_GET;
329- data->set.upload = false;
330 infof(data, "Switch to %s",
331 data->set.opt_no_body?"HEAD":"GET");
332 }
333@@ -1770,7 +1770,7 @@ CURLcode Curl_retry_request(struct Curl_easy *data, char **url)
334
335 /* if we're talking upload, we can't do the checks below, unless the protocol
336 is HTTP as when uploading over HTTP we will still get a response */
337- if(data->set.upload &&
338+ if(data->state.upload &&
339 !(conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_RTSP)))
340 return CURLE_OK;
341
342diff --git a/lib/urldata.h b/lib/urldata.h
343index cca992a0295aa..a8580bdb66fe8 100644
344--- a/lib/urldata.h
345+++ b/lib/urldata.h
346@@ -1487,6 +1487,7 @@
347 BIT(url_alloc); /* URL string is malloc()'ed */
348 BIT(referer_alloc); /* referer string is malloc()ed */
349 BIT(wildcard_resolve); /* Set to true if any resolve change is a wildcard */
350+ BIT(upload); /* upload request */
351 };
352
353 /*
354@@ -1838,7 +1839,6 @@ struct UserDefined {
355 BIT(http_auto_referer); /* set "correct" referer when following
356 location: */
357 BIT(opt_no_body); /* as set with CURLOPT_NOBODY */
358- BIT(upload); /* upload request */
359 BIT(verbose); /* output verbosity */
360 BIT(krb); /* Kerberos connection requested */
361 BIT(reuse_forbid); /* forbidden to be reused, close after use */
362diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
363index b31f741ba9492..d60edaa303642 100644
364--- a/lib/vssh/libssh.c
365+++ b/lib/vssh/libssh.c
366@@ -1209,7 +1209,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
367 }
368
369 case SSH_SFTP_TRANS_INIT:
370- if(data->set.upload)
371+ if(data->state.upload)
372 state(data, SSH_SFTP_UPLOAD_INIT);
373 else {
374 if(protop->path[strlen(protop->path)-1] == '/')
375@@ -1802,7 +1802,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
376 /* Functions from the SCP subsystem cannot handle/return SSH_AGAIN */
377 ssh_set_blocking(sshc->ssh_session, 1);
378
379- if(data->set.upload) {
380+ if(data->state.upload) {
381 if(data->state.infilesize < 0) {
382 failf(data, "SCP requires a known file size for upload");
383 sshc->actualcode = CURLE_UPLOAD_FAILED;
384@@ -1907,7 +1907,7 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data, bool *block)
385 break;
386 }
387 case SSH_SCP_DONE:
388- if(data->set.upload)
389+ if(data->state.upload)
390 state(data, SSH_SCP_SEND_EOF);
391 else
392 state(data, SSH_SCP_CHANNEL_FREE);
393diff --git a/lib/vssh/libssh2.c b/lib/vssh/libssh2.c
394index f1154dc47a74e..f2e5352d1fd3a 100644
395--- a/lib/vssh/libssh2.c
396+++ b/lib/vssh/libssh2.c
397@@ -2019,7 +2019,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
398 }
399
400 case SSH_SFTP_TRANS_INIT:
401- if(data->set.upload)
402+ if(data->state.upload)
403 state(data, SSH_SFTP_UPLOAD_INIT);
404 else {
405 if(sshp->path[strlen(sshp->path)-1] == '/')
406@@ -2691,7 +2691,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
407 break;
408 }
409
410- if(data->set.upload) {
411+ if(data->state.upload) {
412 if(data->state.infilesize < 0) {
413 failf(data, "SCP requires a known file size for upload");
414 sshc->actualcode = CURLE_UPLOAD_FAILED;
415@@ -2831,7 +2831,7 @@ static CURLcode ssh_statemach_act(struct Curl_easy *data, bool *block)
416 break;
417
418 case SSH_SCP_DONE:
419- if(data->set.upload)
420+ if(data->state.upload)
421 state(data, SSH_SCP_SEND_EOF);
422 else
423 state(data, SSH_SCP_CHANNEL_FREE);
424diff --git a/lib/vssh/wolfssh.c b/lib/vssh/wolfssh.c
425index 17d59ecd23bc8..2ca91b7363b1d 100644
426--- a/lib/vssh/wolfssh.c
427+++ b/lib/vssh/wolfssh.c
428@@ -557,7 +557,7 @@ static CURLcode wssh_statemach_act(struct Curl_easy *data, bool *block)
429 }
430 break;
431 case SSH_SFTP_TRANS_INIT:
432- if(data->set.upload)
433+ if(data->state.upload)
434 state(data, SSH_SFTP_UPLOAD_INIT);
435 else {
436 if(sftp_scp->path[strlen(sftp_scp->path)-1] == '/')
diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb
index 3241867d7e..96280b31b2 100644
--- a/meta/recipes-support/curl/curl_7.82.0.bb
+++ b/meta/recipes-support/curl/curl_7.82.0.bb
@@ -48,6 +48,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
48 file://CVE-2023-28319.patch \ 48 file://CVE-2023-28319.patch \
49 file://CVE-2023-28320.patch \ 49 file://CVE-2023-28320.patch \
50 file://CVE-2023-28321.patch \ 50 file://CVE-2023-28321.patch \
51 file://CVE-2023-28322-1.patch \
52 file://CVE-2023-28322-2.patch \
51 " 53 "
52SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c" 54SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
53 55
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-17 14:05:58 +0000