!23 fix CVE-2020-8231
From: @bitcoffee Reviewed-by: @seuzw Signed-off-by: @seuzw
This commit is contained in:
openeuler-ci-bot
Gitee
commit
f1e9383a65
112
0107-curl-close-unused-connect-only-connections.patch
Normal file
112
0107-curl-close-unused-connect-only-connections.patch
Normal file
@ -0,0 +1,112 @@
|
|||||||
|
From d5bb459ccf1fc5980ae4b95c05b4ecf6454a7599 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Marc Aldorasi <marc@groundctl.com>
|
||||||
|
Date: Thu, 30 Jul 2020 14:16:17 -0400
|
||||||
|
Subject: [PATCH] multi_remove_handle: close unused connect-only connections
|
||||||
|
|
||||||
|
Previously any connect-only connections in a multi handle would be kept
|
||||||
|
alive until the multi handle was closed. Since these connections cannot
|
||||||
|
be re-used, they can be marked for closure when the associated easy
|
||||||
|
handle is removed from the multi handle.
|
||||||
|
|
||||||
|
Closes #5749
|
||||||
|
---
|
||||||
|
lib/multi.c | 34 ++++++++++++++++++++++++++++++----
|
||||||
|
tests/data/test1554 | 6 ++++++
|
||||||
|
2 files changed, 36 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/multi.c b/lib/multi.c
|
||||||
|
index 6b62ddaf7..1c3be72fe 100644
|
||||||
|
--- a/lib/multi.c
|
||||||
|
+++ b/lib/multi.c
|
||||||
|
@@ -689,6 +689,26 @@ static CURLcode multi_done(struct Curl_easy *data,
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int close_connect_only(struct connectdata *conn, void *param)
|
||||||
|
+{
|
||||||
|
+ struct Curl_easy *data = param;
|
||||||
|
+
|
||||||
|
+ if(data->state.lastconnect != conn)
|
||||||
|
+ return 0;
|
||||||
|
+
|
||||||
|
+ if(conn->data != data)
|
||||||
|
+ return 1;
|
||||||
|
+ conn->data = NULL;
|
||||||
|
+
|
||||||
|
+ if(!conn->bits.connect_only)
|
||||||
|
+ return 1;
|
||||||
|
+
|
||||||
|
+ connclose(conn, "Removing connect-only easy handle");
|
||||||
|
+ conn->bits.connect_only = FALSE;
|
||||||
|
+
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
|
||||||
|
struct Curl_easy *data)
|
||||||
|
{
|
||||||
|
@@ -776,10 +796,6 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
|
||||||
|
multi_done() as that may actually call Curl_expire that uses this */
|
||||||
|
Curl_llist_destroy(&data->state.timeoutlist, NULL);
|
||||||
|
|
||||||
|
- /* as this was using a shared connection cache we clear the pointer to that
|
||||||
|
- since we're not part of that multi handle anymore */
|
||||||
|
- data->state.conn_cache = NULL;
|
||||||
|
-
|
||||||
|
/* change state without using multistate(), only to make singlesocket() do
|
||||||
|
what we want */
|
||||||
|
data->mstate = CURLM_STATE_COMPLETED;
|
||||||
|
@@ -789,12 +805,22 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
|
||||||
|
/* Remove the association between the connection and the handle */
|
||||||
|
Curl_detach_connnection(data);
|
||||||
|
|
||||||
|
+ if(data->state.lastconnect) {
|
||||||
|
+ /* Mark any connect-only connection for closure */
|
||||||
|
+ Curl_conncache_foreach(data, data->state.conn_cache,
|
||||||
|
+ data, &close_connect_only);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
#ifdef USE_LIBPSL
|
||||||
|
/* Remove the PSL association. */
|
||||||
|
if(data->psl == &multi->psl)
|
||||||
|
data->psl = NULL;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+ /* as this was using a shared connection cache we clear the pointer to that
|
||||||
|
+ since we're not part of that multi handle anymore */
|
||||||
|
+ data->state.conn_cache = NULL;
|
||||||
|
+
|
||||||
|
data->multi = NULL; /* clear the association to this multi handle */
|
||||||
|
|
||||||
|
/* make sure there's no pending message in the queue sent from this easy
|
||||||
|
diff --git a/tests/data/test1554 b/tests/data/test1554
|
||||||
|
index d3926d916..fffa6adb5 100644
|
||||||
|
--- a/tests/data/test1554
|
||||||
|
+++ b/tests/data/test1554
|
||||||
|
@@ -50,6 +50,8 @@ run 1: foobar and so on fun!
|
||||||
|
<- Mutex unlock
|
||||||
|
-> Mutex lock
|
||||||
|
<- Mutex unlock
|
||||||
|
+-> Mutex lock
|
||||||
|
+<- Mutex unlock
|
||||||
|
run 1: foobar and so on fun!
|
||||||
|
-> Mutex lock
|
||||||
|
<- Mutex unlock
|
||||||
|
@@ -65,6 +67,8 @@ run 1: foobar and so on fun!
|
||||||
|
<- Mutex unlock
|
||||||
|
-> Mutex lock
|
||||||
|
<- Mutex unlock
|
||||||
|
+-> Mutex lock
|
||||||
|
+<- Mutex unlock
|
||||||
|
run 1: foobar and so on fun!
|
||||||
|
-> Mutex lock
|
||||||
|
<- Mutex unlock
|
||||||
|
@@ -74,6 +78,8 @@ run 1: foobar and so on fun!
|
||||||
|
<- Mutex unlock
|
||||||
|
-> Mutex lock
|
||||||
|
<- Mutex unlock
|
||||||
|
+-> Mutex lock
|
||||||
|
+<- Mutex unlock
|
||||||
|
</datacheck>
|
||||||
|
</reply>
|
||||||
|
|
||||||
155
0108-curl-fix-CVE-2020-8231.patch
Normal file
155
0108-curl-fix-CVE-2020-8231.patch
Normal file
@ -0,0 +1,155 @@
|
|||||||
|
From 3c9e021f86872baae412a427e807fbfa2f3e8a22 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daniel Stenberg <daniel@haxx.se>
|
||||||
|
Date: Sun, 16 Aug 2020 11:34:35 +0200
|
||||||
|
Subject: [PATCH] Curl_easy: remember last connection by id, not by pointer
|
||||||
|
|
||||||
|
CVE-2020-8231
|
||||||
|
|
||||||
|
Bug: https://curl.haxx.se/docs/CVE-2020-8231.html
|
||||||
|
|
||||||
|
Reported-by: Marc Aldorasi
|
||||||
|
Closes #5824
|
||||||
|
---
|
||||||
|
lib/connect.c | 19 ++++++++++---------
|
||||||
|
lib/easy.c | 3 +--
|
||||||
|
lib/multi.c | 9 +++++----
|
||||||
|
lib/url.c | 2 +-
|
||||||
|
lib/urldata.h | 2 +-
|
||||||
|
5 files changed, 18 insertions(+), 17 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/connect.c b/lib/connect.c
|
||||||
|
index 313c23315..b000b1b2c 100644
|
||||||
|
--- a/lib/connect.c
|
||||||
|
+++ b/lib/connect.c
|
||||||
|
@@ -1363,15 +1363,15 @@ CURLcode Curl_connecthost(struct connectdata *conn, /* context */
|
||||||
|
}
|
||||||
|
|
||||||
|
struct connfind {
|
||||||
|
- struct connectdata *tofind;
|
||||||
|
- bool found;
|
||||||
|
+ long id_tofind;
|
||||||
|
+ struct connectdata *found;
|
||||||
|
};
|
||||||
|
|
||||||
|
static int conn_is_conn(struct connectdata *conn, void *param)
|
||||||
|
{
|
||||||
|
struct connfind *f = (struct connfind *)param;
|
||||||
|
- if(conn == f->tofind) {
|
||||||
|
- f->found = TRUE;
|
||||||
|
+ if(conn->connection_id == f->id_tofind) {
|
||||||
|
+ f->found = conn;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
@@ -1393,21 +1393,22 @@ curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,
|
||||||
|
* - that is associated with a multi handle, and whose connection
|
||||||
|
* was detached with CURLOPT_CONNECT_ONLY
|
||||||
|
*/
|
||||||
|
- if(data->state.lastconnect && (data->multi_easy || data->multi)) {
|
||||||
|
- struct connectdata *c = data->state.lastconnect;
|
||||||
|
+ if((data->state.lastconnect_id != -1) && (data->multi_easy || data->multi)) {
|
||||||
|
+ struct connectdata *c;
|
||||||
|
struct connfind find;
|
||||||
|
- find.tofind = data->state.lastconnect;
|
||||||
|
- find.found = FALSE;
|
||||||
|
+ find.id_tofind = data->state.lastconnect_id;
|
||||||
|
+ find.found = NULL;
|
||||||
|
|
||||||
|
Curl_conncache_foreach(data, data->multi_easy?
|
||||||
|
&data->multi_easy->conn_cache:
|
||||||
|
&data->multi->conn_cache, &find, conn_is_conn);
|
||||||
|
|
||||||
|
if(!find.found) {
|
||||||
|
- data->state.lastconnect = NULL;
|
||||||
|
+ data->state.lastconnect_id = -1;
|
||||||
|
return CURL_SOCKET_BAD;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ c = find.found;
|
||||||
|
if(connp) {
|
||||||
|
/* only store this if the caller cares for it */
|
||||||
|
*connp = c;
|
||||||
|
diff --git a/lib/easy.c b/lib/easy.c
|
||||||
|
index 292cca7f6..a69eb9e56 100644
|
||||||
|
--- a/lib/easy.c
|
||||||
|
+++ b/lib/easy.c
|
||||||
|
@@ -838,8 +838,7 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data)
|
||||||
|
|
||||||
|
/* the connection cache is setup on demand */
|
||||||
|
outcurl->state.conn_cache = NULL;
|
||||||
|
-
|
||||||
|
- outcurl->state.lastconnect = NULL;
|
||||||
|
+ outcurl->state.lastconnect_id = -1;
|
||||||
|
|
||||||
|
outcurl->progress.flags = data->progress.flags;
|
||||||
|
outcurl->progress.callback = data->progress.callback;
|
||||||
|
diff --git a/lib/multi.c b/lib/multi.c
|
||||||
|
index b3a75e137..3c7fb85ed 100644
|
||||||
|
--- a/lib/multi.c
|
||||||
|
+++ b/lib/multi.c
|
||||||
|
@@ -455,6 +455,7 @@ CURLMcode curl_multi_add_handle(struct Curl_multi *multi,
|
||||||
|
data->state.conn_cache = &data->share->conn_cache;
|
||||||
|
else
|
||||||
|
data->state.conn_cache = &multi->conn_cache;
|
||||||
|
+ data->state.lastconnect_id = -1;
|
||||||
|
|
||||||
|
#ifdef USE_LIBPSL
|
||||||
|
/* Do the same for PSL. */
|
||||||
|
@@ -677,11 +678,11 @@ static CURLcode multi_done(struct Curl_easy *data,
|
||||||
|
CONNCACHE_UNLOCK(data);
|
||||||
|
if(Curl_conncache_return_conn(data, conn)) {
|
||||||
|
/* remember the most recently used connection */
|
||||||
|
- data->state.lastconnect = conn;
|
||||||
|
+ data->state.lastconnect_id = conn->connection_id;
|
||||||
|
infof(data, "%s\n", buffer);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
- data->state.lastconnect = NULL;
|
||||||
|
+ data->state.lastconnect_id = -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
Curl_safefree(data->state.buffer);
|
||||||
|
@@ -693,7 +694,7 @@ static int close_connect_only(struct connectdata *conn, void *param)
|
||||||
|
{
|
||||||
|
struct Curl_easy *data = param;
|
||||||
|
|
||||||
|
- if(data->state.lastconnect != conn)
|
||||||
|
+ if(data->state.lastconnect_id != conn->connection_id)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
if(conn->data != data)
|
||||||
|
@@ -805,7 +806,7 @@ CURLMcode curl_multi_remove_handle(struct Curl_multi *multi,
|
||||||
|
/* Remove the association between the connection and the handle */
|
||||||
|
Curl_detach_connnection(data);
|
||||||
|
|
||||||
|
- if(data->state.lastconnect) {
|
||||||
|
+ if(data->state.lastconnect_id != -1) {
|
||||||
|
/* Mark any connect-only connection for closure */
|
||||||
|
Curl_conncache_foreach(data, data->state.conn_cache,
|
||||||
|
data, &close_connect_only);
|
||||||
|
diff --git a/lib/url.c b/lib/url.c
|
||||||
|
index a98aab27f..150667aa9 100644
|
||||||
|
--- a/lib/url.c
|
||||||
|
+++ b/lib/url.c
|
||||||
|
@@ -630,7 +630,7 @@ CURLcode Curl_open(struct Curl_easy **curl)
|
||||||
|
Curl_initinfo(data);
|
||||||
|
|
||||||
|
/* most recent connection is not yet defined */
|
||||||
|
- data->state.lastconnect = NULL;
|
||||||
|
+ data->state.lastconnect_id = -1;
|
||||||
|
|
||||||
|
data->progress.flags |= PGRS_HIDE;
|
||||||
|
data->state.current_speed = -1; /* init to negative == impossible */
|
||||||
|
diff --git a/lib/urldata.h b/lib/urldata.h
|
||||||
|
index 8ddb580c8..0ae926927 100644
|
||||||
|
--- a/lib/urldata.h
|
||||||
|
+++ b/lib/urldata.h
|
||||||
|
@@ -1300,7 +1300,7 @@ struct UrlState {
|
||||||
|
/* buffers to store authentication data in, as parsed from input options */
|
||||||
|
struct curltime keeps_speed; /* for the progress meter really */
|
||||||
|
|
||||||
|
- struct connectdata *lastconnect; /* The last connection, NULL if undefined */
|
||||||
|
+ long lastconnect_id; /* The last connection, -1 if undefined */
|
||||||
|
struct dynbuf headerb; /* buffer to store headers in */
|
||||||
|
|
||||||
|
char *buffer; /* download buffer */
|
||||||
10
curl.spec
10
curl.spec
@ -6,7 +6,7 @@
|
|||||||
|
|
||||||
Name: curl
|
Name: curl
|
||||||
Version: 7.71.1
|
Version: 7.71.1
|
||||||
Release: 1
|
Release: 2
|
||||||
Summary: Curl is used in command lines or scripts to transfer data
|
Summary: Curl is used in command lines or scripts to transfer data
|
||||||
License: MIT
|
License: MIT
|
||||||
URL: https://curl.haxx.se/
|
URL: https://curl.haxx.se/
|
||||||
@ -17,6 +17,8 @@ Patch102: 0102-curl-7.36.0-debug.patch
|
|||||||
Patch104: 0104-curl-7.19.7-localhost6.patch
|
Patch104: 0104-curl-7.19.7-localhost6.patch
|
||||||
Patch105: 0105-curl-7.63.0-lib1560-valgrind.patch
|
Patch105: 0105-curl-7.63.0-lib1560-valgrind.patch
|
||||||
Patch106: 0106-curl-fix-CVE-2019-15601.patch
|
Patch106: 0106-curl-fix-CVE-2019-15601.patch
|
||||||
|
Patch107: 0107-curl-close-unused-connect-only-connections.patch
|
||||||
|
Patch108: 0108-curl-fix-CVE-2020-8231.patch
|
||||||
|
|
||||||
BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel
|
BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel
|
||||||
BuildRequires: libidn2-devel libmetalink-devel libnghttp2-devel libpsl-devel
|
BuildRequires: libidn2-devel libmetalink-devel libnghttp2-devel libpsl-devel
|
||||||
@ -157,6 +159,12 @@ rm -rf ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
|
|||||||
%{_mandir}/man3/*
|
%{_mandir}/man3/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Dec 28 2020 liuxin <liuxin264@huawei.com> - 7.71.1-2
|
||||||
|
- Type:cves
|
||||||
|
- ID:CVE-2020-8231
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:fix CVE-2020-8231
|
||||||
|
|
||||||
* Fri Jul 24 2020 zhujunhao <zhujunhao8@huawei.com> - 7.71.1-1
|
* Fri Jul 24 2020 zhujunhao <zhujunhao8@huawei.com> - 7.71.1-1
|
||||||
- Update to 7.71.1
|
- Update to 7.71.1
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user