public inbox for openembedded-core@lists.openembedded.org
 help / color / mirror / Atom feed
* [PATCH][krogoth 01/12] curl: CVE-2016-8615
@ 2016-11-11  9:49 Sona Sarmadi
  2016-11-11  9:49 ` [PATCH][krogoth 02/12] curl: CVE-2016-8616 Sona Sarmadi
                   ` (10 more replies)
  0 siblings, 11 replies; 14+ messages in thread
From: Sona Sarmadi @ 2016-11-11  9:49 UTC (permalink / raw)
  To: openembedded-core; +Cc: sona

cookie injection for other servers

Affected versions: curl 7.1 to and including 7.50.3

Reference:
https://curl.haxx.se/docs/adv_20161102A.html

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
---
 meta/recipes-support/curl/curl/CVE-2016-8615.patch | 77 ++++++++++++++++++++++
 meta/recipes-support/curl/curl_7.47.1.bb           |  1 +
 2 files changed, 78 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2016-8615.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2016-8615.patch b/meta/recipes-support/curl/curl/CVE-2016-8615.patch
new file mode 100644
index 0000000..5faa423
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2016-8615.patch
@@ -0,0 +1,77 @@
+From 1620f552a277ed5b23a48b9c27dbf07663cac068 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 27 Sep 2016 17:36:19 +0200
+Subject: [PATCH] cookie: replace use of fgets() with custom version
+
+... that will ignore lines that are too long to fit in the buffer.
+
+CVE: CVE-2016-8615
+Upstream-Status: Backport
+
+Bug: https://curl.haxx.se/docs/adv_20161102A.html
+Reported-by: Cure53
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ lib/cookie.c | 31 ++++++++++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 0f05da2..e5097d3 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -901,10 +901,39 @@ Curl_cookie_add(struct Curl_easy *data,
+   }
+ 
+   return co;
+ }
+ 
++/*
++ * get_line() makes sure to only return complete whole lines that fit in 'len'
++ * bytes and end with a newline.
++ */
++static char *get_line(char *buf, int len, FILE *input)
++{
++  bool partial = FALSE;
++  while(1) {
++    char *b = fgets(buf, len, input);
++    if(b) {
++      size_t rlen = strlen(b);
++      if(rlen && (b[rlen-1] == '\n')) {
++        if(partial) {
++          partial = FALSE;
++          continue;
++        }
++        return b;
++      }
++      else
++        /* read a partial, discard the next piece that ends with newline */
++        partial = TRUE;
++    }
++    else
++      break;
++  }
++  return NULL;
++}
++
++
+ /*****************************************************************************
+  *
+  * Curl_cookie_init()
+  *
+  * Inits a cookie struct to read data from a local file. This is always
+@@ -957,11 +986,11 @@ struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
+     bool headerline;
+ 
+     line = malloc(MAX_COOKIE_LINE);
+     if(!line)
+       goto fail;
+-    while(fgets(line, MAX_COOKIE_LINE, fp)) {
++    while(get_line(line, MAX_COOKIE_LINE, fp)) {
+       if(checkprefix("Set-Cookie:", line)) {
+         /* This is a cookie line, get it! */
+         lineptr=&line[11];
+         headerline=TRUE;
+       }
+-- 
+2.9.3
+
diff --git a/meta/recipes-support/curl/curl_7.47.1.bb b/meta/recipes-support/curl/curl_7.47.1.bb
index 3670a11..1f2758c 100644
--- a/meta/recipes-support/curl/curl_7.47.1.bb
+++ b/meta/recipes-support/curl/curl_7.47.1.bb
@@ -15,6 +15,7 @@ SRC_URI += " file://configure_ac.patch \
              file://CVE-2016-5420.patch \
              file://CVE-2016-5421.patch \
              file://CVE-2016-7141.patch \
+             file://CVE-2016-8615.patch \
            "
 
 SRC_URI[md5sum] = "9ea3123449439bbd960cd25cf98796fb"
-- 
1.9.1



^ permalink raw reply related	[flat|nested] 14+ messages in thread
end of thread, other threads:[~2016-11-11 11:08 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-11-11  9:49 [PATCH][krogoth 01/12] curl: CVE-2016-8615 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 02/12] curl: CVE-2016-8616 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 03/12] curl: CVE-2016-8617 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 04/12] curl: CVE-2016-8618 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 05/12] curl: CVE-2016-8619 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 06/12] curl: CVE-2016-8620 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 07/12] curl: CVE-2016-8621 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 08/12] curl: CVE-2016-8622 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 09/12] curl: CVE-2016-8623 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 10/12] curl: CVE-2016-8624 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 11/12] curl: CVE-2016-8625 Sona Sarmadi
2016-11-11  9:49 ` [PATCH][krogoth 12/12] curl/url: remove unconditional idn2.h include Sona Sarmadi
2016-11-11 10:53   ` Anders Darander
2016-11-11 11:07   ` Burton, Ross

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox