* [Buildroot] [PATCH 0/2] Update libcurl to version 7.32.0
@ 2013-08-29 20:07 Ryan Barnett
2013-08-29 20:07 ` [Buildroot] [PATCH 1/2] libcurl: up revision to 7.32.0 Ryan Barnett
2013-08-29 20:07 ` [Buildroot] [PATCH 2/2] libcurl: remove man and static lib from target Ryan Barnett
0 siblings, 2 replies; 5+ messages in thread
From: Ryan Barnett @ 2013-08-29 20:07 UTC (permalink / raw)
To: buildroot
These patches update the version of libcurl to version 7.32.0 and remove
the static library and documentation from being installed on the target.
NOTE: these patches depend on my previously submitted patches for libssh2
Ryan Barnett (2):
libcurl: up revision to 7.32.0
libcurl: remove man and static lib from target
package/libcurl/libcurl-01-CVE-2013-0249.patch | 65 ------------------------
package/libcurl/libcurl-02-CVE-2013-1944.patch | 57 ---------------------
package/libcurl/libcurl-03-CVE-2013-2174.patch | 38 --------------
package/libcurl/libcurl.mk | 24 ++++++++-
4 files changed, 22 insertions(+), 162 deletions(-)
delete mode 100644 package/libcurl/libcurl-01-CVE-2013-0249.patch
delete mode 100644 package/libcurl/libcurl-02-CVE-2013-1944.patch
delete mode 100644 package/libcurl/libcurl-03-CVE-2013-2174.patch
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 1/2] libcurl: up revision to 7.32.0
2013-08-29 20:07 [Buildroot] [PATCH 0/2] Update libcurl to version 7.32.0 Ryan Barnett
@ 2013-08-29 20:07 ` Ryan Barnett
2013-08-29 20:07 ` [Buildroot] [PATCH 2/2] libcurl: remove man and static lib from target Ryan Barnett
1 sibling, 0 replies; 5+ messages in thread
From: Ryan Barnett @ 2013-08-29 20:07 UTC (permalink / raw)
To: buildroot
Updating revision of libcurl to version 7.32.0
Signed-off-by: Ryan Barnett <rjbarnet@rockwellcollins.com>
---
package/libcurl/libcurl-01-CVE-2013-0249.patch | 65 ------------------------
package/libcurl/libcurl-02-CVE-2013-1944.patch | 57 ---------------------
package/libcurl/libcurl-03-CVE-2013-2174.patch | 38 --------------
package/libcurl/libcurl.mk | 4 +-
4 files changed, 2 insertions(+), 162 deletions(-)
delete mode 100644 package/libcurl/libcurl-01-CVE-2013-0249.patch
delete mode 100644 package/libcurl/libcurl-02-CVE-2013-1944.patch
delete mode 100644 package/libcurl/libcurl-03-CVE-2013-2174.patch
diff --git a/package/libcurl/libcurl-01-CVE-2013-0249.patch b/package/libcurl/libcurl-01-CVE-2013-0249.patch
deleted file mode 100644
index 7d2af2a..0000000
--- a/package/libcurl/libcurl-01-CVE-2013-0249.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From ee45a34907ffeb5fd95b0513040d8491d565b663 Mon Sep 17 00:00:00 2001
-From: Eldar Zaitov <kyprizel@volema.com>
-Date: Wed, 30 Jan 2013 23:22:27 +0100
-Subject: [PATCH] Curl_sasl_create_digest_md5_message: fix buffer overflow
-
-When negotiating SASL DIGEST-MD5 authentication, the function
-Curl_sasl_create_digest_md5_message() uses the data provided from the
-server without doing the proper length checks and that data is then
-appended to a local fixed-size buffer on the stack.
-
-This vulnerability can be exploited by someone who is in control of a
-server that a libcurl based program is accessing with POP3, SMTP or
-IMAP. For applications that accept user provided URLs, it is also
-thinkable that a malicious user would feed an application with a URL to
-a server hosting code targetting this flaw.
-
-Bug: http://curl.haxx.se/docs/adv_20130206.html
----
- lib/curl_sasl.c | 23 ++++++-----------------
- 1 file changed, 6 insertions(+), 17 deletions(-)
-
-diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
-index 57116b6..d07387d 100644
---- a/lib/curl_sasl.c
-+++ b/lib/curl_sasl.c
-@@ -346,9 +346,7 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
- snprintf(&HA1_hex[2 * i], 3, "%02x", digest[i]);
-
- /* Prepare the URL string */
-- strcpy(uri, service);
-- strcat(uri, "/");
-- strcat(uri, realm);
-+ snprintf(uri, sizeof(uri), "%s/%s", service, realm);
-
- /* Calculate H(A2) */
- ctxt = Curl_MD5_init(Curl_DIGEST_MD5);
-@@ -392,20 +390,11 @@ CURLcode Curl_sasl_create_digest_md5_message(struct SessionHandle *data,
- for(i = 0; i < MD5_DIGEST_LEN; i++)
- snprintf(&resp_hash_hex[2 * i], 3, "%02x", digest[i]);
-
-- strcpy(response, "username=\"");
-- strcat(response, userp);
-- strcat(response, "\",realm=\"");
-- strcat(response, realm);
-- strcat(response, "\",nonce=\"");
-- strcat(response, nonce);
-- strcat(response, "\",cnonce=\"");
-- strcat(response, cnonce);
-- strcat(response, "\",nc=");
-- strcat(response, nonceCount);
-- strcat(response, ",digest-uri=\"");
-- strcat(response, uri);
-- strcat(response, "\",response=");
-- strcat(response, resp_hash_hex);
-+ snprintf(response, sizeof(response),
-+ "username=\"%s\",realm=\"%s\",nonce=\"%s\","
-+ "cnonce=\"%s\",nc=\"%s\",digest-uri=\"%s\",response=%s",
-+ userp, realm, nonce,
-+ cnonce, nonceCount, uri, resp_hash_hex);
-
- /* Base64 encode the reply */
- return Curl_base64_encode(data, response, 0, outptr, outlen);
---
-1.7.10.4
-
diff --git a/package/libcurl/libcurl-02-CVE-2013-1944.patch b/package/libcurl/libcurl-02-CVE-2013-1944.patch
deleted file mode 100644
index 18d9c2d..0000000
--- a/package/libcurl/libcurl-02-CVE-2013-1944.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 3604fde3d3c9b0d0e389e079aecf470d123ba180 Mon Sep 17 00:00:00 2001
-From: YAMADA Yasuharu <yasuharu.yamada@access-company.com>
-Date: Thu, 11 Apr 2013 00:17:15 +0200
-Subject: [PATCH] cookie: fix tailmatching to prevent cross-domain leakage
-
-Cookies set for 'example.com' could accidentaly also be sent by libcurl
-to the 'bexample.com' (ie with a prefix to the first domain name).
-
-This is a security vulnerabilty, CVE-2013-1944.
-
-Bug: http://curl.haxx.se/docs/adv_20130412.html
----
- lib/cookie.c | 24 +++++++++++++++++++-----
- 1 file changed, 19 insertions(+), 5 deletions(-)
-
-diff --git a/lib/cookie.c b/lib/cookie.c
-index 4b9ec0b..a67204e 100644
---- a/lib/cookie.c
-+++ b/lib/cookie.c
-@@ -118,15 +118,29 @@ static void freecookie(struct Cookie *co)
- free(co);
- }
-
--static bool tailmatch(const char *little, const char *bigone)
-+static bool tailmatch(const char *cooke_domain, const char *hostname)
- {
-- size_t littlelen = strlen(little);
-- size_t biglen = strlen(bigone);
-+ size_t cookie_domain_len = strlen(cooke_domain);
-+ size_t hostname_len = strlen(hostname);
-
-- if(littlelen > biglen)
-+ if(hostname_len < cookie_domain_len)
- return FALSE;
-
-- return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE;
-+ if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len))
-+ return FALSE;
-+
-+ /* A lead char of cookie_domain is not '.'.
-+ RFC6265 4.1.2.3. The Domain Attribute says:
-+ For example, if the value of the Domain attribute is
-+ "example.com", the user agent will include the cookie in the Cookie
-+ header when making HTTP requests to example.com, www.example.com, and
-+ www.corp.example.com.
-+ */
-+ if(hostname_len == cookie_domain_len)
-+ return TRUE;
-+ if('.' == *(hostname + hostname_len - cookie_domain_len - 1))
-+ return TRUE;
-+ return FALSE;
- }
-
- /*
---
-1.7.10.4
-
diff --git a/package/libcurl/libcurl-03-CVE-2013-2174.patch b/package/libcurl/libcurl-03-CVE-2013-2174.patch
deleted file mode 100644
index 673431f..0000000
--- a/package/libcurl/libcurl-03-CVE-2013-2174.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 6032f0ff672f09babf69d9d42bcde6eb9eeb5bea Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Sun, 19 May 2013 23:24:29 +0200
-Subject: [PATCH] Curl_urldecode: no peeking beyond end of input buffer
-
-Security problem: CVE-2013-2174
-
-If a program would give a string like "%" to curl_easy_unescape(), it
-would still consider the % as start of an encoded character. The
-function then not only read beyond the buffer but it would also deduct
-the *unsigned* counter variable for how many more bytes there's left to
-read in the buffer by two, making the counter wrap. Continuing this, the
-function would go on reading beyond the buffer and soon writing beyond
-the allocated target buffer...
-
-Bug: http://curl.haxx.se/docs/adv_20130622.html
-Reported-by: Timo Sirainen
----
- lib/escape.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/lib/escape.c b/lib/escape.c
-index 6a26cf8..aa7db2c 100644
---- a/lib/escape.c
-+++ b/lib/escape.c
-@@ -159,7 +159,8 @@ CURLcode Curl_urldecode(struct SessionHandle *data,
-
- while(--alloc > 0) {
- in = *string;
-- if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
-+ if(('%' == in) && (alloc > 2) &&
-+ ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
- /* this is two hexadecimal digits following a '%' */
- char hexstr[3];
- char *ptr;
---
-1.7.10.4
-
diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk
index fd15478..79c16eb 100644
--- a/package/libcurl/libcurl.mk
+++ b/package/libcurl/libcurl.mk
@@ -4,7 +4,7 @@
#
################################################################################
-LIBCURL_VERSION = 7.28.1
+LIBCURL_VERSION = 7.32.0
LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.bz2
LIBCURL_SITE = http://curl.haxx.se/download
LIBCURL_LICENSE = ICS
@@ -27,7 +27,7 @@ LIBCURL_CONF_ENV += ac_cv_lib_crypto_CRYPTO_lock=yes
# Fix it by setting LD_LIBRARY_PATH to something sensible so those libs
# are found first.
LIBCURL_CONF_ENV += LD_LIBRARY_PATH=$$LD_LIBRARY_PATH:/lib:/usr/lib
-LIBCURL_CONF_OPT += --with-ssl=$(STAGING_DIR)/usr \
+LIBCURL_CONF_OPT += --with-ssl \
--with-random=/dev/urandom \
--with-ca-path=/etc/ssl/certs
else
--
1.7.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 2/2] libcurl: remove man and static lib from target
2013-08-29 20:07 [Buildroot] [PATCH 0/2] Update libcurl to version 7.32.0 Ryan Barnett
2013-08-29 20:07 ` [Buildroot] [PATCH 1/2] libcurl: up revision to 7.32.0 Ryan Barnett
@ 2013-08-29 20:07 ` Ryan Barnett
2013-08-29 21:37 ` Arnout Vandecappelle
1 sibling, 1 reply; 5+ messages in thread
From: Ryan Barnett @ 2013-08-29 20:07 UTC (permalink / raw)
To: buildroot
Remove the documentation that libcurl installs on the target along
with removing the static libraries on the target. The documentation
and static library will only exist in the sysroot.
Signed-off-by: Ryan Barnett <rjbarnet@rockwellcollins.com>
---
package/libcurl/libcurl.mk | 20 ++++++++++++++++++++
1 files changed, 20 insertions(+), 0 deletions(-)
diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk
index 79c16eb..caf355d 100644
--- a/package/libcurl/libcurl.mk
+++ b/package/libcurl/libcurl.mk
@@ -54,6 +54,26 @@ endef
LIBCURL_POST_INSTALL_TARGET_HOOKS += LIBCURL_TARGET_CLEANUP
endif
+# Remove unneeded files/directories from target
+LIBCURL_UNNEEDED_FILES = \
+ usr/lib/libcurl.a \
+ usr/lib/libcurl.la \
+ usr/include/curl \
+ usr/lib/pkgconfig/libcurl.pc
+define LIBCURL_REMOVE_UNNEEDED_FILES
+ rm -rf $(addprefix $(TARGET_DIR)/, $(LIBCURL_UNNEEDED_FILES))
+endef
+LIBCURL_POST_INSTALL_TARGET_HOOKS += LIBCURL_REMOVE_UNNEEDED_FILES
+
+# Remove Documentation
+ifneq ($(BR2_HAVE_DOCUMENTATION),y)
+define LIBCURL_TARGET_REMOVE_DOCUMENTATION
+ rm -f $(TARGET_DIR)/usr/share/man/man3/*curl*
+ rm -f $(TARGET_DIR)/usr/share/man/man1/*curl*
+endef
+LIBCURL_POST_INSTALL_TARGET_HOOKS += LIBCURL_TARGET_REMOVE_DOCUMENTATION
+endif
+
$(eval $(autotools-package))
curl: libcurl
--
1.7.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 2/2] libcurl: remove man and static lib from target
2013-08-29 20:07 ` [Buildroot] [PATCH 2/2] libcurl: remove man and static lib from target Ryan Barnett
@ 2013-08-29 21:37 ` Arnout Vandecappelle
2013-08-29 21:39 ` rjbarnet at rockwellcollins.com
0 siblings, 1 reply; 5+ messages in thread
From: Arnout Vandecappelle @ 2013-08-29 21:37 UTC (permalink / raw)
To: buildroot
On 08/29/13 22:07, Ryan Barnett wrote:
> Remove the documentation that libcurl installs on the target along
> with removing the static libraries on the target. The documentation
> and static library will only exist in the sysroot.
This shouldn't be needed as it is done by target-finalize. Or doesn't
that work for you?
Regards,
Arnout
>
> Signed-off-by: Ryan Barnett <rjbarnet@rockwellcollins.com>
> ---
> package/libcurl/libcurl.mk | 20 ++++++++++++++++++++
> 1 files changed, 20 insertions(+), 0 deletions(-)
>
> diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk
> index 79c16eb..caf355d 100644
> --- a/package/libcurl/libcurl.mk
> +++ b/package/libcurl/libcurl.mk
> @@ -54,6 +54,26 @@ endef
> LIBCURL_POST_INSTALL_TARGET_HOOKS += LIBCURL_TARGET_CLEANUP
> endif
>
> +# Remove unneeded files/directories from target
> +LIBCURL_UNNEEDED_FILES = \
> + usr/lib/libcurl.a \
> + usr/lib/libcurl.la \
> + usr/include/curl \
> + usr/lib/pkgconfig/libcurl.pc
> +define LIBCURL_REMOVE_UNNEEDED_FILES
> + rm -rf $(addprefix $(TARGET_DIR)/, $(LIBCURL_UNNEEDED_FILES))
> +endef
> +LIBCURL_POST_INSTALL_TARGET_HOOKS += LIBCURL_REMOVE_UNNEEDED_FILES
> +
> +# Remove Documentation
> +ifneq ($(BR2_HAVE_DOCUMENTATION),y)
> +define LIBCURL_TARGET_REMOVE_DOCUMENTATION
> + rm -f $(TARGET_DIR)/usr/share/man/man3/*curl*
> + rm -f $(TARGET_DIR)/usr/share/man/man1/*curl*
> +endef
> +LIBCURL_POST_INSTALL_TARGET_HOOKS += LIBCURL_TARGET_REMOVE_DOCUMENTATION
> +endif
> +
> $(eval $(autotools-package))
>
> curl: libcurl
>
--
Arnout Vandecappelle arnout at mind be
Senior Embedded Software Architect +32-16-286500
Essensium/Mind http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint: 7CB5 E4CC 6C2E EFD4 6E3D A754 F963 ECAB 2450 2F1F
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 2/2] libcurl: remove man and static lib from target
2013-08-29 21:37 ` Arnout Vandecappelle
@ 2013-08-29 21:39 ` rjbarnet at rockwellcollins.com
0 siblings, 0 replies; 5+ messages in thread
From: rjbarnet at rockwellcollins.com @ 2013-08-29 21:39 UTC (permalink / raw)
To: buildroot
Arnout -
As stated in my previous email - I didn't realize target finalize takes
care of this. I will resubmit with just upgrading the libcurl version.
Thanks,
-Ryan
Ryan J Barnett / Software Engineer / Platform SW
MS 137-157, 855 35th St NE, Cedar Rapids, IA, 52498-3161, US
Phone: 319-263-3880 / VPN: 263-3880
rjbarnet at rockwellcollins.com
www.rockwellcollins.com
From: Arnout Vandecappelle <arnout@mind.be>
To: Ryan Barnett <rjbarnet@rockwellcollins.com>
Cc: buildroot at busybox.net
Date: 08/29/2013 04:37 PM
Subject: Re: [Buildroot] [PATCH 2/2] libcurl: remove man and static
lib from target
On 08/29/13 22:07, Ryan Barnett wrote:
> Remove the documentation that libcurl installs on the target along
> with removing the static libraries on the target. The documentation
> and static library will only exist in the sysroot.
This shouldn't be needed as it is done by target-finalize. Or doesn't
that work for you?
Regards,
Arnout
>
> Signed-off-by: Ryan Barnett <rjbarnet@rockwellcollins.com>
> ---
> package/libcurl/libcurl.mk | 20 ++++++++++++++++++++
> 1 files changed, 20 insertions(+), 0 deletions(-)
>
> diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk
> index 79c16eb..caf355d 100644
> --- a/package/libcurl/libcurl.mk
> +++ b/package/libcurl/libcurl.mk
> @@ -54,6 +54,26 @@ endef
> LIBCURL_POST_INSTALL_TARGET_HOOKS += LIBCURL_TARGET_CLEANUP
> endif
>
> +# Remove unneeded files/directories from target
> +LIBCURL_UNNEEDED_FILES = \
> + usr/lib/libcurl.a \
> + usr/lib/libcurl.la \
> + usr/include/curl \
> + usr/lib/pkgconfig/libcurl.pc
> +define LIBCURL_REMOVE_UNNEEDED_FILES
> + rm -rf $(addprefix $(TARGET_DIR)/,
$(LIBCURL_UNNEEDED_FILES))
> +endef
> +LIBCURL_POST_INSTALL_TARGET_HOOKS += LIBCURL_REMOVE_UNNEEDED_FILES
> +
> +# Remove Documentation
> +ifneq ($(BR2_HAVE_DOCUMENTATION),y)
> +define LIBCURL_TARGET_REMOVE_DOCUMENTATION
> + rm -f $(TARGET_DIR)/usr/share/man/man3/*curl*
> + rm -f $(TARGET_DIR)/usr/share/man/man1/*curl*
> +endef
> +LIBCURL_POST_INSTALL_TARGET_HOOKS +=
LIBCURL_TARGET_REMOVE_DOCUMENTATION
> +endif
> +
> $(eval $(autotools-package))
>
> curl: libcurl
>
--
Arnout Vandecappelle arnout at mind be
Senior Embedded Software Architect +32-16-286500
Essensium/Mind http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint: 7CB5 E4CC 6C2E EFD4 6E3D A754 F963 ECAB 2450 2F1F
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20130829/0233203c/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 2004 bytes
Desc: not available
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20130829/0233203c/attachment.gif>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-08-29 21:39 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-08-29 20:07 [Buildroot] [PATCH 0/2] Update libcurl to version 7.32.0 Ryan Barnett
2013-08-29 20:07 ` [Buildroot] [PATCH 1/2] libcurl: up revision to 7.32.0 Ryan Barnett
2013-08-29 20:07 ` [Buildroot] [PATCH 2/2] libcurl: remove man and static lib from target Ryan Barnett
2013-08-29 21:37 ` Arnout Vandecappelle
2013-08-29 21:39 ` rjbarnet at rockwellcollins.com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox