package/network/utils/curl/patches/101-CVE-2017-7407.patch

   1 From 6019f1795b4e3b72507b84b0e02dc8c32024f562 Mon Sep 17 00:00:00 2001
   2 From: Dan Fandrich <dan@coneharvesters.com>
   3 Date: Sat, 11 Mar 2017 10:59:34 +0100
   4 Subject: [PATCH] CVE-2017-7407: fixed
   5
   6 Bug: https://curl.haxx.se/docs/adv_20170403.html
   7
   8 Reported-by: Brian Carpenter
   9 ---
  10  src/tool_writeout.c     |  6 +++---
  11  tests/data/Makefile.inc |  2 +-
  12  tests/data/test1440     | 31 +++++++++++++++++++++++++++++++
  13  tests/data/test1441     | 31 +++++++++++++++++++++++++++++++
  14  tests/data/test1442     | 35 +++++++++++++++++++++++++++++++++++
  15  5 files changed, 101 insertions(+), 4 deletions(-)
  16  create mode 100644 tests/data/test1440
  17  create mode 100644 tests/data/test1441
  18  create mode 100644 tests/data/test1442
  19
  20 --- a/src/tool_writeout.c
  21 +++ b/src/tool_writeout.c
  22 @@ -5,7 +5,7 @@
  23   *                            | (__| |_| |  _ <| |___
  24   *                             \___|\___/|_| \_\_____|
  25   *
  26 - * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
  27 + * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
  28   *
  29   * This software is licensed as described in the file COPYING, which
  30   * you should have received as part of this distribution. The terms
  31 @@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutS
  32    double doubleinfo;
  33
  34    while(ptr && *ptr) {
  35 -    if('%' == *ptr) {
  36 +    if('%' == *ptr && ptr[1]) {
  37        if('%' == ptr[1]) {
  38          /* an escaped %-letter */
  39          fputc('%', stream);
  40 @@ -341,7 +341,7 @@ void ourWriteOut(CURL *curl, struct OutS
  41          }
  42        }
  43      }
  44 -    else if('\\' == *ptr) {
  45 +    else if('\\' == *ptr && ptr[1]) {
  46        switch(ptr[1]) {
  47        case 'r':
  48          fputc('\r', stream);
  49 --- a/tests/data/Makefile.inc
  50 +++ b/tests/data/Makefile.inc
  51 @@ -150,7 +150,7 @@ test1408 test1409 test1410 test1411 test
  52  test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \
  53  test1424 \
  54  test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \
  55 -test1436 test1437 test1438 test1439 \
  56 +test1436 test1437 test1438 test1439 test1440 test1441 test1442 \
  57  \
  58  test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
  59  test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
  60 --- /dev/null
  61 +++ b/tests/data/test1440
  62 @@ -0,0 +1,31 @@
  63 +<testcase>
  64 +<info>
  65 +<keywords>
  66 +--write-out
  67 +</keywords>
  68 +</info>
  69 +# Server-side
  70 +<reply>
  71 +</reply>
  72 +
  73 +# Client-side
  74 +<client>
  75 +<server>
  76 +file
  77 +</server>
  78 +
  79 +<name>
  80 +Check --write-out with trailing %{
  81 +</name>
  82 +<command>
  83 +file://localhost/%PWD/log/ --write-out '%{'
  84 +</command>
  85 +</client>
  86 +
  87 +# Verify data
  88 +<verify>
  89 +<stdout nonewline="yes">
  90 +%{
  91 +</stdout>
  92 +</verify>
  93 +</testcase>
  94 --- /dev/null
  95 +++ b/tests/data/test1441
  96 @@ -0,0 +1,31 @@
  97 +<testcase>
  98 +<info>
  99 +<keywords>
 100 +--write-out
 101 +</keywords>
 102 +</info>
 103 +# Server-side
 104 +<reply>
 105 +</reply>
 106 +
 107 +# Client-side
 108 +<client>
 109 +<server>
 110 +file
 111 +</server>
 112 +
 113 +<name>
 114 +Check --write-out with trailing %
 115 +</name>
 116 +<command>
 117 +file://localhost/%PWD/log/ --write-out '%'
 118 +</command>
 119 +</client>
 120 +
 121 +# Verify data
 122 +<verify>
 123 +<stdout nonewline="yes">
 124 +%
 125 +</stdout>
 126 +</verify>
 127 +</testcase>
 128 --- /dev/null
 129 +++ b/tests/data/test1442
 130 @@ -0,0 +1,35 @@
 131 +<testcase>
 132 +<info>
 133 +<keywords>
 134 +--write-out
 135 +FILE
 136 +</keywords>
 137 +</info>
 138 +# Server-side
 139 +<reply>
 140 +</reply>
 141 +
 142 +# Client-side
 143 +<client>
 144 +<server>
 145 +file
 146 +</server>
 147 +
 148 +<name>
 149 +Check --write-out with trailing \
 150 +</name>
 151 +<command>
 152 +file://localhost/%PWD/log/non-existent-file.txt --write-out '\'
 153 +</command>
 154 +</client>
 155 +
 156 +# Verify data
 157 +<verify>
 158 +<errorcode>
 159 +37
 160 +</errorcode>
 161 +<stdout nonewline="yes">
 162 +\
 163 +</stdout>
 164 +</verify>
 165 +</testcase>