mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-31 12:49:46 +00:00
Code Issues Projects Releases Wiki Activity

curl: Security fix for CVE-2016-8618

Browse Source 
Affected versions: curl 7.1 to and including 7.50.3
Not affected versions: curl >= 7.51.0

(From OE-Core rev: 1fc1c9a11eee2f5ba727b18300a92949b166b035)

Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Thiruvadi Rajaraman
2017-11-04 07:44:32 -07:00
committed by Richard Purdie
parent c8ebaaaf8d
commit b29b1bc1d7
2 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-support/curl/curl/CVE-2016-8618.patch
+49
View File
@@ -0,0 +1,49 @@
From 31106a073882656a2a5ab56c4ce2847e9a334c3c Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 28 Sep 2016 10:15:34 +0200
Subject: [PATCH] aprintf: detect wrap-around when growing allocation
On 32bit systems we could otherwise wrap around after 2GB and allocate 0
bytes and crash.
CVE-2016-8618
Bug: https://curl.haxx.se/docs/adv_20161102D.html
Reported-by: Cure53
Upstream-Status: Backport
https://curl.haxx.se/CVE-2016-8618.patch
CVE: CVE-2016-8618
Signed-off-by: Thiruvadi Rajaraman <trajaraman@mvista.com>
---
lib/mprintf.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
Index: curl-7.44.0/lib/mprintf.c
===================================================================
--- curl-7.44.0.orig/lib/mprintf.c
+++ curl-7.44.0/lib/mprintf.c
@@ -1011,16 +1011,19 @@ static int alloc_addbyter(int output, FI
infop->len =0;
}
else if(infop->len+1 >= infop->alloc) {
- char *newptr;
+ char *newptr = NULL;
+ size_t newsize = infop->alloc*2;
- newptr = realloc(infop->buffer, infop->alloc*2);
+ /* detect wrap-around or other overflow problems */
+ if(newsize > infop->alloc)
+ newptr = realloc(infop->buffer, newsize);
if(!newptr) {
infop->fail = 1;
return -1; /* fail */
}
infop->buffer = newptr;
- infop->alloc *= 2;
+ infop->alloc = newsize;
}
infop->buffer[ infop->len ] = outc;
meta/recipes-support/curl/curl_7.50.1.bb
+1
View File
@@ -14,6 +14,7 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \
#
SRC_URI += " file://configure_ac.patch \
file://CVE-2016-8615.patch \
file://CVE-2016-8618.patch \
"
SRC_URI[md5sum] = "015f6a0217ca6f2c5442ca406476920b"