From: Etienne Cordonnier <[email protected]> The original backport applied upstream's CURLcode return path into ssize_t ws_enc_write_head(), which uses an undeclared result and is invalid for curl 8.7.1's API. Builds with --enable-websockets fail.
Adapt Curl_rand() error handling to set *err and return -1. AI-Generated: Claude Sonnet 4.6 Signed-off-by: Etienne Cordonnier <[email protected]> --- .../curl/curl/CVE-2025-10148.patch | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/meta/recipes-support/curl/curl/CVE-2025-10148.patch b/meta/recipes-support/curl/curl/CVE-2025-10148.patch index d37497febe..654f4151e9 100644 --- a/meta/recipes-support/curl/curl/CVE-2025-10148.patch +++ b/meta/recipes-support/curl/curl/CVE-2025-10148.patch @@ -9,23 +9,28 @@ Closes #18496 CVE: CVE-2025-10148 Upstream-Status: Backport [https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa] Signed-off-by: Hitendra Prajapati <[email protected]> +Signed-off-by: Etienne Cordonnier <[email protected]> --- - lib/ws.c | 21 +++++++++++++-------- - 1 file changed, 13 insertions(+), 8 deletions(-) + lib/ws.c | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/lib/ws.c b/lib/ws.c index 5bc5ecc..02e0ef0 100644 --- a/lib/ws.c +++ b/lib/ws.c -@@ -614,6 +614,18 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data, +@@ -614,6 +614,22 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data, enc->payload_remain = enc->payload_len = payload_len; ws_enc_info(enc, data, "sending"); -+ /* 4 bytes random */ -+ -+ result = Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask)); -+ if(result) -+ return result; ++ /* 4 bytes random */ ++ { ++ CURLcode result = Curl_rand(data, (unsigned char *)&enc->mask, ++ sizeof(enc->mask)); ++ if(result) { ++ *err = result; ++ return -1; ++ } ++ } + +#ifdef DEBUGBUILD + if(getenv("CURL_WS_FORCE_ZERO_MASK")) @@ -36,7 +41,7 @@ index 5bc5ecc..02e0ef0 100644 /* add 4 bytes mask */ memcpy(&head[hlen], &enc->mask, 4); hlen += 4; -@@ -802,14 +814,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data, +@@ -802,14 +818,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data, subprotocol not requested by the client), the client MUST Fail the WebSocket Connection. */ @@ -54,4 +59,3 @@ index 5bc5ecc..02e0ef0 100644 result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode, -- 2.50.1 - -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243377): https://lists.openembedded.org/g/openembedded-core/message/243377 Mute This Topic: https://lists.openembedded.org/mt/120736583/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
