mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-23 07:22:33 +00:00
dc1b578a4c
This fixes the following security problems: * CVE-2018-14618: NTLM password overflow via integer overflow * CVE-2018-16839: SASL password overflow via integer overflow * CVE-2018-16840: use-after-free in handle close * CVE-2018-16842: warning message out-of-buffer read * CVE-2019-3823: SMTP end-of-response out-of-bounds read * CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow * CVE-2018-16890: NTLM type-2 out-of-bounds buffer read Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
32 lines
1.0 KiB
Diff
32 lines
1.0 KiB
Diff
From 81d135d67155c5295b1033679c606165d4e28f3f Mon Sep 17 00:00:00 2001
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Thu, 18 Oct 2018 15:07:15 +0200
|
|
Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
|
|
use-after-free
|
|
|
|
Regression from b46cfbc068 (7.59.0)
|
|
CVE-2018-16840
|
|
Reported-by: Brian Carpenter (Geeknik Labs)
|
|
|
|
Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
|
|
---
|
|
lib/url.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
--- a/lib/url.c
|
|
+++ b/lib/url.c
|
|
@@ -320,10 +320,12 @@ CURLcode Curl_close(struct Curl_easy *da
|
|
and detach this handle from there. */
|
|
curl_multi_remove_handle(data->multi, data);
|
|
|
|
- if(data->multi_easy)
|
|
+ if(data->multi_easy) {
|
|
/* when curl_easy_perform() is used, it creates its own multi handle to
|
|
use and this is the one */
|
|
curl_multi_cleanup(data->multi_easy);
|
|
+ data->multi_easy = NULL;
|
|
+ }
|
|
|
|
/* Destroy the timeout list that is held in the easy handle. It is
|
|
/normally/ done by curl_multi_remove_handle() but this is "just in
|