mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-13 23:02:30 +02:00
Code Issues Packages Projects Releases Wiki Activity

Curl: Security fix for CVE-2019-5482

Browse Source 
Source: curl.org
MR: 99905
Type: Security Fix
Disposition: Backport from facb0e4662
ChangeID: e0c807da8937f687a4b2e28eaa6b4b5a51845bc5
Description:

Fixes CVE-2019-5482
- Affected versions: libcurl >= 7.19.4 to and including 7.65.3
- Not affected versions: libcurl < 7.19.4

(From OE-Core rev: d2e5558133f970a8a196c545dd00af9315c1a06a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Armin Kuster
2019-09-13 16:14:16 -07:00
committed by Richard Purdie
parent c6720451a8
commit 1b9559de4b
2 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
meta/recipes-support/curl/curl/CVE-2019-5482.patch Normal file
View File

@@ -0,0 +1,65 @@
From facb0e4662415b5f28163e853dc6742ac5fafb3d Mon Sep 17 00:00:00 2001
From: Thomas Vegas <>
Date: Sat, 31 Aug 2019 17:30:51 +0200
Subject: [PATCH] tftp: Alloc maximum blksize, and use default unless OACK is
received
Fixes potential buffer overflow from 'recvfrom()', should the server
return an OACK without blksize.
Bug: https://curl.haxx.se/docs/CVE-2019-5482.html
CVE-2019-5482
Upstream-Status: Backport
CVE: CVE-2019-5482
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
lib/tftp.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
Index: curl-7.64.1/lib/tftp.c
===================================================================
--- curl-7.64.1.orig/lib/tftp.c
+++ curl-7.64.1/lib/tftp.c
@@ -973,6 +973,7 @@ static CURLcode tftp_connect(struct conn
{
tftp_state_data_t *state;
int blksize;
+ int need_blksize;
blksize = TFTP_BLKSIZE_DEFAULT;
@@ -987,15 +988,20 @@ static CURLcode tftp_connect(struct conn
return CURLE_TFTP_ILLEGAL;
}
+ need_blksize = blksize;
+ /* default size is the fallback when no OACK is received */
+ if(need_blksize < TFTP_BLKSIZE_DEFAULT)
+ need_blksize = TFTP_BLKSIZE_DEFAULT;
+
if(!state->rpacket.data) {
- state->rpacket.data = calloc(1, blksize + 2 + 2);
+ state->rpacket.data = calloc(1, need_blksize + 2 + 2);
if(!state->rpacket.data)
return CURLE_OUT_OF_MEMORY;
}
if(!state->spacket.data) {
- state->spacket.data = calloc(1, blksize + 2 + 2);
+ state->spacket.data = calloc(1, need_blksize + 2 + 2);
if(!state->spacket.data)
return CURLE_OUT_OF_MEMORY;
@@ -1009,7 +1015,7 @@ static CURLcode tftp_connect(struct conn
state->sockfd = state->conn->sock[FIRSTSOCKET];
state->state = TFTP_STATE_START;
state->error = TFTP_ERR_NONE;
- state->blksize = blksize;
+ state->blksize = TFTP_BLKSIZE_DEFAULT; /* Unless updated by OACK response */
state->requested_blksize = blksize;
((struct sockaddr *)&state->local_addr)->sa_family =

1
meta/recipes-support/curl/curl_7.64.1.bb
View File

@@ -9,6 +9,7 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \
file://0001-replace-krb5-config-with-pkg-config.patch \
file://CVE-2019-5435.patch \
file://CVE-2019-5436.patch \
file://CVE-2019-5482.patch \
"
SRC_URI[md5sum] = "790c101927845208a9d7e8c429ddd1b2"