diff options
| author | Nishant Chaprana <n.chaprana@samsung.com> | 2019-03-09 12:21:06 +0530 |
|---|---|---|
| committer | Nishant Chaprana <n.chaprana@samsung.com> | 2019-03-09 12:21:06 +0530 |
| commit | ce2c30a81630cdc9f58f31424394f418c2ea4de5 (patch) | |
| tree | 093e0b6eb52665008729a2d41ade03cb6b33cfda | |
| parent | e57a422322fb42574ae27ad1eb72997646b578b4 (diff) | |
| download | curl-ce2c30a81630cdc9f58f31424394f418c2ea4de5.tar.gz curl-ce2c30a81630cdc9f58f31424394f418c2ea4de5.tar.bz2 curl-ce2c30a81630cdc9f58f31424394f418c2ea4de5.zip | |
NTLM: fix size check condition for type2 received datasubmit/tizen_base/20190531.050615submit/tizen_base/20190311.044245accepted/tizen/base/20190531.081959accepted/tizen/base/20190316.131826
Bug: https://curl.haxx.se/docs/CVE-2018-16890.html
Reported-by: Wenxiang Qian
CVE-2018-16890
Backported patch details:-
Link: https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb.patch
Change-Id: I15fc8002280680a7cf194dd02a5d7751cc7dbc71
Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
| -rw-r--r-- | lib/vauth/ntlm.c | 7 | ||||
| -rw-r--r-- | packaging/curl.spec | 2 |
2 files changed, 5 insertions, 4 deletions
diff --git a/lib/vauth/ntlm.c b/lib/vauth/ntlm.c index 82b59f61d..1bef9ee38 100644 --- a/lib/vauth/ntlm.c +++ b/lib/vauth/ntlm.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -182,10 +182,11 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data, target_info_len = Curl_read16_le(&buffer[40]); target_info_offset = Curl_read32_le(&buffer[44]); if(target_info_len > 0) { - if(((target_info_offset + target_info_len) > size) || + if((target_info_offset >= size) || + ((target_info_offset + target_info_len) > size) || (target_info_offset < 48)) { infof(data, "NTLM handshake failure (bad type-2 message). " - "Target Info Offset Len is set incorrect by the peer\n"); + "Target Info Offset Len is set incorrect by the peer\n"); return CURLE_BAD_CONTENT_ENCODING; } diff --git a/packaging/curl.spec b/packaging/curl.spec index 42a93baea..8e4f44789 100644 --- a/packaging/curl.spec +++ b/packaging/curl.spec @@ -1,7 +1,7 @@ Name: curl Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Version: 7.62.0 -Release: 3 +Release: 4 Group: Applications/Internet License: MIT URL: http://curl.haxx.se/ |