mirror of
https://git.yoctoproject.org/poky
synced 2026-05-02 18:32:15 +02:00
79bc6dd607
Pick commits per https://curl.se/docs/CVE-2024-7264.html (From OE-Core rev: 0f1c4b8ae80dc90ee4ed89c4b99da2dca75dd247) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
62 lines
2.2 KiB
Diff
62 lines
2.2 KiB
Diff
From 3c914bc680155b32178f1f15ca8d47c7f4640afe Mon Sep 17 00:00:00 2001
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Tue, 30 Jul 2024 10:05:17 +0200
|
|
Subject: [PATCH] x509asn1: clean up GTime2str
|
|
|
|
Co-authored-by: Stefan Eissing
|
|
Reported-by: Dov Murik
|
|
|
|
Closes #14307
|
|
|
|
CVE: CVE-2024-7264
|
|
Upstream-Status: Backport [https://github.com/curl/curl/commit/3c914bc680155b32178f1f15ca8d47c7f4640afe.patch]
|
|
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
|
---
|
|
lib/vtls/x509asn1.c | 23 ++++++++++++++---------
|
|
1 file changed, 14 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/lib/vtls/x509asn1.c b/lib/vtls/x509asn1.c
|
|
index 1bc4243ddae343..e3a9fe4232a4ea 100644
|
|
--- a/lib/vtls/x509asn1.c
|
|
+++ b/lib/vtls/x509asn1.c
|
|
@@ -488,7 +488,7 @@ static CURLcode GTime2str(struct dynbuf *store,
|
|
/* Convert an ASN.1 Generalized time to a printable string.
|
|
Return the dynamically allocated string, or NULL if an error occurs. */
|
|
|
|
- for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
|
|
+ for(fracp = beg; fracp < end && ISDIGIT(*fracp); fracp++)
|
|
;
|
|
|
|
/* Get seconds digits. */
|
|
@@ -507,17 +507,22 @@ static CURLcode GTime2str(struct dynbuf *store,
|
|
return CURLE_BAD_FUNCTION_ARGUMENT;
|
|
}
|
|
|
|
- /* Scan for timezone, measure fractional seconds. */
|
|
+ /* timezone follows optional fractional seconds. */
|
|
tzp = fracp;
|
|
- fracl = 0;
|
|
+ fracl = 0; /* no fractional seconds detected so far */
|
|
if(fracp < end && (*fracp == '.' || *fracp == ',')) {
|
|
- fracp++;
|
|
- do
|
|
+ /* Have fractional seconds, e.g. "[.,]\d+". How many? */
|
|
+ tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
|
|
+ while(tzp < end && ISDIGIT(*tzp))
|
|
tzp++;
|
|
- while(tzp < end && *tzp >= '0' && *tzp <= '9');
|
|
- /* Strip leading zeroes in fractional seconds. */
|
|
- for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
|
|
- ;
|
|
+ if(tzp == fracp) /* never looped, no digit after [.,] */
|
|
+ return CURLE_BAD_FUNCTION_ARGUMENT;
|
|
+ fracl = tzp - fracp - 1; /* number of fractional sec digits */
|
|
+ DEBUGASSERT(fracl > 0);
|
|
+ /* Strip trailing zeroes in fractional seconds.
|
|
+ * May reduce fracl to 0 if only '0's are present. */
|
|
+ while(fracl && fracp[fracl - 1] == '0')
|
|
+ fracl--;
|
|
}
|
|
|
|
/* Process timezone. */
|