path: root/curl-7.15.5-CVE-2013-2174.patch

From ab181f4e1116322b13db55969fc5162e6a7c0114 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sat, 4 Aug 2007 20:47:59 +0000
Subject: [PATCH 1/4] Patrick Monnerat fixed curl_easy_escape() and curlx_strtoll() to work on non-ASCII systems.

[upstream commit 1926f4573d43f35f33b524d120e847ea819cc7c7]

Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
 lib/escape.c |   29 ++++++++++++++++++++++-------
 1 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/lib/escape.c b/lib/escape.c
index 18ae2e1..e0e696a 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -75,9 +75,27 @@ char *curl_easy_escape(CURL *handle, const char *string, int inlength)
   length = alloc-1;
   while(length--) {
     in = *string;
-    if(!(in >= 'a' && in <= 'z') &&
-       !(in >= 'A' && in <= 'Z') &&
-       !(in >= '0' && in <= '9')) {
+
+    /* Portable character check (remember EBCDIC). Do not use isalnum() because
+       its behavior is altered by the current locale. */
+
+    switch (in) {
+    case '0': case '1': case '2': case '3': case '4':
+    case '5': case '6': case '7': case '8': case '9':
+    case 'a': case 'b': case 'c': case 'd': case 'e':
+    case 'f': case 'g': case 'h': case 'i': case 'j':
+    case 'k': case 'l': case 'm': case 'n': case 'o':
+    case 'p': case 'q': case 'r': case 's': case 't':
+    case 'u': case 'v': case 'w': case 'x': case 'y': case 'z':
+    case 'A': case 'B': case 'C': case 'D': case 'E':
+    case 'F': case 'G': case 'H': case 'I': case 'J':
+    case 'K': case 'L': case 'M': case 'N': case 'O':
+    case 'P': case 'Q': case 'R': case 'S': case 'T':
+    case 'U': case 'V': case 'W': case 'X': case 'Y': case 'Z':
+      /* just copy this */
+      ns[strindex++]=in;
+      break;
+    default:
       /* encode it */
       newlen += 2; /* the size grows with two, since this'll become a %XX */
       if(newlen > alloc) {
@@ -105,10 +123,7 @@ char *curl_easy_escape(CURL *handle, const char *string, int inlength)
       snprintf(&ns[strindex], 4, "%%%02X", in);
 
       strindex+=3;
-    }
-    else {
-      /* just copy this */
-      ns[strindex++]=in;
+      break;
     }
     string++;
   }
-- 
1.7.1


From e2a98feff68c5ccc7c5de901f460860fc1b7ca95 Mon Sep 17 00:00:00 2001
From: Dan Fandrich <dan@coneharvesters.com>
Date: Tue, 9 Sep 2008 21:15:50 +0000
Subject: [PATCH 2/4] Factored out Curl_isalnum

[upstream commit c98ab69cc7aae688db604bbaad5bcc8d3fe25cba]

Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
 lib/escape.c |   47 +++++++++++++++++++++++++++--------------------
 1 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/lib/escape.c b/lib/escape.c
index e0e696a..868d56a 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -42,6 +42,30 @@
 /* The last #include file should be: */
 #include "memdebug.h"
 
+/* Portable character check (remember EBCDIC). Do not use isalnum() because
+its behavior is altered by the current locale. */
+static bool Curl_isalnum(unsigned char in)
+{
+  switch (in) {
+    case '0': case '1': case '2': case '3': case '4':
+    case '5': case '6': case '7': case '8': case '9':
+    case 'a': case 'b': case 'c': case 'd': case 'e':
+    case 'f': case 'g': case 'h': case 'i': case 'j':
+    case 'k': case 'l': case 'm': case 'n': case 'o':
+    case 'p': case 'q': case 'r': case 's': case 't':
+    case 'u': case 'v': case 'w': case 'x': case 'y': case 'z':
+    case 'A': case 'B': case 'C': case 'D': case 'E':
+    case 'F': case 'G': case 'H': case 'I': case 'J':
+    case 'K': case 'L': case 'M': case 'N': case 'O':
+    case 'P': case 'Q': case 'R': case 'S': case 'T':
+    case 'U': case 'V': case 'W': case 'X': case 'Y': case 'Z':
+      return TRUE;
+    default:
+      break;
+  }
+  return FALSE;
+}
+
 /* for ABI-compatibility with previous versions */
 char *curl_escape(const char *string, int inlength)
 {
@@ -76,26 +100,10 @@ char *curl_easy_escape(CURL *handle, const char *string, int inlength)
   while(length--) {
     in = *string;
 
-    /* Portable character check (remember EBCDIC). Do not use isalnum() because
-       its behavior is altered by the current locale. */
-
-    switch (in) {
-    case '0': case '1': case '2': case '3': case '4':
-    case '5': case '6': case '7': case '8': case '9':
-    case 'a': case 'b': case 'c': case 'd': case 'e':
-    case 'f': case 'g': case 'h': case 'i': case 'j':
-    case 'k': case 'l': case 'm': case 'n': case 'o':
-    case 'p': case 'q': case 'r': case 's': case 't':
-    case 'u': case 'v': case 'w': case 'x': case 'y': case 'z':
-    case 'A': case 'B': case 'C': case 'D': case 'E':
-    case 'F': case 'G': case 'H': case 'I': case 'J':
-    case 'K': case 'L': case 'M': case 'N': case 'O':
-    case 'P': case 'Q': case 'R': case 'S': case 'T':
-    case 'U': case 'V': case 'W': case 'X': case 'Y': case 'Z':
+    if (Curl_isalnum(in)) {
       /* just copy this */
       ns[strindex++]=in;
-      break;
-    default:
+    } else {
       /* encode it */
       newlen += 2; /* the size grows with two, since this'll become a %XX */
       if(newlen > alloc) {
@@ -123,7 +131,6 @@ char *curl_easy_escape(CURL *handle, const char *string, int inlength)
       snprintf(&ns[strindex], 4, "%%%02X", in);
 
       strindex+=3;
-      break;
     }
     string++;
   }
@@ -191,7 +198,7 @@ char *curl_easy_unescape(CURL *handle, const char *string, int length,
 }
 
 /* For operating systems/environments that use different malloc/free
-   ssystems for the app and for this library, we provide a free that uses
+   systems for the app and for this library, we provide a free that uses
    the library's memory system */
 void curl_free(void *p)
 {
-- 
1.7.1


From 97aff30c56bde0d8a07ed3eadad5fa6b6bfd07eb Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 28 Sep 2010 23:46:14 +0200
Subject: [PATCH 3/4] curl_easy_escape: don't escape "unreserved" characters

According to RFC3986 section 2.3 the letters -, ., _ and ~ should not be
percent-encoded.

Reported by: Miguel Diaz
Bug: http://curl.haxx.se/mail/lib-2010-09/0227.html

[upstream commit 5df13c31735fa089d5344fde13b66ace1ea473d1]

Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
 lib/escape.c      |    9 ++++++---
 tests/data/test58 |    2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/lib/escape.c b/lib/escape.c
index 868d56a..e759607 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -43,8 +43,10 @@
 #include "memdebug.h"
 
 /* Portable character check (remember EBCDIC). Do not use isalnum() because
-its behavior is altered by the current locale. */
-static bool Curl_isalnum(unsigned char in)
+   its behavior is altered by the current locale.
+   See http://tools.ietf.org/html/rfc3986#section-2.3
+*/
+static bool Curl_isunreserved(unsigned char in)
 {
   switch (in) {
     case '0': case '1': case '2': case '3': case '4':
@@ -59,6 +61,7 @@ static bool Curl_isalnum(unsigned char in)
     case 'K': case 'L': case 'M': case 'N': case 'O':
     case 'P': case 'Q': case 'R': case 'S': case 'T':
     case 'U': case 'V': case 'W': case 'X': case 'Y': case 'Z':
+    case '-': case '.': case '_': case '~':
       return TRUE;
     default:
       break;
@@ -100,7 +103,7 @@ char *curl_easy_escape(CURL *handle, const char *string, int inlength)
   while(length--) {
     in = *string;
 
-    if (Curl_isalnum(in)) {
+    if (Curl_isunreserved(in)) {
       /* just copy this */
       ns[strindex++]=in;
     } else {
diff --git a/tests/data/test58 b/tests/data/test58
index 32d7731..7b85b0b 100644
--- a/tests/data/test58
+++ b/tests/data/test58
@@ -38,7 +38,7 @@ a few bytes
 ^User-Agent:.*
 </strip>
 <protocol>
-PUT /we/want/58te%5B%5Dst%2Etxt HTTP/1.1
+PUT /we/want/58te%5B%5Dst.txt HTTP/1.1
 Host: 127.0.0.1:%HTTPPORT
 Accept: */*
 Content-Length: 12
-- 
1.7.1


From a2ea27383a6028604540ce6f2e2f6bbc34bd7d5e Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sun, 19 May 2013 23:24:29 +0200
Subject: [PATCH 4/4] Curl_urldecode: no peaking beyond end of input buffer

Security problem: CVE-2013-2174

If a program would give a string like "%" to curl_easy_unescape(), it
would still consider the % as start of an encoded character. The
function then not only read beyond the buffer but it would also deduct
the *unsigned* counter variable for how many more bytes there's left to
read in the buffer by two, making the counter wrap. Continuing this, the
function would go on reading beyond the buffer and soon writing beyond
the allocated target buffer...

Reported-by: Timo Sirainen

Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
 lib/escape.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/lib/escape.c b/lib/escape.c
index e759607..c891a22 100644
--- a/lib/escape.c
+++ b/lib/escape.c
@@ -163,7 +163,7 @@ char *curl_easy_unescape(CURL *handle, const char *string, int length,
 
   while(--alloc > 0) {
     in = *string;
-    if(('%' == in) && ishex(string[1]) && ishex(string[2])) {
+    if(('%' == in) && (alloc > 2) && ishex(string[1]) && ishex(string[2])) {
       /* this is two hexadecimal digits following a '%' */
       char hexstr[3];
       char *ptr;
-- 
1.7.1