From c8827bfaddac53f9f1c878c80cf6e062a30fa662 Mon Sep 17 00:00:00 2001
From: sherlock2010 <15151851377@163.com>
Date: Thu, 1 Sep 2022 14:45:00 +0800
Subject: [PATCH] CVE-2022-35252

(cherry picked from commit ae367a79d76928d7dd3d9b24df1ee5a07afa8d80)
---
 ...ie-reject-cookies-with-control-bytes.patch | 68 +++++++++++++++++++
 curl.spec                                     |  9 ++-
 2 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch

diff --git a/backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch b/backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch
new file mode 100644
index 0000000..58c4031
--- /dev/null
+++ b/backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch
@@ -0,0 +1,68 @@
+From 8dfc93e573ca740544a2d79ebb0ed786592c65c3 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 29 Aug 2022 00:09:17 +0200
+Subject: [PATCH] cookie: reject cookies with "control bytes"
+
+Rejects 0x01 - 0x1f (except 0x09) plus 0x7f
+
+Reported-by: Axel Chong
+
+Bug: https://curl.se/docs/CVE-2022-35252.html
+
+CVE-2022-35252
+
+Closes #9381
+---
+ lib/cookie.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 5a4d9e9..ab790a1 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -442,6 +442,30 @@ static bool bad_domain(const char *domain)
+ }
+ 
+ /*
++  RFC 6265 section 4.1.1 says a server should accept this range:
++
++  cookie-octet    = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
++
++  But Firefox and Chrome as of June 2022 accept space, comma and double-quotes
++  fine. The prime reason for filtering out control bytes is that some HTTP
++  servers return 400 for requests that contain such.
++*/
++static int invalid_octets(const char *p)
++{
++  /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */
++  static const char badoctets[] = {
++    "\x01\x02\x03\x04\x05\x06\x07\x08\x0a"
++    "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
++    "\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x7f"
++  };
++  size_t vlen, len;
++  /* scan for all the octets that are *not* in cookie-octet */
++  len = strcspn(p, badoctets);
++  vlen = strlen(p);
++  return (len != vlen);
++}
++
++/*
+  * Curl_cookie_add
+  *
+  * Add a single cookie line to the cookie keeping object. Be aware that
+@@ -595,6 +619,11 @@ Curl_cookie_add(struct Curl_easy *data,
+             badcookie = TRUE;
+             break;
+           }
++          if(invalid_octets(whatptr) || invalid_octets(name)) {
++            infof(data, "invalid octets in name/value, cookie dropped");
++            badcookie = TRUE;
++            break;
++          }
+         }
+         else if(!len) {
+           /*
+-- 
+1.8.3.1
+
diff --git a/curl.spec b/curl.spec
index f420553..af618be 100644
--- a/curl.spec
+++ b/curl.spec
@@ -6,7 +6,7 @@
 
 Name:           curl
 Version:        7.79.1
-Release:        9
+Release:        10
 Summary:        Curl is used in command lines or scripts to transfer data
 License:        MIT
 URL:            https://curl.haxx.se/
@@ -27,6 +27,7 @@ Patch12:        backport-CVE-2022-32206.patch
 Patch13:        backport-CVE-2022-32207.patch
 Patch14:        backport-CVE-2022-32208.patch
 Patch15:        backport-fix-configure-disable-http-auth-build-error.patch
+Patch16:        backport-CVE-2022-35252-cookie-reject-cookies-with-control-bytes.patch
 
 BuildRequires:  automake brotli-devel coreutils gcc groff krb5-devel
 BuildRequires:  libidn2-devel libnghttp2-devel libpsl-devel
@@ -201,6 +202,12 @@ rm -rf ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 %{_mandir}/man3/*
 
 %changelog
+* Thu Sep 01 2022 zhouyihang <zhouyihang@h-partners.com> - 7.79.1-10
+- Type:cves
+- CVE:CVE-2022-35252
+- SUG:NA
+- DESC:fix CVE-2022-35252
+
 * Thu Jul 28 2022 gaihuiying <eaglegai@163.com> - 7.79.1-9
 - Type:bugfix
 - CVE:NA