Resolves: CVE-2018-16840 - fix use-after-free in handle close
This commit is contained in:
parent
796d905297
commit
00c5d944d9
|
@ -0,0 +1,39 @@
|
|||
From 235f209a0e62edee654be441a50bb0c154edeaa5 Mon Sep 17 00:00:00 2001
|
||||
From: Daniel Stenberg <daniel@haxx.se>
|
||||
Date: Thu, 18 Oct 2018 15:07:15 +0200
|
||||
Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
|
||||
use-after-free
|
||||
|
||||
Regression from b46cfbc068 (7.59.0)
|
||||
CVE-2018-16840
|
||||
Reported-by: Brian Carpenter (Geeknik Labs)
|
||||
|
||||
Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
|
||||
|
||||
Upstream-commit: 81d135d67155c5295b1033679c606165d4e28f3f
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
lib/url.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/url.c b/lib/url.c
|
||||
index f159008..dcc1ecc 100644
|
||||
--- a/lib/url.c
|
||||
+++ b/lib/url.c
|
||||
@@ -320,10 +320,12 @@ CURLcode Curl_close(struct Curl_easy *data)
|
||||
and detach this handle from there. */
|
||||
curl_multi_remove_handle(data->multi, data);
|
||||
|
||||
- if(data->multi_easy)
|
||||
+ if(data->multi_easy) {
|
||||
/* when curl_easy_perform() is used, it creates its own multi handle to
|
||||
use and this is the one */
|
||||
curl_multi_cleanup(data->multi_easy);
|
||||
+ data->multi_easy = NULL;
|
||||
+ }
|
||||
|
||||
/* Destroy the timeout list that is held in the easy handle. It is
|
||||
/normally/ done by curl_multi_remove_handle() but this is "just in
|
||||
--
|
||||
2.17.2
|
||||
|
|
@ -37,6 +37,9 @@ Patch10: 0010-curl-7.59.0-CVE-2018-16842.patch
|
|||
# we need `git apply` to apply this patch
|
||||
BuildRequires: git
|
||||
|
||||
# fix use-after-free in handle close (CVE-2018-16840)
|
||||
Patch11: 0011-curl-7.59.0-CVE-2018-16840.patch
|
||||
|
||||
# patch making libcurl multilib ready
|
||||
Patch101: 0101-curl-7.32.0-multilib.patch
|
||||
|
||||
|
@ -197,6 +200,7 @@ be installed.
|
|||
%patch8 -p1
|
||||
%patch9 -p1
|
||||
git apply %{PATCH10}
|
||||
%patch11 -p1
|
||||
|
||||
# Fedora patches
|
||||
%patch101 -p1
|
||||
|
@ -344,6 +348,7 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
|
|||
|
||||
%changelog
|
||||
* Thu Nov 01 2018 Kamil Dudka <kdudka@redhat.com> - 7.59.0-8
|
||||
- fix use-after-free in handle close (CVE-2018-16840)
|
||||
- fix bad arethmetic when outputting warnings to stderr (CVE-2018-16842)
|
||||
- test320: update expected output for gnutls-3.6.4
|
||||
|
||||
|
|
Loading…
Reference in New Issue