# HG changeset patch
# User Rich Burridge <rich.burridge@oracle.com>
# Date 1377077864 25200
# Node ID d430caca2495f0adfbcb697d94a4b4c35d0646a4
# Parent  3288b0639de63cc981a961d0508de759272ec57f
17335413 problem in LIBRARY/CURL

diff -r 3288b0639de6 -r d430caca2495 components/curl/patches/008-CVE-2013-2174.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/curl/patches/008-CVE-2013-2174.patch	Wed Aug 21 02:37:44 2013 -0700
@@ -0,0 +1,33 @@
+CVE-2013-2174: Heap-based buffer overflow in the curl_easy_unescape function
+in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote
+attackers to cause a denial of service (application crash) or possibly
+execute arbitrary code via a crafted string ending in a "%" (percent)
+character.
+
+CVE webpage for this problem:
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174
+
+Relevant upstream patch at:
+https://github.com/bagder/curl/commit/192c4f788d48f82c03e9cef40013f34370e90737
+
+--- lib/escape.c.orig	2013-08-20 17:09:51.197431224 -0700
++++ lib/escape.c	2013-08-20 17:10:43.746809478 -0700
+@@ -5,7 +5,7 @@
+  *                            | (__| |_| |  _ <| |___
+  *                             \___|\___/|_| \_\_____|
+  *
+- * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
++ * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
+  *
+  * This software is licensed as described in the file COPYING, which
+  * you should have received as part of this distribution. The terms
+@@ -159,7 +159,8 @@
+ 
+   while(--alloc > 0) {
+     in = *string;
+-    if(('%' == in) && ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
++    if(('%' == in) && (alloc > 2) &&
++       ISXDIGIT(string[1]) && ISXDIGIT(string[2])) {
+       /* this is two hexadecimal digits following a '%' */
+       char hexstr[3];
+       char *ptr;