|
| 1 | +From 851e92133dcb67015af8f7d3402fb58fa5df051e Mon Sep 17 00:00:00 2001 |
| 2 | +From: Suresh Thelkar <sthelkar@microsoft.com> |
| 3 | +Date: Wed, 18 Sep 2024 15:14:00 +0530 |
| 4 | +Subject: [PATCH] Patch for CVE-2023-27534 |
| 5 | + |
| 6 | +Upstream patch details are given below. |
| 7 | +https://github.com/curl/curl/pull/10729/commits/01345b13d4c4d1222387f5c02dfb6244a9cade33#diff-86c8ab4ca5332fd50f646ad37656e92fc41839ba34e0ddab1ec7728439cbe5f1 |
| 8 | +--- |
| 9 | + Utilities/cmcurl/lib/curl_path.c | 72 ++++++++++++++++---------------- |
| 10 | + 1 file changed, 36 insertions(+), 36 deletions(-) |
| 11 | + |
| 12 | +diff --git a/Utilities/cmcurl/lib/curl_path.c b/Utilities/cmcurl/lib/curl_path.c |
| 13 | +index 65106188..28eb41ad 100644 |
| 14 | +--- a/Utilities/cmcurl/lib/curl_path.c |
| 15 | ++++ b/Utilities/cmcurl/lib/curl_path.c |
| 16 | +@@ -30,6 +30,8 @@ |
| 17 | + #include "escape.h" |
| 18 | + #include "memdebug.h" |
| 19 | + |
| 20 | ++#define MAX_SSHPATH_LEN 100000 /* arbitrary */ |
| 21 | ++ |
| 22 | + /* figure out the path to work with in this particular request */ |
| 23 | + CURLcode Curl_getworkingpath(struct Curl_easy *data, |
| 24 | + char *homedir, /* when SFTP is used */ |
| 25 | +@@ -39,57 +41,55 @@ CURLcode Curl_getworkingpath(struct Curl_easy *data, |
| 26 | + char *real_path = NULL; |
| 27 | + char *working_path; |
| 28 | + size_t working_path_len; |
| 29 | ++ struct dynbuf npath; |
| 30 | + CURLcode result = |
| 31 | + Curl_urldecode(data, data->state.up.path, 0, &working_path, |
| 32 | + &working_path_len, REJECT_ZERO); |
| 33 | + if(result) |
| 34 | + return result; |
| 35 | + |
| 36 | ++ /* new path to switch to in case we need to */ |
| 37 | ++ Curl_dyn_init(&npath, MAX_SSHPATH_LEN); |
| 38 | ++ |
| 39 | + /* Check for /~/, indicating relative to the user's home directory */ |
| 40 | +- if(data->conn->handler->protocol & CURLPROTO_SCP) { |
| 41 | +- real_path = malloc(working_path_len + 1); |
| 42 | +- if(!real_path) { |
| 43 | ++ if((data->conn->handler->protocol & CURLPROTO_SCP) && |
| 44 | ++ (working_path_len > 3) && (!memcmp(working_path, "/~/", 3))) { |
| 45 | ++ /* It is referenced to the home directory, so strip the leading '/~/' */ |
| 46 | ++ if(Curl_dyn_addn(&npath, &working_path[3], working_path_len - 3)) { |
| 47 | + free(working_path); |
| 48 | + return CURLE_OUT_OF_MEMORY; |
| 49 | + } |
| 50 | +- if((working_path_len > 3) && (!memcmp(working_path, "/~/", 3))) |
| 51 | +- /* It is referenced to the home directory, so strip the leading '/~/' */ |
| 52 | +- memcpy(real_path, working_path + 3, working_path_len - 2); |
| 53 | +- else |
| 54 | +- memcpy(real_path, working_path, 1 + working_path_len); |
| 55 | + } |
| 56 | +- else if(data->conn->handler->protocol & CURLPROTO_SFTP) { |
| 57 | +- if((working_path_len > 1) && (working_path[1] == '~')) { |
| 58 | +- size_t homelen = strlen(homedir); |
| 59 | +- real_path = malloc(homelen + working_path_len + 1); |
| 60 | +- if(!real_path) { |
| 61 | +- free(working_path); |
| 62 | +- return CURLE_OUT_OF_MEMORY; |
| 63 | +- } |
| 64 | +- /* It is referenced to the home directory, so strip the |
| 65 | +- leading '/' */ |
| 66 | +- memcpy(real_path, homedir, homelen); |
| 67 | +- real_path[homelen] = '/'; |
| 68 | +- real_path[homelen + 1] = '\0'; |
| 69 | +- if(working_path_len > 3) { |
| 70 | +- memcpy(real_path + homelen + 1, working_path + 3, |
| 71 | +- 1 + working_path_len -3); |
| 72 | +- } |
| 73 | ++ else if((data->conn->handler->protocol & CURLPROTO_SFTP) && |
| 74 | ++ (working_path_len > 2) && !memcmp(working_path, "/~/", 3)) { |
| 75 | ++ size_t len; |
| 76 | ++ const char *p; |
| 77 | ++ int copyfrom = 3; |
| 78 | ++ if(Curl_dyn_add(&npath, homedir)) { |
| 79 | ++ free(working_path); |
| 80 | ++ return CURLE_OUT_OF_MEMORY; |
| 81 | + } |
| 82 | +- else { |
| 83 | +- real_path = malloc(working_path_len + 1); |
| 84 | +- if(!real_path) { |
| 85 | +- free(working_path); |
| 86 | +- return CURLE_OUT_OF_MEMORY; |
| 87 | +- } |
| 88 | +- memcpy(real_path, working_path, 1 + working_path_len); |
| 89 | ++ /* Copy a separating '/' if homedir does not end with one */ |
| 90 | ++ len = Curl_dyn_len(&npath); |
| 91 | ++ p = Curl_dyn_ptr(&npath); |
| 92 | ++ if(len && (p[len-1] != '/')) |
| 93 | ++ copyfrom = 2; |
| 94 | ++ |
| 95 | ++ if(Curl_dyn_addn(&npath, |
| 96 | ++ &working_path[copyfrom], working_path_len - copyfrom)) { |
| 97 | ++ free(working_path); |
| 98 | ++ return CURLE_OUT_OF_MEMORY; |
| 99 | + } |
| 100 | + } |
| 101 | + |
| 102 | +- free(working_path); |
| 103 | +- |
| 104 | +- /* store the pointer for the caller to receive */ |
| 105 | +- *path = real_path; |
| 106 | ++ if(Curl_dyn_len(&npath)) { |
| 107 | ++ free(working_path); |
| 108 | ++ |
| 109 | ++ /* store the pointer for the caller to receive */ |
| 110 | ++ *path = Curl_dyn_ptr(&npath); |
| 111 | ++ } |
| 112 | ++ else |
| 113 | ++ *path = working_path |
| 114 | + |
| 115 | + return CURLE_OK; |
| 116 | + } |
| 117 | +-- |
| 118 | +2.34.1 |
| 119 | + |
0 commit comments