diff options
| author |   Armin Kuster <akuster@mvista.com> | 2017-11-04 09:09:26 -0700 |
|---|---|---|
| committer |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-11-05 22:39:27 +0000 |
| commit | eafbe104727d79643c1738360789ae455fff116c (patch) | |
| tree | 1a6646885c36620603eb5aef1ed73294a5546c7e | |
| parent | b6ec8ab42befaa07c859a5c5cc14611b821a1304 (diff) | |
| download | openembedded-core-eafbe104727d79643c1738360789ae455fff116c.tar.gz | |
curl: Security fix for CVE-2017-1000100
Affected versions: libcurl 7.15.0 to and including 7.54.1
Not affected versions: libcurl < 7.15.0 and >= 7.55.0
Signed-off-by: Armin Kuster <akuster@mvista.com>
| -rw-r--r-- | meta/recipes-support/curl/curl/CVE-2017-1000100.patch | 50 | ||||
| -rw-r--r-- | meta/recipes-support/curl/curl_7.53.1.bb | 4 |
2 files changed, 53 insertions, 1 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2017-1000100.patch b/meta/recipes-support/curl/curl/CVE-2017-1000100.patch new file mode 100644 index 0000000000..508df8c7db --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2017-1000100.patch @@ -0,0 +1,50 @@ +From 358b2b131ad6c095696f20dcfa62b8305263f898 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <daniel@haxx.se> +Date: Tue, 1 Aug 2017 17:16:46 +0200 +Subject: [PATCH] tftp: reject file name lengths that don't fit + +... and thereby avoid telling send() to send off more bytes than the +size of the buffer! + +CVE-2017-1000100 + +Bug: https://curl.haxx.se/docs/adv_20170809B.html +Reported-by: Even Rouault + +Credit to OSS-Fuzz for the discovery + +Upstream-Status: Backport +https://github.com/curl/curl/commit/358b2b131ad6c095696f20dcfa62b8305263f898 + +CVE: CVE-2017-1000100 +Signed-off-by: Armin Kuster <akuster@mvista.com> + +--- + lib/tftp.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +Index: curl-7.53.1/lib/tftp.c +=================================================================== +--- curl-7.53.1.orig/lib/tftp.c ++++ curl-7.53.1/lib/tftp.c +@@ -5,7 +5,7 @@ + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * +- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al. ++ * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms +@@ -490,6 +490,11 @@ static CURLcode tftp_send_first(tftp_sta + if(result) + return result; + ++ if(strlen(filename) > (state->blksize - strlen(mode) - 4)) { ++ failf(data, "TFTP file name too long\n"); ++ return CURLE_TFTP_ILLEGAL; /* too long file name field */ ++ } ++ + snprintf((char *)state->spacket.data+2, + state->blksize, + "%s%c%s%c", filename, '\0', mode, '\0'); diff --git a/meta/recipes-support/curl/curl_7.53.1.bb b/meta/recipes-support/curl/curl_7.53.1.bb index a3d7cb949d..72828fe814 100644 --- a/meta/recipes-support/curl/curl_7.53.1.bb +++ b/meta/recipes-support/curl/curl_7.53.1.bb @@ -12,7 +12,9 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \ # curl likes to set -g0 in CFLAGS, so we stop it # from mucking around with debug options # -SRC_URI += " file://configure_ac.patch" +SRC_URI += " file://configure_ac.patch \ + file://CVE-2017-1000100.patch \ + " SRC_URI[md5sum] = "fb1f03a142236840c1a77c035fa4c542" SRC_URI[sha256sum] = "1c7207c06d75e9136a944a2e0528337ce76f15b9ec9ae4bb30d703b59bf530e8" |