mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

curl: fix CVE-2025-10148 backport for websockets on 8.7.1

Browse Source 
The original backport applied upstream's CURLcode return path into
ssize_t ws_enc_write_head(), which uses an undeclared result and is
invalid for curl 8.7.1's API. Builds with --enable-websockets fail.

Adapt Curl_rand() error handling to set *err and return -1.

AI-Generated: Claude Sonnet 4.6
(From OE-Core rev: 152c139de6b1ad00d904b5fd16b4abc9852459a4)

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Etienne Cordonnier
2026-08-13 18:37:46 +02:00
committed by Richard Purdie
parent 1d390a4e04
commit 5b35d2e634
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
meta/recipes-support/curl/curl/CVE-2025-10148.patch
View File

@@ -9,23 +9,28 @@ Closes #18496
CVE: CVE-2025-10148 CVE: CVE-2025-10148
Upstream-Status: Backport [https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa] Upstream-Status: Backport [https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa]
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
--- ---
lib/ws.c | 21 +++++++++++++-------- lib/ws.c | 25 +++++++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-) 1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/lib/ws.c b/lib/ws.c diff --git a/lib/ws.c b/lib/ws.c
index 5bc5ecc..02e0ef0 100644 index 5bc5ecc..02e0ef0 100644
--- a/lib/ws.c --- a/lib/ws.c
+++ b/lib/ws.c +++ b/lib/ws.c
@@ -614,6 +614,18 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data, @@ -614,6 +614,22 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data,
enc->payload_remain = enc->payload_len = payload_len; enc->payload_remain = enc->payload_len = payload_len;
ws_enc_info(enc, data, "sending"); ws_enc_info(enc, data, "sending");
+ /* 4 bytes random */ + /* 4 bytes random */
+ + {
+ result = Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask)); + CURLcode result = Curl_rand(data, (unsigned char *)&enc->mask,
+ if(result) + sizeof(enc->mask));
+ return result; + if(result) {
+ *err = result;
+ return -1;
+ }
+ }
+ +
+#ifdef DEBUGBUILD +#ifdef DEBUGBUILD
+ if(getenv("CURL_WS_FORCE_ZERO_MASK")) + if(getenv("CURL_WS_FORCE_ZERO_MASK"))
@@ -36,7 +41,7 @@ index 5bc5ecc..02e0ef0 100644
/* add 4 bytes mask */ /* add 4 bytes mask */
memcpy(&head[hlen], &enc->mask, 4); memcpy(&head[hlen], &enc->mask, 4);
hlen += 4; hlen += 4;
@@ -802,14 +814,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data, @@ -802,14 +818,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
subprotocol not requested by the client), the client MUST Fail subprotocol not requested by the client), the client MUST Fail
the WebSocket Connection. */ the WebSocket Connection. */
@@ -54,4 +59,3 @@ index 5bc5ecc..02e0ef0 100644
result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode, result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode,
-- --
2.50.1 2.50.1