Hello community,
here is the log from the commit of package curl for openSUSE:Factory checked in
at 2019-03-11 11:14:20
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/curl (Old)
and /work/SRC/openSUSE:Factory/.curl.new.28833 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "curl"
Mon Mar 11 11:14:20 2019 rev:143 rq:682978 version:7.64.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/curl/curl-mini.changes 2019-03-01
20:26:02.738060058 +0100
+++ /work/SRC/openSUSE:Factory/.curl.new.28833/curl-mini.changes
2019-03-11 11:14:22.709360313 +0100
@@ -1,0 +2,7 @@
+Fri Mar 8 16:10:39 UTC 2019 - Fabian Vogt <fv...@suse.com>
+
+- Add patches to fix use-after-free (boo#1127849):
+ * 0001-connection_check-set-data-to-the-transfer-doing-the-.patch
+ * 0002-connection_check-restore-original-conn-data-after-th.patch
+
+-------------------------------------------------------------------
curl.changes: same change
New:
----
0001-connection_check-set-data-to-the-transfer-doing-the-.patch
0002-connection_check-restore-original-conn-data-after-th.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ curl-mini.spec ++++++
--- /var/tmp/diff_new_pack.Q7FghA/_old 2019-03-11 11:14:23.609360044 +0100
+++ /var/tmp/diff_new_pack.Q7FghA/_new 2019-03-11 11:14:23.613360042 +0100
@@ -46,6 +46,9 @@
# PATCH-FIX-OPENSUSE bsc#1076446 protocol redirection not supported or disabled
Patch4: curl-disabled-redirect-protocol-message.patch
Patch5: curl-use_OPENSSL_config.patch
+# PATCH-FIX-UPSTREAM boo#1127849 fix a crash in libcurl
+Patch6: 0001-connection_check-set-data-to-the-transfer-doing-the-.patch
+Patch7: 0002-connection_check-restore-original-conn-data-after-th.patch
BuildRequires: libtool
BuildRequires: pkgconfig
Requires: libcurl4%{?mini} = %{version}
@@ -129,6 +132,8 @@
%endif
%patch4 -p1
%patch5 -p1
+%patch6 -p1
+%patch7 -p1
%build
# curl complains if macro definition is contained in CFLAGS
++++++ curl.spec ++++++
--- /var/tmp/diff_new_pack.Q7FghA/_old 2019-03-11 11:14:23.633360037 +0100
+++ /var/tmp/diff_new_pack.Q7FghA/_new 2019-03-11 11:14:23.637360035 +0100
@@ -44,6 +44,9 @@
# PATCH-FIX-OPENSUSE bsc#1076446 protocol redirection not supported or disabled
Patch4: curl-disabled-redirect-protocol-message.patch
Patch5: curl-use_OPENSSL_config.patch
+# PATCH-FIX-UPSTREAM boo#1127849 fix a crash in libcurl
+Patch6: 0001-connection_check-set-data-to-the-transfer-doing-the-.patch
+Patch7: 0002-connection_check-restore-original-conn-data-after-th.patch
BuildRequires: libtool
BuildRequires: pkgconfig
Requires: libcurl4%{?mini} = %{version}
@@ -127,6 +130,8 @@
%endif
%patch4 -p1
%patch5 -p1
+%patch6 -p1
+%patch7 -p1
%build
# curl complains if macro definition is contained in CFLAGS
++++++ 0001-connection_check-set-data-to-the-transfer-doing-the-.patch ++++++
>From c34b576805318aa4896caf1d9b806a5bb89ca456 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <dan...@haxx.se>
Date: Mon, 11 Feb 2019 07:56:00 +0100
Subject: [PATCH 1/2] connection_check: set ->data to the transfer doing the
check
The http2 code for connection checking needs a transfer to use. Make
sure a working one is set before handler->connection_check() is called.
Reported-by: jnbr on github
Fixes #3541
Closes #3547
---
lib/url.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/url.c b/lib/url.c
index d5a982008..229c655da 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -965,6 +965,7 @@ static bool extract_if_dead(struct connectdata *conn,
/* The protocol has a special method for checking the state of the
connection. Use it to check if the connection is dead. */
unsigned int state;
+ conn->data = data; /* use this transfer for now */
state = conn->handler->connection_check(conn, CONNCHECK_ISDEAD);
dead = (state & CONNRESULT_DEAD);
}
--
2.20.1
++++++ 0002-connection_check-restore-original-conn-data-after-th.patch ++++++
>From f992905ab8a242934dba114103c730117a1d25a3 Mon Sep 17 00:00:00 2001
From: Jay Satiro <raysat...@yahoo.com>
Date: Mon, 11 Feb 2019 23:00:00 -0500
Subject: [PATCH 2/2] connection_check: restore original conn->data after the
check
- Save the original conn->data before it's changed to the specified
data transfer for the connection check and then restore it afterwards.
This is a follow-up to 38d8e1b 2019-02-11.
History:
It was discovered a month ago that before checking whether to extract a
dead connection that that connection should be associated with a "live"
transfer for the check (ie original conn->data ignored and set to the
passed in data). A fix was landed in 54b201b which did that and also
cleared conn->data after the check. The original conn->data was not
restored, so presumably it was thought that a valid conn->data was no
longer needed.
Several days later it was discovered that a valid conn->data was needed
after the check and follow-up fix was landed in bbae24c which partially
reverted the original fix and attempted to limit the scope of when
conn->data was changed to only when pruning dead connections. In that
case conn->data was not cleared and the original conn->data not
restored.
A month later it was discovered that the original fix was somewhat
correct; a "live" transfer is needed for the check in all cases
because original conn->data could be null which could cause a bad deref
at arbitrary points in the check. A fix was landed in 38d8e1b which
expanded the scope to all cases. conn->data was not cleared and the
original conn->data not restored.
A day later it was discovered that not restoring the original conn->data
may lead to busy loops in applications that use the event interface, and
given this observation it's a pretty safe assumption that there is some
code path that still needs the original conn->data. This commit is the
follow-up fix for that, it restores the original conn->data after the
connection check.
Assisted-by: tho...@users.noreply.github.com
Reported-by: tho...@users.noreply.github.com
Fixes https://github.com/curl/curl/issues/3542
Closes #3559
---
lib/url.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/url.c b/lib/url.c
index 229c655da..a77e92dfe 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -965,8 +965,10 @@ static bool extract_if_dead(struct connectdata *conn,
/* The protocol has a special method for checking the state of the
connection. Use it to check if the connection is dead. */
unsigned int state;
+ struct Curl_easy *olddata = conn->data;
conn->data = data; /* use this transfer for now */
state = conn->handler->connection_check(conn, CONNCHECK_ISDEAD);
+ conn->data = olddata;
dead = (state & CONNRESULT_DEAD);
}
else {
@@ -995,7 +997,6 @@ struct prunedead {
static int call_extract_if_dead(struct connectdata *conn, void *param)
{
struct prunedead *p = (struct prunedead *)param;
- conn->data = p->data; /* transfer to use for this check */
if(extract_if_dead(conn, p->data)) {
/* stop the iteration here, pass back the connection that was extracted */
p->extracted = conn;
--
2.20.1
