author | Rich Burridge <rich.burridge@oracle.com> |
Fri, 09 Jan 2015 13:31:17 -0800 | |
branch | s11u2-sru |
changeset 3610 | 70f156a82910 |
permissions | -rw-r--r-- |
3610
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
1 |
From 4e2ac2afa94f014a2a015c48c678e2367a63ae82 Mon Sep 17 00:00:00 2001 |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
2 |
From: Daniel Stenberg <[email protected]> |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
3 |
Date: Thu, 25 Dec 2014 23:55:03 +0100 |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
4 |
Subject: [PATCH] url-parsing: reject CRLFs within URLs |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
5 |
|
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
6 |
Bug: http://curl.haxx.se/docs/adv_20150108B.html |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
7 |
Reported-by: Andrey Labunets |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
8 |
--- |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
9 |
lib/url.c | 7 +++++++ |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
10 |
1 file changed, 7 insertions(+) |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
11 |
|
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
12 |
This fix is already available upstream in curl version 7.40.0 |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
13 |
|
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
14 |
--- lib/url.c.orig 2015-01-05 17:12:46.302124082 -0800 |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
15 |
+++ lib/url.c 2015-01-05 17:13:15.299976184 -0800 |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
16 |
@@ -3545,6 +3545,13 @@ |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
17 |
|
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
18 |
*prot_missing = FALSE; |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
19 |
|
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
20 |
+ /* We might pass the entire URL into the request so we need to make sure |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
21 |
+ * there are no bad characters in there.*/ |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
22 |
+ if(strpbrk(data->change.url, "\r\n")) { |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
23 |
+ failf(data, "Illegal characters found in URL"); |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
24 |
+ return CURLE_URL_MALFORMAT; |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
25 |
+ } |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
26 |
+ |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
27 |
/************************************************************* |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
28 |
* Parse the URL. |
70f156a82910
20306105 problem in LIBRARY/CURL
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
29 |
* |