mirror of
https://git.yoctoproject.org/poky
synced 2026-06-02 13:29:49 +00:00
curl: CVE-2023-23916 HTTP multi-header compression denial of service
Upstream-Status: Backport from https://github.com/curl/curl/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9 (From OE-Core rev: b121b59cf6f642f46c97c96f3c4cf4cd84ff2af5) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Hitendra Prajapati
committed by
Steve Sakoman
Steve Sakoman
parent
a307ef21c1
commit
ba7aa15473
@@ -0,0 +1,231 @@
|
||||
From 119fb187192a9ea13dc90d9d20c215fc82799ab9 Mon Sep 17 00:00:00 2001
|
||||
From: Patrick Monnerat <patrick@monnerat.net>
|
||||
Date: Mon, 13 Feb 2023 08:33:09 +0100
|
||||
Subject: [PATCH] content_encoding: do not reset stage counter for each header
|
||||
|
||||
Test 418 verifies
|
||||
|
||||
Closes #10492
|
||||
|
||||
Upstream-Status: Backport [https://github.com/curl/curl/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9]
|
||||
CVE: CVE-2023-23916
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
lib/content_encoding.c | 7 +-
|
||||
lib/urldata.h | 1 +
|
||||
tests/data/Makefile.inc | 2 +-
|
||||
tests/data/test418 | 152 ++++++++++++++++++++++++++++++++++++++++
|
||||
4 files changed, 157 insertions(+), 5 deletions(-)
|
||||
create mode 100644 tests/data/test418
|
||||
|
||||
diff --git a/lib/content_encoding.c b/lib/content_encoding.c
|
||||
index 91e621f..7e098a5 100644
|
||||
--- a/lib/content_encoding.c
|
||||
+++ b/lib/content_encoding.c
|
||||
@@ -944,7 +944,6 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
|
||||
{
|
||||
struct Curl_easy *data = conn->data;
|
||||
struct SingleRequest *k = &data->req;
|
||||
- int counter = 0;
|
||||
|
||||
do {
|
||||
const char *name;
|
||||
@@ -979,9 +978,9 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
|
||||
if(!encoding)
|
||||
encoding = &error_encoding; /* Defer error at stack use. */
|
||||
|
||||
- if(++counter >= MAX_ENCODE_STACK) {
|
||||
- failf(data, "Reject response due to %u content encodings",
|
||||
- counter);
|
||||
+ if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
|
||||
+ failf(data, "Reject response due to more than %u content encodings",
|
||||
+ MAX_ENCODE_STACK);
|
||||
return CURLE_BAD_CONTENT_ENCODING;
|
||||
}
|
||||
/* Stack the unencoding stage. */
|
||||
diff --git a/lib/urldata.h b/lib/urldata.h
|
||||
index ad0ef8f..168f874 100644
|
||||
--- a/lib/urldata.h
|
||||
+++ b/lib/urldata.h
|
||||
@@ -648,6 +648,7 @@ struct SingleRequest {
|
||||
#ifndef CURL_DISABLE_DOH
|
||||
struct dohdata doh; /* DoH specific data for this request */
|
||||
#endif
|
||||
+ unsigned char writer_stack_depth; /* Unencoding stack depth. */
|
||||
BIT(header); /* incoming data has HTTP header */
|
||||
BIT(content_range); /* set TRUE if Content-Range: was found */
|
||||
BIT(upload_done); /* set to TRUE when doing chunked transfer-encoding
|
||||
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
|
||||
index 60e8176..40de8bc 100644
|
||||
--- a/tests/data/Makefile.inc
|
||||
+++ b/tests/data/Makefile.inc
|
||||
@@ -63,7 +63,7 @@ test350 test351 test352 test353 test354 test355 test356 test357 \
|
||||
test393 test394 test395 \
|
||||
\
|
||||
test400 test401 test402 test403 test404 test405 test406 test407 test408 \
|
||||
-test409 \
|
||||
+test409 test418 \
|
||||
\
|
||||
test490 test491 test492 \
|
||||
\
|
||||
diff --git a/tests/data/test418 b/tests/data/test418
|
||||
new file mode 100644
|
||||
index 0000000..50e974e
|
||||
--- /dev/null
|
||||
+++ b/tests/data/test418
|
||||
@@ -0,0 +1,152 @@
|
||||
+<testcase>
|
||||
+<info>
|
||||
+<keywords>
|
||||
+HTTP
|
||||
+gzip
|
||||
+</keywords>
|
||||
+</info>
|
||||
+
|
||||
+#
|
||||
+# Server-side
|
||||
+<reply>
|
||||
+<data nocheck="yes">
|
||||
+HTTP/1.1 200 OK
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+
|
||||
+-foo-
|
||||
+</data>
|
||||
+</reply>
|
||||
+
|
||||
+#
|
||||
+# Client-side
|
||||
+<client>
|
||||
+<server>
|
||||
+http
|
||||
+</server>
|
||||
+ <name>
|
||||
+Response with multiple Transfer-Encoding headers
|
||||
+ </name>
|
||||
+ <command>
|
||||
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
|
||||
+</command>
|
||||
+</client>
|
||||
+
|
||||
+#
|
||||
+# Verify data after the test has been "shot"
|
||||
+<verify>
|
||||
+<protocol crlf="yes">
|
||||
+GET /%TESTNUMBER HTTP/1.1
|
||||
+Host: %HOSTIP:%HTTPPORT
|
||||
+User-Agent: curl/%VERSION
|
||||
+Accept: */*
|
||||
+
|
||||
+</protocol>
|
||||
+
|
||||
+# CURLE_BAD_CONTENT_ENCODING is 61
|
||||
+<errorcode>
|
||||
+61
|
||||
+</errorcode>
|
||||
+<stderr mode="text">
|
||||
+curl: (61) Reject response due to more than 5 content encodings
|
||||
+</stderr>
|
||||
+</verify>
|
||||
+</testcase>
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -42,6 +42,7 @@ SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 \
|
||||
file://CVE-2022-32221.patch \
|
||||
file://CVE-2022-35260.patch \
|
||||
file://CVE-2022-43552.patch \
|
||||
file://CVE-2023-23916.patch \
|
||||
"
|
||||
|
||||
SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42"
|
||||
|
||||
Reference in New Issue
Block a user