fix CVE-2023-23916
(cherry picked from commit 914f7c0a0d710d53dcf3b62cecfac8002ed3c65f)
This commit is contained in:
xinghe
openeuler-sync-bot
parent
664e02e2b6
commit
bbce09840b
229
backport-CVE-2023-23916.patch
Normal file
229
backport-CVE-2023-23916.patch
Normal file
@ -0,0 +1,229 @@
|
|||||||
|
From 119fb187192a9ea13dc90d9d20c215fc82799ab9 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Patrick Monnerat <patrick@monnerat.net>
|
||||||
|
Date: Mon, 13 Feb 2023 08:33:09 +0100
|
||||||
|
Subject: [PATCH] content_encoding: do not reset stage counter for each header
|
||||||
|
|
||||||
|
Test 418 verifies
|
||||||
|
|
||||||
|
Closes #10492
|
||||||
|
|
||||||
|
Conflict: remove tests/data/test387
|
||||||
|
Reference: https://github.com/curl/curl/commit/119fb187192a9ea13dc
|
||||||
|
---
|
||||||
|
lib/content_encoding.c | 7 +-
|
||||||
|
lib/urldata.h | 1 +
|
||||||
|
tests/data/Makefile.inc | 2 +-
|
||||||
|
tests/data/test418 | 152 ++++++++++++++++++++++++++++++++++++++++
|
||||||
|
4 files changed, 157 insertions(+), 5 deletions(-)
|
||||||
|
create mode 100644 tests/data/test418
|
||||||
|
|
||||||
|
diff --git a/lib/content_encoding.c b/lib/content_encoding.c
|
||||||
|
index 4a20142..3633791 100644
|
||||||
|
--- a/lib/content_encoding.c
|
||||||
|
+++ b/lib/content_encoding.c
|
||||||
|
@@ -945,7 +945,6 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
|
||||||
|
{
|
||||||
|
struct Curl_easy *data = conn->data;
|
||||||
|
struct SingleRequest *k = &data->req;
|
||||||
|
- int counter = 0;
|
||||||
|
|
||||||
|
do {
|
||||||
|
const char *name;
|
||||||
|
@@ -980,9 +979,9 @@ CURLcode Curl_build_unencoding_stack(struct connectdata *conn,
|
||||||
|
if(!encoding)
|
||||||
|
encoding = &error_encoding; /* Defer error at stack use. */
|
||||||
|
|
||||||
|
- if(++counter >= MAX_ENCODE_STACK) {
|
||||||
|
- failf(data, "Reject response due to %u content encodings",
|
||||||
|
- counter);
|
||||||
|
+ if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
|
||||||
|
+ failf(data, "Reject response due to more than %u content encodings",
|
||||||
|
+ MAX_ENCODE_STACK);
|
||||||
|
return CURLE_BAD_CONTENT_ENCODING;
|
||||||
|
}
|
||||||
|
/* Stack the unencoding stage. */
|
||||||
|
diff --git a/lib/urldata.h b/lib/urldata.h
|
||||||
|
index dc77061..27ee1b5 100644
|
||||||
|
--- a/lib/urldata.h
|
||||||
|
+++ b/lib/urldata.h
|
||||||
|
@@ -653,6 +653,7 @@ struct SingleRequest {
|
||||||
|
struct dohdata doh; /* DoH specific data for this request */
|
||||||
|
#endif
|
||||||
|
unsigned char setcookies;
|
||||||
|
+ unsigned char writer_stack_depth; /* Unencoding stack depth. */
|
||||||
|
BIT(header); /* incoming data has HTTP header */
|
||||||
|
BIT(content_range); /* set TRUE if Content-Range: was found */
|
||||||
|
BIT(upload_done); /* set to TRUE when doing chunked transfer-encoding
|
||||||
|
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
|
||||||
|
index f57f45e..5b943ab 100644
|
||||||
|
--- a/tests/data/Makefile.inc
|
||||||
|
+++ b/tests/data/Makefile.inc
|
||||||
|
@@ -65,7 +65,7 @@ test393 test394 test395 \
|
||||||
|
\
|
||||||
|
test400 test401 test402 test403 test404 test405 test406 test407 test408 \
|
||||||
|
test409 \
|
||||||
|
-\
|
||||||
|
+test418 \
|
||||||
|
test430 test431 test432 \
|
||||||
|
\
|
||||||
|
test490 test491 test492 \
|
||||||
|
diff --git a/tests/data/test418 b/tests/data/test418
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..50e974e
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/data/test418
|
||||||
|
@@ -0,0 +1,152 @@
|
||||||
|
+<testcase>
|
||||||
|
+<info>
|
||||||
|
+<keywords>
|
||||||
|
+HTTP
|
||||||
|
+gzip
|
||||||
|
+</keywords>
|
||||||
|
+</info>
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# Server-side
|
||||||
|
+<reply>
|
||||||
|
+<data nocheck="yes">
|
||||||
|
+HTTP/1.1 200 OK
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+Transfer-Encoding: gzip
|
||||||
|
+
|
||||||
|
+-foo-
|
||||||
|
+</data>
|
||||||
|
+</reply>
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# Client-side
|
||||||
|
+<client>
|
||||||
|
+<server>
|
||||||
|
+http
|
||||||
|
+</server>
|
||||||
|
+ <name>
|
||||||
|
+Response with multiple Transfer-Encoding headers
|
||||||
|
+ </name>
|
||||||
|
+ <command>
|
||||||
|
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
|
||||||
|
+</command>
|
||||||
|
+</client>
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# Verify data after the test has been "shot"
|
||||||
|
+<verify>
|
||||||
|
+<protocol crlf="yes">
|
||||||
|
+GET /%TESTNUMBER HTTP/1.1
|
||||||
|
+Host: %HOSTIP:%HTTPPORT
|
||||||
|
+User-Agent: curl/%VERSION
|
||||||
|
+Accept: */*
|
||||||
|
+
|
||||||
|
+</protocol>
|
||||||
|
+
|
||||||
|
+# CURLE_BAD_CONTENT_ENCODING is 61
|
||||||
|
+<errorcode>
|
||||||
|
+61
|
||||||
|
+</errorcode>
|
||||||
|
+<stderr mode="text">
|
||||||
|
+curl: (61) Reject response due to more than 5 content encodings
|
||||||
|
+</stderr>
|
||||||
|
+</verify>
|
||||||
|
+</testcase>
|
||||||
|
--
|
||||||
|
2.27.0
|
||||||
@ -6,7 +6,7 @@
|
|||||||
|
|
||||||
Name: curl
|
Name: curl
|
||||||
Version: 7.71.1
|
Version: 7.71.1
|
||||||
Release: 20
|
Release: 21
|
||||||
Summary: Curl is used in command lines or scripts to transfer data
|
Summary: Curl is used in command lines or scripts to transfer data
|
||||||
License: MIT
|
License: MIT
|
||||||
URL: https://curl.haxx.se/
|
URL: https://curl.haxx.se/
|
||||||
@ -50,6 +50,7 @@ Patch136: backport-fix-configure-disable-http-auth-build-error.patch
|
|||||||
Patch137: backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch
|
Patch137: backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch
|
||||||
Patch138: backport-CVE-2022-32221.patch
|
Patch138: backport-CVE-2022-32221.patch
|
||||||
Patch139: backport-CVE-2022-43552-smb-telnet-do-not-free-the-protocol-struct-in-_done.patch
|
Patch139: backport-CVE-2022-43552-smb-telnet-do-not-free-the-protocol-struct-in-_done.patch
|
||||||
|
Patch140: backport-CVE-2023-23916.patch
|
||||||
|
|
||||||
BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel
|
BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel
|
||||||
BuildRequires: libidn2-devel libnghttp2-devel libpsl-devel
|
BuildRequires: libidn2-devel libnghttp2-devel libpsl-devel
|
||||||
@ -191,6 +192,12 @@ rm -rf ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
|
|||||||
%{_mandir}/man3/*
|
%{_mandir}/man3/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Sat Feb 18 2023 xinghe <xinghe2@h-partners.com> - 7.71.1-21
|
||||||
|
- Type:cves
|
||||||
|
- CVE:CVE-2023-23916
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:fix CVE-2023-23916
|
||||||
|
|
||||||
* Wed Dec 28 2022 zhouyihang <zhouyihang3@h-partners.com> - 7.71.1-20
|
* Wed Dec 28 2022 zhouyihang <zhouyihang3@h-partners.com> - 7.71.1-20
|
||||||
- Type:cves
|
- Type:cves
|
||||||
- CVE:CVE-2022-43552
|
- CVE:CVE-2022-43552
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user