mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-19 15:32:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

curl: CVE-2018-14618

Browse Source 
Backport the CVE patch from the upstream
57d299a499.patch
https://curl.haxx.se/docs/CVE-2018-14618.html
https://nvd.nist.gov/vuln/detail/CVE-2018-14618

(From OE-Core rev: b76903b4b7bfec71be0a8a14e2cab4e2ec852222)

(From OE-Core rev: 4c51e82e43cbcc74d9bcabe24b778aae3cf123ca)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Zhixiong Chi
2018-09-18 01:46:17 -07:00
committed by Richard Purdie
parent 6f0d13a19e
commit b949a00e76
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
meta/recipes-support/curl/curl/CVE-2018-14618.patch Normal file
View File

@@ -0,0 +1,37 @@
From 57d299a499155d4b327e341c6024e293b0418243 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 13 Aug 2018 10:35:52 +0200
Subject: [PATCH] Curl_ntlm_core_mk_nt_hash: return error on too long password
... since it would cause an integer overflow if longer than (max size_t
/ 2).
This is CVE-2018-14618
Bug: https://curl.haxx.se/docs/CVE-2018-14618.html
Closes #2756
Reported-by: Zhaoyang Wu
CVE: CVE-2018-14618
Upstream-Status: Backport
Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
---
lib/curl_ntlm_core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c
index e27cab353c..922e85a926 100644
--- a/lib/curl_ntlm_core.c
+++ b/lib/curl_ntlm_core.c
@@ -557,8 +557,11 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struct Curl_easy *data,
unsigned char *ntbuffer /* 21 bytes */)
{
size_t len = strlen(password);
- unsigned char *pw = len ? malloc(len * 2) : strdup("");
+ unsigned char *pw;
CURLcode result;
+ if(len > SIZE_T_MAX/2) /* avoid integer overflow */
+ return CURLE_OUT_OF_MEMORY;
+ pw = len ? malloc(len * 2) : strdup("");
if(!pw)
return CURLE_OUT_OF_MEMORY;

1
meta/recipes-support/curl/curl_7.61.0.bb
View File

@@ -7,6 +7,7 @@ LIC_FILES_CHKSUM = "file://COPYING;beginline=8;md5=3a34942f4ae3fbf1a303160714e66
SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \
file://0001-replace-krb5-config-with-pkg-config.patch \
file://CVE-2018-14618.patch \
"
SRC_URI[md5sum] = "31d0a9f48dc796a7db351898a1e5058a"