Skip to content

Commit bddbf86

Browse files
CBL-Mariner-Botsharath-srikanth-chellappa
CBL-Mariner-Bot
and
sharath-srikanth-chellappa
authored
[AUTO-CHERRYPICK] cmake: Fixes for CVE-2022-43552, CVE-2023-27536, CVE-2023-27535, CVE-2023-27538, CVE-2023-23916 and CVE-2023-46218 - branch main (#11123)
Co-authored-by: sharath-srikanth-chellappa <115591284+sharath-srikanth-chellappa@users.noreply.github.com>
1 parent 1bb81db commit bddbf86

9 files changed

Lines changed: 477 additions & 5 deletions

File tree

‎SPECS/cmake/CVE-2022-43552.patch‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
From 6967f3bebe94e6878500dea358438e8ac95baf47 Mon Sep 17 00:00:00 2001
2+
From: Sharath Srikanth Chellappa <sharathsr@microsoft.com>
3+
Date: Tue, 12 Nov 2024 17:05:45 -0800
4+
Subject: [PATCH] Patch for CVE-2022-43552
5+
6+
Upstream patch: https://github.com/curl/curl/commit/4f20188ac644afe174be6005ef4f6ffba232b8b2.patch
7+
8+
---
9+
Utilities/cmcurl/lib/smb.c | 14 ++------------
10+
Utilities/cmcurl/lib/telnet.c | 3 ---
11+
2 files changed, 2 insertions(+), 15 deletions(-)
12+
13+
diff --git a/Utilities/cmcurl/lib/smb.c b/Utilities/cmcurl/lib/smb.c
14+
index 39facb267d..eb4ef15be0 100644
15+
--- a/Utilities/cmcurl/lib/smb.c
16+
+++ b/Utilities/cmcurl/lib/smb.c
17+
@@ -60,8 +60,6 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done);
18+
static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
19+
static CURLcode smb_do(struct Curl_easy *data, bool *done);
20+
static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
21+
-static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
22+
- bool premature);
23+
static CURLcode smb_disconnect(struct Curl_easy *data,
24+
struct connectdata *conn, bool dead);
25+
static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
26+
@@ -76,7 +74,7 @@ const struct Curl_handler Curl_handler_smb = {
27+
"SMB", /* scheme */
28+
smb_setup_connection, /* setup_connection */
29+
smb_do, /* do_it */
30+
- smb_done, /* done */
31+
+ ZERO_NULL, /* done */
32+
ZERO_NULL, /* do_more */
33+
smb_connect, /* connect_it */
34+
smb_connection_state, /* connecting */
35+
@@ -103,7 +101,7 @@ const struct Curl_handler Curl_handler_smbs = {
36+
"SMBS", /* scheme */
37+
smb_setup_connection, /* setup_connection */
38+
smb_do, /* do_it */
39+
- smb_done, /* done */
40+
+ ZERO_NULL, /* done */
41+
ZERO_NULL, /* do_more */
42+
smb_connect, /* connect_it */
43+
smb_connection_state, /* connecting */
44+
@@ -940,14 +938,6 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
45+
return CURLE_OK;
46+
}
47+
48+
-static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
49+
- bool premature)
50+
-{
51+
- (void) premature;
52+
- Curl_safefree(data->req.p.smb);
53+
- return status;
54+
-}
55+
-
56+
static CURLcode smb_disconnect(struct Curl_easy *data,
57+
struct connectdata *conn, bool dead)
58+
{
59+
diff --git a/Utilities/cmcurl/lib/telnet.c b/Utilities/cmcurl/lib/telnet.c
60+
index fdd137fb0c..96c89096e5 100644
61+
--- a/Utilities/cmcurl/lib/telnet.c
62+
+++ b/Utilities/cmcurl/lib/telnet.c
63+
@@ -1243,9 +1243,6 @@ static CURLcode telnet_done(struct Curl_easy *data,
64+
65+
curl_slist_free_all(tn->telnet_vars);
66+
tn->telnet_vars = NULL;
67+
-
68+
- Curl_safefree(data->req.p.telnet);
69+
-
70+
return CURLE_OK;
71+
}
72+
73+
--
74+
2.45.2

‎SPECS/cmake/CVE-2023-23916.patch‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
From bd3423bcd2c427ee591b9c8772206af7574a3e80 Mon Sep 17 00:00:00 2001
2+
From: Sharath Srikanth Chellappa <sharathsr@microsoft.com>
3+
Date: Thu, 14 Nov 2024 15:45:07 -0800
4+
Subject: [PATCH] Patch for CVE-2023-23916
5+
6+
Upstream patch: https://github.com/curl/curl/commit/119fb187192a9ea13dc
7+
8+
---
9+
Utilities/cmcurl/lib/content_encoding.c | 8 ++++++++
10+
Utilities/cmcurl/lib/urldata.h | 1 +
11+
2 files changed, 9 insertions(+)
12+
13+
diff --git a/Utilities/cmcurl/lib/content_encoding.c b/Utilities/cmcurl/lib/content_encoding.c
14+
index a84ff543b9..c870df2dd4 100644
15+
--- a/Utilities/cmcurl/lib/content_encoding.c
16+
+++ b/Utilities/cmcurl/lib/content_encoding.c
17+
@@ -1025,6 +1025,9 @@ static const struct content_encoding *find_encoding(const char *name,
18+
return NULL;
19+
}
20+
21+
+/* allow no more than 5 "chained" compression steps */
22+
+#define MAX_ENCODE_STACK 5
23+
+
24+
/* Set-up the unencoding stack from the Content-Encoding header value.
25+
* See RFC 7231 section 3.1.2.2. */
26+
CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
27+
@@ -1065,6 +1068,11 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
28+
if(!encoding)
29+
encoding = &error_encoding; /* Defer error at stack use. */
30+
31+
+ if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
32+
+ failf(data, "Reject response due to more than %u content encodings",
33+
+ MAX_ENCODE_STACK);
34+
+ return CURLE_BAD_CONTENT_ENCODING;
35+
+ }
36+
/* Stack the unencoding stage. */
37+
writer = new_unencoding_writer(data, encoding, k->writer_stack);
38+
if(!writer)
39+
diff --git a/Utilities/cmcurl/lib/urldata.h b/Utilities/cmcurl/lib/urldata.h
40+
index ef3a58e55a..3505962f45 100644
41+
--- a/Utilities/cmcurl/lib/urldata.h
42+
+++ b/Utilities/cmcurl/lib/urldata.h
43+
@@ -702,6 +702,7 @@ struct SingleRequest {
44+
#ifndef CURL_DISABLE_DOH
45+
struct dohdata *doh; /* DoH specific data for this request */
46+
#endif
47+
+ unsigned char writer_stack_depth; /* Unencoding stack depth. */
48+
BIT(header); /* incoming data has HTTP header */
49+
BIT(content_range); /* set TRUE if Content-Range: was found */
50+
BIT(upload_done); /* set to TRUE when doing chunked transfer-encoding
51+
--
52+
2.45.2

‎SPECS/cmake/CVE-2023-27535.patch‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
From f1c9ae1e195f93a5d46434b067d17a60867d0f6a Mon Sep 17 00:00:00 2001
2+
From: Sharath Srikanth Chellappa <sharathsr@microsoft.com>
3+
Date: Wed, 13 Nov 2024 14:18:44 -0800
4+
Subject: [PATCH] Patch for CVE-2023-27535
5+
6+
Upstream patch: https://github.com/curl/curl/commit/8f4608468b890dc
7+
8+
---
9+
Utilities/cmcurl/lib/ftp.c | 29 +++++++++++++++++++++++++++--
10+
Utilities/cmcurl/lib/ftp.h | 5 +++++
11+
Utilities/cmcurl/lib/setopt.c | 1 +
12+
Utilities/cmcurl/lib/strcase.c | 22 ++++++++++++++++++++++
13+
Utilities/cmcurl/lib/strcase.h | 2 ++
14+
Utilities/cmcurl/lib/url.c | 16 +++++++++++++++-
15+
Utilities/cmcurl/lib/urldata.h | 4 ++--
16+
7 files changed, 74 insertions(+), 5 deletions(-)
17+
18+
diff --git a/Utilities/cmcurl/lib/ftp.c b/Utilities/cmcurl/lib/ftp.c
19+
index 425b0afec6..776a65f956 100644
20+
--- a/Utilities/cmcurl/lib/ftp.c
21+
+++ b/Utilities/cmcurl/lib/ftp.c
22+
@@ -4084,6 +4084,8 @@ static CURLcode ftp_disconnect(struct Curl_easy *data,
23+
}
24+
25+
freedirs(ftpc);
26+
+ Curl_safefree(ftpc->account);
27+
+ Curl_safefree(ftpc->alternative_to_user);
28+
Curl_safefree(ftpc->prevpath);
29+
Curl_safefree(ftpc->server_os);
30+
Curl_pp_disconnect(pp);
31+
@@ -4344,11 +4346,32 @@ static CURLcode ftp_setup_connection(struct Curl_easy *data,
32+
{
33+
char *type;
34+
struct FTP *ftp;
35+
+ CURLcode result = CURLE_OK;
36+
+ struct ftp_conn *ftpc = &conn->proto.ftpc;
37+
38+
- data->req.p.ftp = ftp = calloc(sizeof(struct FTP), 1);
39+
+ ftp = calloc(sizeof(struct FTP), 1);
40+
if(NULL == ftp)
41+
return CURLE_OUT_OF_MEMORY;
42+
43+
+ /* clone connection related data that is FTP specific */
44+
+ if(data->set.str[STRING_FTP_ACCOUNT]) {
45+
+ ftpc->account = strdup(data->set.str[STRING_FTP_ACCOUNT]);
46+
+ if(!ftpc->account) {
47+
+ free(ftp);
48+
+ return CURLE_OUT_OF_MEMORY;
49+
+ }
50+
+ }
51+
+ if(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]) {
52+
+ ftpc->alternative_to_user =
53+
+ strdup(data->set.str[STRING_FTP_ALTERNATIVE_TO_USER]);
54+
+ if(!ftpc->alternative_to_user) {
55+
+ Curl_safefree(ftpc->account);
56+
+ free(ftp);
57+
+ return CURLE_OUT_OF_MEMORY;
58+
+ }
59+
+ }
60+
+ data->req.p.ftp = ftp;
61+
+
62+
ftp->path = &data->state.up.path[1]; /* don't include the initial slash */
63+
64+
/* FTP URLs support an extension like ";type=<typecode>" that
65+
@@ -4383,7 +4406,9 @@ static CURLcode ftp_setup_connection(struct Curl_easy *data,
66+
/* get some initial data into the ftp struct */
67+
ftp->transfer = PPTRANSFER_BODY;
68+
ftp->downloadsize = 0;
69+
- conn->proto.ftpc.known_filesize = -1; /* unknown size for now */
70+
+ ftpc->known_filesize = -1; /* unknown size for now */
71+
+ ftpc->use_ssl = data->set.use_ssl;
72+
+ ftpc->ccc = data->set.ftp_ccc;
73+
74+
return CURLE_OK;
75+
}
76+
diff --git a/Utilities/cmcurl/lib/ftp.h b/Utilities/cmcurl/lib/ftp.h
77+
index 1cfdac0851..afca25b469 100644
78+
--- a/Utilities/cmcurl/lib/ftp.h
79+
+++ b/Utilities/cmcurl/lib/ftp.h
80+
@@ -115,6 +115,8 @@ struct FTP {
81+
struct */
82+
struct ftp_conn {
83+
struct pingpong pp;
84+
+ char *account;
85+
+ char *alternative_to_user;
86+
char *entrypath; /* the PWD reply when we logged on */
87+
char *file; /* url-decoded file name (or path) */
88+
char **dirs; /* realloc()ed array for path components */
89+
@@ -144,6 +146,9 @@ struct ftp_conn {
90+
ftpstate state; /* always use ftp.c:state() to change state! */
91+
ftpstate state_saved; /* transfer type saved to be reloaded after
92+
data connection is established */
93+
+ unsigned char use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or
94+
+ IMAP or POP3 or others! (type: curl_usessl)*/
95+
+ unsigned char ccc; /* ccc level for this connection */
96+
curl_off_t retr_size_saved; /* Size of retrieved file saved */
97+
char *server_os; /* The target server operating system. */
98+
curl_off_t known_filesize; /* file size is different from -1, if wildcard
99+
diff --git a/Utilities/cmcurl/lib/setopt.c b/Utilities/cmcurl/lib/setopt.c
100+
index fb8b86d474..10c6872bb3 100644
101+
--- a/Utilities/cmcurl/lib/setopt.c
102+
+++ b/Utilities/cmcurl/lib/setopt.c
103+
@@ -2307,6 +2307,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
104+
if((arg < CURLUSESSL_NONE) || (arg >= CURLUSESSL_LAST))
105+
return CURLE_BAD_FUNCTION_ARGUMENT;
106+
data->set.use_ssl = (curl_usessl)arg;
107+
+ data->set.use_ssl = (unsigned char)arg;
108+
break;
109+
110+
case CURLOPT_SSL_OPTIONS:
111+
diff --git a/Utilities/cmcurl/lib/strcase.c b/Utilities/cmcurl/lib/strcase.c
112+
index 955e3c79ea..29cc539cdf 100644
113+
--- a/Utilities/cmcurl/lib/strcase.c
114+
+++ b/Utilities/cmcurl/lib/strcase.c
115+
@@ -251,6 +251,28 @@ void Curl_strntolower(char *dest, const char *src, size_t n)
116+
} while(*src++ && --n);
117+
}
118+
119+
+/*
120+
+ * Curl_timestrcmp() returns 0 if the two strings are identical. The time this
121+
+ * function spends is a function of the shortest string, not of the contents.
122+
+ */
123+
+int Curl_timestrcmp(const char *a, const char *b)
124+
+{
125+
+ int match = 0;
126+
+ int i = 0;
127+
+
128+
+ if(a && b) {
129+
+ while(1) {
130+
+ match |= a[i]^b[i];
131+
+ if(!a[i] || !b[i])
132+
+ break;
133+
+ i++;
134+
+ }
135+
+ }
136+
+ else
137+
+ return a || b;
138+
+ return match;
139+
+}
140+
+
141+
/* --- public functions --- */
142+
143+
int curl_strequal(const char *first, const char *second)
144+
diff --git a/Utilities/cmcurl/lib/strcase.h b/Utilities/cmcurl/lib/strcase.h
145+
index 10dc698817..6fdb32ed08 100644
146+
--- a/Utilities/cmcurl/lib/strcase.h
147+
+++ b/Utilities/cmcurl/lib/strcase.h
148+
@@ -48,4 +48,6 @@ char Curl_raw_toupper(char in);
149+
void Curl_strntoupper(char *dest, const char *src, size_t n);
150+
void Curl_strntolower(char *dest, const char *src, size_t n);
151+
152+
+int Curl_timestrcmp(const char *first, const char *second);
153+
+
154+
#endif /* HEADER_CURL_STRCASE_H */
155+
diff --git a/Utilities/cmcurl/lib/url.c b/Utilities/cmcurl/lib/url.c
156+
index ca40322504..e00c56300b 100644
157+
--- a/Utilities/cmcurl/lib/url.c
158+
+++ b/Utilities/cmcurl/lib/url.c
159+
@@ -1334,10 +1334,24 @@ ConnectionExists(struct Curl_easy *data,
160+
(data->state.httpwant < CURL_HTTP_VERSION_2_0))
161+
continue;
162+
163+
- if(get_protocol_family(needle->handler) & PROTO_FAMILY_SSH) {
164+
+#ifdef USE_SSH
165+
+ else if(get_protocol_family(needle->handler) & PROTO_FAMILY_SSH) {
166+
if(!ssh_config_matches(needle, check))
167+
continue;
168+
}
169+
+#endif
170+
+#ifndef CURL_DISABLE_FTP
171+
+ else if(get_protocol_family(needle->handler) & PROTO_FAMILY_FTP) {
172+
+ /* Also match ACCOUNT, ALTERNATIVE-TO-USER, USE_SSL and CCC options */
173+
+ if(Curl_timestrcmp(needle->proto.ftpc.account,
174+
+ check->proto.ftpc.account) ||
175+
+ Curl_timestrcmp(needle->proto.ftpc.alternative_to_user,
176+
+ check->proto.ftpc.alternative_to_user) ||
177+
+ (needle->proto.ftpc.use_ssl != check->proto.ftpc.use_ssl) ||
178+
+ (needle->proto.ftpc.ccc != check->proto.ftpc.ccc))
179+
+ continue;
180+
+ }
181+
+#endif
182+
183+
if((needle->handler->flags&PROTOPT_SSL)
184+
#ifndef CURL_DISABLE_PROXY
185+
diff --git a/Utilities/cmcurl/lib/urldata.h b/Utilities/cmcurl/lib/urldata.h
186+
index 365b6821b1..ef3a58e55a 100644
187+
--- a/Utilities/cmcurl/lib/urldata.h
188+
+++ b/Utilities/cmcurl/lib/urldata.h
189+
@@ -1729,8 +1729,6 @@ struct UserDefined {
190+
void *ssh_keyfunc_userp; /* custom pointer to callback */
191+
enum CURL_NETRC_OPTION
192+
use_netrc; /* defined in include/curl.h */
193+
- curl_usessl use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or
194+
- IMAP or POP3 or others! */
195+
long new_file_perms; /* Permissions to use when creating remote files */
196+
long new_directory_perms; /* Permissions to use when creating remote dirs */
197+
long ssh_auth_types; /* allowed SSH auth types */
198+
@@ -1773,6 +1771,8 @@ struct UserDefined {
199+
CURLU *uh; /* URL handle for the current parsed URL */
200+
void *trailer_data; /* pointer to pass to trailer data callback */
201+
curl_trailer_callback trailer_callback; /* trailing data callback */
202+
+ unsigned char use_ssl; /* if AUTH TLS is to be attempted etc, for FTP or
203+
+ IMAP or POP3 or others! (type: curl_usessl)*/
204+
BIT(is_fread_set); /* has read callback been set to non-NULL? */
205+
BIT(is_fwrite_set); /* has write callback been set to non-NULL? */
206+
BIT(free_referer); /* set TRUE if 'referer' points to a string we
207+
--
208+
2.45.2

‎SPECS/cmake/CVE-2023-27536.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
From f7da0416e4b6374fd336fdcf3b708a493a492969 Mon Sep 17 00:00:00 2001
2+
From: Sharath Srikanth Chellappa <sharathsr@microsoft.com>
3+
Date: Tue, 12 Nov 2024 17:19:13 -0800
4+
Subject: [PATCH] Patch for CVE-2023-27536
5+
6+
Upstream patch: https://github.com/curl/curl/commit/cb49e67303dba.patch
7+
8+
---
9+
Utilities/cmcurl/lib/url.c | 6 ++++++
10+
Utilities/cmcurl/lib/urldata.h | 1 +
11+
2 files changed, 7 insertions(+)
12+
13+
diff --git a/Utilities/cmcurl/lib/url.c b/Utilities/cmcurl/lib/url.c
14+
index 1ee38af0d5..4ab389af48 100644
15+
--- a/Utilities/cmcurl/lib/url.c
16+
+++ b/Utilities/cmcurl/lib/url.c
17+
@@ -1322,6 +1322,11 @@ ConnectionExists(struct Curl_easy *data,
18+
}
19+
}
20+
21+
+ /* GSS delegation differences do not actually affect every connection
22+
+ and auth method, but this check takes precaution before efficiency */
23+
+ if(needle->gssapi_delegation != check->gssapi_delegation)
24+
+ continue;
25+
+
26+
/* If multiplexing isn't enabled on the h2 connection and h1 is
27+
explicitly requested, handle it: */
28+
if((needle->handler->protocol & PROTO_FAMILY_HTTP) &&
29+
@@ -1766,6 +1771,7 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
30+
conn->fclosesocket = data->set.fclosesocket;
31+
conn->closesocket_client = data->set.closesocket_client;
32+
conn->lastused = Curl_now(); /* used now */
33+
+ conn->gssapi_delegation = data->set.gssapi_delegation;
34+
35+
return conn;
36+
error:
37+
diff --git a/Utilities/cmcurl/lib/urldata.h b/Utilities/cmcurl/lib/urldata.h
38+
index fb905c36c5..365b6821b1 100644
39+
--- a/Utilities/cmcurl/lib/urldata.h
40+
+++ b/Utilities/cmcurl/lib/urldata.h
41+
@@ -1120,6 +1120,7 @@ struct connectdata {
42+
int socks5_gssapi_enctype;
43+
#endif
44+
unsigned short localport;
45+
+ unsigned char gssapi_delegation; /* inherited from set.gssapi_delegation */
46+
};
47+
48+
/* The end of connectdata. */
49+
--
50+
2.45.2
51+

0 commit comments

Comments
 (0)