25241371 problem in LIBRARY/CURL
25241378 problem in LIBRARY/CURL
25241832 problem in LIBRARY/CURL
25241839 problem in LIBRARY/CURL
25241853 problem in LIBRARY/CURL
25241867 problem in LIBRARY/CURL
25241881 problem in LIBRARY/CURL
25241889 problem in LIBRARY/CURL
25241894 problem in LIBRARY/CURL
25241900 problem in LIBRARY/CURL
25306385 problem in LIBRARY/CURL
From 1620f552a277ed5b23a48b9c27dbf07663cac068 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <[email protected]>
Date: Tue, 27 Sep 2016 17:36:19 +0200
Subject: [PATCH] cookie: replace use of fgets() with custom version
... that will ignore lines that are too long to fit in the buffer.
CVE-2016-8615
Bug: https://curl.haxx.se/docs/adv_20161102A.html
Reported-by: Cure53
---
lib/cookie.c | 31 ++++++++++++++++++++++++++++++-
1 file changed, 30 insertions(+), 1 deletion(-)
--- lib/cookie.c
+++ lib/cookie.c
@@ -901,10 +901,39 @@ Curl_cookie_add(struct Curl_easy *data,
}
return co;
}
+/*
+ * get_line() makes sure to only return complete whole lines that fit in 'len'
+ * bytes and end with a newline.
+ */
+static char *get_line(char *buf, int len, FILE *input)
+{
+ bool partial = FALSE;
+ while(1) {
+ char *b = fgets(buf, len, input);
+ if(b) {
+ size_t rlen = strlen(b);
+ if(rlen && (b[rlen-1] == '\n')) {
+ if(partial) {
+ partial = FALSE;
+ continue;
+ }
+ return b;
+ }
+ else
+ /* read a partial, discard the next piece that ends with newline */
+ partial = TRUE;
+ }
+ else
+ break;
+ }
+ return NULL;
+}
+
+
/*****************************************************************************
*
* Curl_cookie_init()
*
* Inits a cookie struct to read data from a local file. This is always
@@ -957,11 +986,11 @@ struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
bool headerline;
line = malloc(MAX_COOKIE_LINE);
if(!line)
goto fail;
- while(fgets(line, MAX_COOKIE_LINE, fp)) {
+ while(get_line(line, MAX_COOKIE_LINE, fp)) {
if(checkprefix("Set-Cookie:", line)) {
/* This is a cookie line, get it! */
lineptr=&line[11];
headerline=TRUE;
}
--
2.9.3