69 lines
2.1 KiB
Diff
69 lines
2.1 KiB
Diff
From 13336408dacd26ee5ca3164037558c39da058135 Mon Sep 17 00:00:00 2001
|
|
From: xiaojiangfeng <xiaojiangfeng@huawei.com>
|
|
Date: Wed, 7 Sep 2022 20:22:02 +0800
|
|
Subject: [PATCH] [Backport] fix CVE-2022-35252 curl 7.78.0
|
|
|
|
Offering: RTOS
|
|
CVE: CVE-2022-35252
|
|
Reference: https://github.com/curl/curl/commit/8dfc93e573ca740544a2d79ebb0ed786592c65c3
|
|
DTS/AR: DTS2022090605556
|
|
type: LTS
|
|
reason: fix CVE-2022-35252 curl 7.78.0
|
|
|
|
(cherry picked from commit 8dfc93e573ca740544a2d79ebb0ed786592c65c3)
|
|
Signed-off-by: xiaojiangfeng <xiaojiangfeng@huawei.com>
|
|
---
|
|
lib/cookie.c | 29 +++++++++++++++++++++++++++++
|
|
1 file changed, 29 insertions(+)
|
|
|
|
diff --git a/lib/cookie.c b/lib/cookie.c
|
|
index 573edf657..9b8feefc5 100644
|
|
--- a/lib/cookie.c
|
|
+++ b/lib/cookie.c
|
|
@@ -430,6 +430,30 @@ static bool bad_domain(const char *domain)
|
|
return !strchr(domain, '.') && !strcasecompare(domain, "localhost");
|
|
}
|
|
|
|
+/*
|
|
+ RFC 6265 section 4.1.1 says a server should accept this range:
|
|
+
|
|
+ cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
|
|
+
|
|
+ But Firefox and Chrome as of June 2022 accept space, comma and double-quotes
|
|
+ fine. The prime reason for filtering out control bytes is that some HTTP
|
|
+ servers return 400 for requests that contain such.
|
|
+*/
|
|
+static int invalid_octets(const char *p)
|
|
+{
|
|
+ /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */
|
|
+ static const char badoctets[] = {
|
|
+ "\x01\x02\x03\x04\x05\x06\x07\x08\x0a"
|
|
+ "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
|
|
+ "\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x7f"
|
|
+ };
|
|
+ size_t vlen, len;
|
|
+ /* scan for all the octets that are *not* in cookie-octet */
|
|
+ len = strcspn(p, badoctets);
|
|
+ vlen = strlen(p);
|
|
+ return (len != vlen);
|
|
+}
|
|
+
|
|
/*
|
|
* Curl_cookie_add
|
|
*
|
|
@@ -582,6 +606,11 @@ Curl_cookie_add(struct Curl_easy *data,
|
|
badcookie = TRUE;
|
|
break;
|
|
}
|
|
+ if(invalid_octets(whatptr) || invalid_octets(name)) {
|
|
+ infof(data, "invalid octets in name/value, cookie dropped");
|
|
+ badcookie = TRUE;
|
|
+ break;
|
|
+ }
|
|
}
|
|
else if(!len) {
|
|
/*
|
|
--
|
|
2.35.1.windows.2
|
|
|