mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-28 01:28:59 +00:00
7ab8bf126e
This fixes the following security problems: * CVE-2017-7407: https://curl.haxx.se/docs/adv_20170403.html * CVE-2017-7468: https://curl.haxx.se/docs/adv_20170419.html Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
166 lines
3.5 KiB
Diff
166 lines
3.5 KiB
Diff
From 6019f1795b4e3b72507b84b0e02dc8c32024f562 Mon Sep 17 00:00:00 2001
|
|
From: Dan Fandrich <dan@coneharvesters.com>
|
|
Date: Sat, 11 Mar 2017 10:59:34 +0100
|
|
Subject: [PATCH] CVE-2017-7407: fixed
|
|
|
|
Bug: https://curl.haxx.se/docs/adv_20170403.html
|
|
|
|
Reported-by: Brian Carpenter
|
|
---
|
|
src/tool_writeout.c | 6 +++---
|
|
tests/data/Makefile.inc | 2 +-
|
|
tests/data/test1440 | 31 +++++++++++++++++++++++++++++++
|
|
tests/data/test1441 | 31 +++++++++++++++++++++++++++++++
|
|
tests/data/test1442 | 35 +++++++++++++++++++++++++++++++++++
|
|
5 files changed, 101 insertions(+), 4 deletions(-)
|
|
create mode 100644 tests/data/test1440
|
|
create mode 100644 tests/data/test1441
|
|
create mode 100644 tests/data/test1442
|
|
|
|
--- a/src/tool_writeout.c
|
|
+++ b/src/tool_writeout.c
|
|
@@ -5,7 +5,7 @@
|
|
* | (__| |_| | _ <| |___
|
|
* \___|\___/|_| \_\_____|
|
|
*
|
|
- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
+ * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
*
|
|
* This software is licensed as described in the file COPYING, which
|
|
* you should have received as part of this distribution. The terms
|
|
@@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutS
|
|
double doubleinfo;
|
|
|
|
while(ptr && *ptr) {
|
|
- if('%' == *ptr) {
|
|
+ if('%' == *ptr && ptr[1]) {
|
|
if('%' == ptr[1]) {
|
|
/* an escaped %-letter */
|
|
fputc('%', stream);
|
|
@@ -341,7 +341,7 @@ void ourWriteOut(CURL *curl, struct OutS
|
|
}
|
|
}
|
|
}
|
|
- else if('\\' == *ptr) {
|
|
+ else if('\\' == *ptr && ptr[1]) {
|
|
switch(ptr[1]) {
|
|
case 'r':
|
|
fputc('\r', stream);
|
|
--- a/tests/data/Makefile.inc
|
|
+++ b/tests/data/Makefile.inc
|
|
@@ -150,7 +150,7 @@ test1408 test1409 test1410 test1411 test
|
|
test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \
|
|
test1424 \
|
|
test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \
|
|
-test1436 test1437 test1438 test1439 \
|
|
+test1436 test1437 test1438 test1439 test1440 test1441 test1442 \
|
|
\
|
|
test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
|
|
test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
|
|
--- /dev/null
|
|
+++ b/tests/data/test1440
|
|
@@ -0,0 +1,31 @@
|
|
+<testcase>
|
|
+<info>
|
|
+<keywords>
|
|
+--write-out
|
|
+</keywords>
|
|
+</info>
|
|
+# Server-side
|
|
+<reply>
|
|
+</reply>
|
|
+
|
|
+# Client-side
|
|
+<client>
|
|
+<server>
|
|
+file
|
|
+</server>
|
|
+
|
|
+<name>
|
|
+Check --write-out with trailing %{
|
|
+</name>
|
|
+<command>
|
|
+file://localhost/%PWD/log/ --write-out '%{'
|
|
+</command>
|
|
+</client>
|
|
+
|
|
+# Verify data
|
|
+<verify>
|
|
+<stdout nonewline="yes">
|
|
+%{
|
|
+</stdout>
|
|
+</verify>
|
|
+</testcase>
|
|
--- /dev/null
|
|
+++ b/tests/data/test1441
|
|
@@ -0,0 +1,31 @@
|
|
+<testcase>
|
|
+<info>
|
|
+<keywords>
|
|
+--write-out
|
|
+</keywords>
|
|
+</info>
|
|
+# Server-side
|
|
+<reply>
|
|
+</reply>
|
|
+
|
|
+# Client-side
|
|
+<client>
|
|
+<server>
|
|
+file
|
|
+</server>
|
|
+
|
|
+<name>
|
|
+Check --write-out with trailing %
|
|
+</name>
|
|
+<command>
|
|
+file://localhost/%PWD/log/ --write-out '%'
|
|
+</command>
|
|
+</client>
|
|
+
|
|
+# Verify data
|
|
+<verify>
|
|
+<stdout nonewline="yes">
|
|
+%
|
|
+</stdout>
|
|
+</verify>
|
|
+</testcase>
|
|
--- /dev/null
|
|
+++ b/tests/data/test1442
|
|
@@ -0,0 +1,35 @@
|
|
+<testcase>
|
|
+<info>
|
|
+<keywords>
|
|
+--write-out
|
|
+FILE
|
|
+</keywords>
|
|
+</info>
|
|
+# Server-side
|
|
+<reply>
|
|
+</reply>
|
|
+
|
|
+# Client-side
|
|
+<client>
|
|
+<server>
|
|
+file
|
|
+</server>
|
|
+
|
|
+<name>
|
|
+Check --write-out with trailing \
|
|
+</name>
|
|
+<command>
|
|
+file://localhost/%PWD/log/non-existent-file.txt --write-out '\'
|
|
+</command>
|
|
+</client>
|
|
+
|
|
+# Verify data
|
|
+<verify>
|
|
+<errorcode>
|
|
+37
|
|
+</errorcode>
|
|
+<stdout nonewline="yes">
|
|
+\
|
|
+</stdout>
|
|
+</verify>
|
|
+</testcase>
|