mirror of
https://github.com/openwrt/openwrt.git
synced 2025-01-02 12:06:50 +00:00
55591e63bc
On Windows, refuse paths that start with \\ ... as that might cause an unexpected SMB connection to a given host name. Ref: PR#2730 Ref: https://curl.haxx.se/docs/CVE-2019-15601.html Suggested-by: Jerome Benoit <jerome.benoit@sap.com> Signed-off-by: Petr Štetiar <ynezz@true.cz>
45 lines
1.4 KiB
Diff
45 lines
1.4 KiB
Diff
From 1b71bc532bde8621fd3260843f8197182a467ff2 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Thu, 7 Nov 2019 10:13:01 +0100
|
|
Subject: [PATCH] file: on Windows, refuse paths that start with \\
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
... as that might cause an unexpected SMB connection to a given host
|
|
name.
|
|
|
|
Reported-by: Fernando Muñoz
|
|
CVE-2019-15601
|
|
Bug: https://curl.haxx.se/docs/CVE-2019-15601.html
|
|
|
|
Signed-off-by: Petr Štetiar <ynezz@true.cz>
|
|
---
|
|
lib/file.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/lib/file.c b/lib/file.c
|
|
index d349cd9241cd..166931d7f1ba 100644
|
|
--- a/lib/file.c
|
|
+++ b/lib/file.c
|
|
@@ -136,7 +136,7 @@ static CURLcode file_connect(struct connectdata *conn, bool *done)
|
|
struct Curl_easy *data = conn->data;
|
|
char *real_path;
|
|
struct FILEPROTO *file = data->req.protop;
|
|
- int fd;
|
|
+ int fd = -1;
|
|
#ifdef DOS_FILESYSTEM
|
|
size_t i;
|
|
char *actual_path;
|
|
@@ -181,7 +181,9 @@ static CURLcode file_connect(struct connectdata *conn, bool *done)
|
|
return CURLE_URL_MALFORMAT;
|
|
}
|
|
|
|
- fd = open_readonly(actual_path, O_RDONLY|O_BINARY);
|
|
+ if(strncmp("\\\\", actual_path, 2))
|
|
+ /* refuse to open path that starts with two backslashes */
|
|
+ fd = open_readonly(actual_path, O_RDONLY|O_BINARY);
|
|
file->path = actual_path;
|
|
#else
|
|
if(memchr(real_path, 0, real_path_len)) {
|