On Wed, Oct 11, 2023 at 7:55 PM Mike Crowe via lists.openembedded.org <mac=mcrowe....@lists.openembedded.org> wrote: > > From: Mike Crowe <m...@mcrowe.com> > > Take patch from Debian 7.64.0-4+deb10u7. > > Signed-off-by: Mike Crowe <m...@mcrowe.com> > --- > .../curl/curl/CVE-2023-38546.patch | 131 ++++++++++++++++++ > meta/recipes-support/curl/curl_7.69.1.bb | 1 + > 2 files changed, 132 insertions(+) > create mode 100644 meta/recipes-support/curl/curl/CVE-2023-38546.patch > > diff --git a/meta/recipes-support/curl/curl/CVE-2023-38546.patch > b/meta/recipes-support/curl/curl/CVE-2023-38546.patch > new file mode 100644 > index 0000000000..21887d58a3 > --- /dev/null > +++ b/meta/recipes-support/curl/curl/CVE-2023-38546.patch > @@ -0,0 +1,131 @@ > +From 7b67721f12cbe6ed1a41e7332f3b5a7186a5e23f Mon Sep 17 00:00:00 2001 > +From: Daniel Stenberg <dan...@haxx.se> > +Date: Thu, 14 Sep 2023 23:28:32 +0200 > +Subject: [PATCH] cookie: remove unnecessary struct fields > +To: libcurl development <curl-libr...@cool.haxx.se> > + > +Plus: reduce the hash table size from 256 to 63. It seems unlikely to > +make much of a speed difference for most use cases but saves 1.5KB of > +data per instance. > + > +Closes #11862 > + > +This patch taken from Debian's 7.64.0-4+deb10u7 package which applied with > +only a little fuzz. > + > +CVE: CVE-2023-38546 > +Upstream-Status: Backport [61275672b46d9abb32857404]
Missing Signed-off-by: Please submit a V2 Thanks! Steve > +--- > + lib/cookie.c | 13 +------------ > + lib/cookie.h | 7 ++----- > + lib/easy.c | 4 +--- > + 3 files changed, 4 insertions(+), 20 deletions(-) > + > +diff --git a/lib/cookie.c b/lib/cookie.c > +index 68054e1c4..a378f28e1 100644 > +--- a/lib/cookie.c > ++++ b/lib/cookie.c > +@@ -114,7 +114,6 @@ static void freecookie(struct Cookie *co) > + free(co->name); > + free(co->value); > + free(co->maxage); > +- free(co->version); > + free(co); > + } > + > +@@ -641,11 +640,7 @@ Curl_cookie_add(struct Curl_easy *data, > + } > + } > + else if(strcasecompare("version", name)) { > +- strstore(&co->version, whatptr); > +- if(!co->version) { > +- badcookie = TRUE; > +- break; > +- } > ++ /* just ignore */ > + } > + else if(strcasecompare("max-age", name)) { > + /* Defined in RFC2109: > +@@ -1042,7 +1037,6 @@ Curl_cookie_add(struct Curl_easy *data, > + free(clist->path); > + free(clist->spath); > + free(clist->expirestr); > +- free(clist->version); > + free(clist->maxage); > + > + *clist = *co; /* then store all the new data */ > +@@ -1111,9 +1105,6 @@ struct CookieInfo *Curl_cookie_init(struct Curl_easy > *data, > + c = calloc(1, sizeof(struct CookieInfo)); > + if(!c) > + return NULL; /* failed to get memory */ > +- c->filename = strdup(file?file:"none"); /* copy the name just in case */ > +- if(!c->filename) > +- goto fail; /* failed to get memory */ > + } > + else { > + /* we got an already existing one, use that */ > +@@ -1241,7 +1232,6 @@ static struct Cookie *dup_cookie(struct Cookie *src) > + CLONE(name); > + CLONE(value); > + CLONE(maxage); > +- CLONE(version); > + d->expires = src->expires; > + d->tailmatch = src->tailmatch; > + d->secure = src->secure; > +@@ -1457,7 +1447,6 @@ void Curl_cookie_cleanup(struct CookieInfo *c) > + { > + if(c) { > + unsigned int i; > +- free(c->filename); > + for(i = 0; i < COOKIE_HASH_SIZE; i++) > + Curl_cookie_freelist(c->cookies[i]); > + free(c); /* free the base struct as well */ > +diff --git a/lib/cookie.h b/lib/cookie.h > +index b3865e601..2e667cda0 100644 > +--- a/lib/cookie.h > ++++ b/lib/cookie.h > +@@ -36,8 +36,6 @@ struct Cookie { > + char *expirestr; /* the plain text version */ > + bool tailmatch; /* whether we do tail-matching of the domain name */ > + > +- /* RFC 2109 keywords. Version=1 means 2109-compliant cookie sending */ > +- char *version; /* Version = <value> */ > + char *maxage; /* Max-Age = <value> */ > + > + bool secure; /* whether the 'secure' keyword was used */ > +@@ -54,15 +52,14 @@ struct Cookie { > + #define COOKIE_PREFIX__SECURE (1<<0) > + #define COOKIE_PREFIX__HOST (1<<1) > + > +-#define COOKIE_HASH_SIZE 256 > ++#define COOKIE_HASH_SIZE 63 > + > + struct CookieInfo { > + /* linked list of cookies we know of */ > + struct Cookie *cookies[COOKIE_HASH_SIZE]; > + > +- char *filename; /* file we read from/write to */ > + bool running; /* state info, for cookie adding information */ > +- long numcookies; /* number of cookies in the "jar" */ > ++ int numcookies; /* number of cookies in the "jar" */ > + bool newsession; /* new session, discard session cookies on load */ > + int lastct; /* last creation-time used in the jar */ > + }; > +diff --git a/lib/easy.c b/lib/easy.c > +index b648e80c1..cdca0fb03 100644 > +--- a/lib/easy.c > ++++ b/lib/easy.c > +@@ -840,9 +840,7 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy > *data) > + if(data->cookies) { > + /* If cookies are enabled in the parent handle, we enable them > + in the clone as well! */ > +- outcurl->cookies = Curl_cookie_init(data, > +- data->cookies->filename, > +- outcurl->cookies, > ++ outcurl->cookies = Curl_cookie_init(data, NULL, outcurl->cookies, > + data->set.cookiesession); > + if(!outcurl->cookies) > + goto fail; > +-- > +2.39.2 > + > diff --git a/meta/recipes-support/curl/curl_7.69.1.bb > b/meta/recipes-support/curl/curl_7.69.1.bb > index 4012776613..0141b780ee 100644 > --- a/meta/recipes-support/curl/curl_7.69.1.bb > +++ b/meta/recipes-support/curl/curl_7.69.1.bb > @@ -54,6 +54,7 @@ SRC_URI = "https://curl.haxx.se/download/curl-${PV}.tar.bz2 > \ > file://CVE-2023-28320-fol1.patch \ > file://CVE-2023-32001.patch \ > file://CVE-2023-38545.patch \ > + file://CVE-2023-38546.patch \ > " > > SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42" > -- > 2.39.2 > > > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#189020): https://lists.openembedded.org/g/openembedded-core/message/189020 Mute This Topic: https://lists.openembedded.org/mt/101913150/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-