aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-support/curl/curl/CVE-2016-8624.patch68
-rw-r--r--meta/recipes-support/curl/curl_7.50.1.bb1
2 files changed, 69 insertions, 0 deletions
diff --git a/meta/recipes-support/curl/curl/CVE-2016-8624.patch b/meta/recipes-support/curl/curl/CVE-2016-8624.patch
new file mode 100644
index 0000000000..b9e000ecb5
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2016-8624.patch
@@ -0,0 +1,68 @@
+From 44ab42e55bbe329777ee05d50aea1ee059221652 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 11 Oct 2016 00:48:35 +0200
+Subject: [PATCH] urlparse: accept '#' as end of host name
+
+'http://example.com#@127.0.0.1/x.txt' equals a request to example.com
+for the '/' document with the rest of the URL being a fragment.
+
+Upstream-Status: Backport
+
+CVE: CVE-2016-8624
+Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
+
+---
+ lib/url.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 74e9bf5..ce94281 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -4159,11 +4159,11 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
+ /* clear path */
+ char slashbuf[4];
+ path[0]=0;
+
+ rc = sscanf(data->change.url,
+- "%15[^\n:]:%3[/]%[^\n/?]%[^\n]",
++ "%15[^\n:]:%3[/]%[^\n/?#]%[^\n]",
+ protobuf, slashbuf, conn->host.name, path);
+ if(2 == rc) {
+ failf(data, "Bad URL");
+ return CURLE_URL_MALFORMAT;
+ }
+@@ -4171,11 +4171,11 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
+
+ /*
+ * The URL was badly formatted, let's try the browser-style _without_
+ * protocol specified like 'http://'.
+ */
+- rc = sscanf(data->change.url, "%[^\n/?]%[^\n]", conn->host.name, path);
++ rc = sscanf(data->change.url, "%[^\n/?#]%[^\n]", conn->host.name, path);
+ if(1 > rc) {
+ /*
+ * We couldn't even get this format.
+ * djgpp 2.04 has a sscanf() bug where 'conn->host.name' is
+ * assigned, but the return value is EOF!
+@@ -4276,14 +4276,14 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
+ strcpy(path, "/");
+ rebuild_url = TRUE;
+ }
+
+ /* If the URL is malformatted (missing a '/' after hostname before path) we
+- * insert a slash here. The only letter except '/' we accept to start a path
+- * is '?'.
++ * insert a slash here. The only letters except '/' that can start a path is
++ * '?' and '#' - as controlled by the two sscanf() patterns above.
+ */
+- if(path[0] == '?') {
++ if(path[0] != '/') {
+ /* We need this function to deal with overlapping memory areas. We know
+ that the memory area 'path' points to is 'urllen' bytes big and that
+ is bigger than the path. Use +1 to move the zero byte too. */
+ memmove(&path[1], path, strlen(path)+1);
+ path[0] = '/';
+--
+2.9.3
+
diff --git a/meta/recipes-support/curl/curl_7.50.1.bb b/meta/recipes-support/curl/curl_7.50.1.bb
index ad7d83dac7..bdf5d73b31 100644
--- a/meta/recipes-support/curl/curl_7.50.1.bb
+++ b/meta/recipes-support/curl/curl_7.50.1.bb
@@ -20,6 +20,7 @@ SRC_URI += " file://configure_ac.patch \
file://CVE-2016-8621.patch \
file://CVE-2016-8623.patch \
file://CVE-2016-8617.patch \
+ file://CVE-2016-8624.patch \
"
SRC_URI[md5sum] = "015f6a0217ca6f2c5442ca406476920b"