mirror of
https://github.com/hak5/wifipineapple-openwrt.git
synced 2025-10-29 16:57:19 +00:00
db9be1fa75
This fixes the following security vulnerabilities in curl: * CVE-2015-3143 * CVE-2015-3144 * CVE-2015-3145 * CVE-2015-3148 * CVE-2015-3153 * CVE-2015-3236 * CVE-2015-3237 This was fixed in trunk with update to version 7.43.0 in r46169. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> git-svn-id: svn://svn.openwrt.org/openwrt/branches/chaos_calmer@46312 3c298f89-4303-0410-b956-a3cf2f4a3e73
36 lines
1.2 KiB
Diff
36 lines
1.2 KiB
Diff
From d2f1a8bdce9d77a277d05adae025d369c1bdd9e6 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Fri, 22 May 2015 10:28:21 +0200
|
|
Subject: [PATCH] SMB: rangecheck values read off incoming packet
|
|
|
|
CVE-2015-3237
|
|
|
|
Detected by Coverity. CID 1299430.
|
|
|
|
Bug: http://curl.haxx.se/docs/adv_20150617B.html
|
|
---
|
|
lib/smb.c | 12 +++++++++---
|
|
1 file changed, 9 insertions(+), 3 deletions(-)
|
|
|
|
--- a/lib/smb.c
|
|
+++ b/lib/smb.c
|
|
@@ -783,9 +783,15 @@ static CURLcode smb_request_state(struct
|
|
off = Curl_read16_le(((unsigned char *) msg) +
|
|
sizeof(struct smb_header) + 13);
|
|
if(len > 0) {
|
|
- result = Curl_client_write(conn, CLIENTWRITE_BODY,
|
|
- (char *)msg + off + sizeof(unsigned int),
|
|
- len);
|
|
+ struct smb_conn *smbc = &conn->proto.smbc;
|
|
+ if(off + sizeof(unsigned int) + len > smbc->got) {
|
|
+ failf(conn->data, "Invalid input packet");
|
|
+ result = CURLE_RECV_ERROR;
|
|
+ }
|
|
+ else
|
|
+ result = Curl_client_write(conn, CLIENTWRITE_BODY,
|
|
+ (char *)msg + off + sizeof(unsigned int),
|
|
+ len);
|
|
if(result) {
|
|
req->result = result;
|
|
next_state = SMB_CLOSE;
|