fix CVE-2023-23916
(cherry picked from commit 914f7c0a0d710d53dcf3b62cecfac8002ed3c65f)
This commit is contained in:
xinghe
openeuler-sync-bot
parent
664e02e2b6
commit
bbce09840b
229
backport-CVE-2023-23916.patch
Normal file
229
backport-CVE-2023-23916.patch
Normal file
@ -0,0 +1,229 @@
|
||||
From 119fb187192a9ea13dc90d9d20c215fc82799ab9 Mon Sep 17 00:00:00 2001
|
||||
From: Patrick Monnerat <patrick@monnerat.net>
|
||||
Date: Mon, 13 Feb 2023 08:33:09 +0100
|
||||
Subject: [PATCH] content_encoding: do not reset stage counter for each header
|
||||
|
||||
Test 418 verifies
|
||||
|
||||
Closes #10492
|
||||
|
||||
Conflict: remove tests/data/test387
|
||||
Reference: https://github.com/curl/curl/commit/119fb187192a9ea13dc
|
||||
---
|
||||
lib/content_encoding.c | 7 +-
|
||||
lib/urldata.h | 1 +
|
||||
tests/data/Makefile.inc | 2 +-
|
||||
tests/data/test418 | 152 ++++++++++++++++++++++++++++++++++++++++
|
||||
4 files changed, 157 insertions(+), 5 deletions(-)
|
||||
create mode 100644 tests/data/test418
|
||||
|
||||
diff --git a/lib/content_encoding.c b/lib/content_encoding.c
|
||||
index 4a20142..3633791 100644
|
||||
--- a/lib/content_encoding.c
|
||||
+++ b/lib/content_encoding.c
|
||||
@@ -945,7 +945,6 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
|
||||
{
|
||||
struct Curl_easy *data = conn->data;
|
||||
struct SingleRequest *k = &data->req;
|
||||
- int counter = 0;
|
||||
|
||||
do {
|
||||
const char *name;
|
||||
@@ -980,9 +979,9 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
|
||||
if(!encoding)
|
||||
encoding = &error_encoding; /* Defer error at stack use. */
|
||||
|
||||
- if(++counter >= MAX_ENCODE_STACK) {
|
||||
- failf(data, "Reject response due to %u content encodings",
|
||||
- counter);
|
||||
+ if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
|
||||
+ failf(data, "Reject response due to more than %u content encodings",
|
||||
+ MAX_ENCODE_STACK);
|
||||
return CURLE_BAD_CONTENT_ENCODING;
|
||||
}
|
||||
/* Stack the unencoding stage. */
|
||||
diff --git a/lib/urldata.h b/lib/urldata.h
|
||||
index dc77061..27ee1b5 100644
|
||||
--- a/lib/urldata.h
|
||||
+++ b/lib/urldata.h
|
||||
@@ -653,6 +653,7 @@ struct SingleRequest {
|
||||
struct dohdata doh; /* DoH specific data for this request */
|
||||
#endif
|
||||
unsigned char setcookies;
|
||||
+ unsigned char writer_stack_depth; /* Unencoding stack depth. */
|
||||
BIT(header); /* incoming data has HTTP header */
|
||||
BIT(content_range); /* set TRUE if Content-Range: was found */
|
||||
BIT(upload_done); /* set to TRUE when doing chunked transfer-encoding
|
||||
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
|
||||
index f57f45e..5b943ab 100644
|
||||
--- a/tests/data/Makefile.inc
|
||||
+++ b/tests/data/Makefile.inc
|
||||
@@ -65,7 +65,7 @@ test393 test394 test395 \
|
||||
\
|
||||
test400 test401 test402 test403 test404 test405 test406 test407 test408 \
|
||||
test409 \
|
||||
-\
|
||||
+test418 \
|
||||
test430 test431 test432 \
|
||||
\
|
||||
test490 test491 test492 \
|
||||
diff --git a/tests/data/test418 b/tests/data/test418
|
||||
new file mode 100644
|
||||
index 0000000..50e974e
|
||||
--- /dev/null
|
||||
+++ b/tests/data/test418
|
||||
@@ -0,0 +1,152 @@
|
||||
+<testcase>
|
||||
+<info>
|
||||
+<keywords>
|
||||
+HTTP
|
||||
+gzip
|
||||
+</keywords>
|
||||
+</info>
|
||||
+
|
||||
+#
|
||||
+# Server-side
|
||||
+<reply>
|
||||
+<data nocheck="yes">
|
||||
+HTTP/1.1 200 OK
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+Transfer-Encoding: gzip
|
||||
+
|
||||
+-foo-
|
||||
+</data>
|
||||
+</reply>
|
||||
+
|
||||
+#
|
||||
+# Client-side
|
||||
+<client>
|
||||
+<server>
|
||||
+http
|
||||
+</server>
|
||||
+ <name>
|
||||
+Response with multiple Transfer-Encoding headers
|
||||
+ </name>
|
||||
+ <command>
|
||||
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
|
||||
+</command>
|
||||
+</client>
|
||||
+
|
||||
+#
|
||||
+# Verify data after the test has been "shot"
|
||||
+<verify>
|
||||
+<protocol crlf="yes">
|
||||
+GET /%TESTNUMBER HTTP/1.1
|
||||
+Host: %HOSTIP:%HTTPPORT
|
||||
+User-Agent: curl/%VERSION
|
||||
+Accept: */*
|
||||
+
|
||||
+</protocol>
|
||||
+
|
||||
+# CURLE_BAD_CONTENT_ENCODING is 61
|
||||
+<errorcode>
|
||||
+61
|
||||
+</errorcode>
|
||||
+<stderr mode="text">
|
||||
+curl: (61) Reject response due to more than 5 content encodings
|
||||
+</stderr>
|
||||
+</verify>
|
||||
+</testcase>
|
||||
--
|
||||
2.27.0
|
||||
@ -6,7 +6,7 @@
|
||||
|
||||
Name: curl
|
||||
Version: 7.71.1
|
||||
Release: 20
|
||||
Release: 21
|
||||
Summary: Curl is used in command lines or scripts to transfer data
|
||||
License: MIT
|
||||
URL: https://curl.haxx.se/
|
||||
@ -50,6 +50,7 @@ Patch136: backport-fix-configure-disable-http-auth-build-error.patch
|
||||
Patch137: backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch
|
||||
Patch138: backport-CVE-2022-32221.patch
|
||||
Patch139: backport-CVE-2022-43552-smb-telnet-do-not-free-the-protocol-struct-in-_done.patch
|
||||
Patch140: backport-CVE-2023-23916.patch
|
||||
|
||||
BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel
|
||||
BuildRequires: libidn2-devel libnghttp2-devel libpsl-devel
|
||||
@ -191,6 +192,12 @@ rm -rf ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
|
||||
%{_mandir}/man3/*
|
||||
|
||||
%changelog
|
||||
* Sat Feb 18 2023 xinghe <xinghe2@h-partners.com> - 7.71.1-21
|
||||
- Type:cves
|
||||
- CVE:CVE-2023-23916
|
||||
- SUG:NA
|
||||
- DESC:fix CVE-2023-23916
|
||||
|
||||
* Wed Dec 28 2022 zhouyihang <zhouyihang3@h-partners.com> - 7.71.1-20
|
||||
- Type:cves
|
||||
- CVE:CVE-2022-43552
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user