101-CVE-2017-7407.patch 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165
  1. From 6019f1795b4e3b72507b84b0e02dc8c32024f562 Mon Sep 17 00:00:00 2001
  2. From: Dan Fandrich <dan@coneharvesters.com>
  3. Date: Sat, 11 Mar 2017 10:59:34 +0100
  4. Subject: [PATCH] CVE-2017-7407: fixed
  5. Bug: https://curl.haxx.se/docs/adv_20170403.html
  6. Reported-by: Brian Carpenter
  7. ---
  8. src/tool_writeout.c | 6 +++---
  9. tests/data/Makefile.inc | 2 +-
  10. tests/data/test1440 | 31 +++++++++++++++++++++++++++++++
  11. tests/data/test1441 | 31 +++++++++++++++++++++++++++++++
  12. tests/data/test1442 | 35 +++++++++++++++++++++++++++++++++++
  13. 5 files changed, 101 insertions(+), 4 deletions(-)
  14. create mode 100644 tests/data/test1440
  15. create mode 100644 tests/data/test1441
  16. create mode 100644 tests/data/test1442
  17. --- a/src/tool_writeout.c
  18. +++ b/src/tool_writeout.c
  19. @@ -5,7 +5,7 @@
  20. * | (__| |_| | _ <| |___
  21. * \___|\___/|_| \_\_____|
  22. *
  23. - * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
  24. + * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
  25. *
  26. * This software is licensed as described in the file COPYING, which
  27. * you should have received as part of this distribution. The terms
  28. @@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutS
  29. double doubleinfo;
  30. while(ptr && *ptr) {
  31. - if('%' == *ptr) {
  32. + if('%' == *ptr && ptr[1]) {
  33. if('%' == ptr[1]) {
  34. /* an escaped %-letter */
  35. fputc('%', stream);
  36. @@ -341,7 +341,7 @@ void ourWriteOut(CURL *curl, struct OutS
  37. }
  38. }
  39. }
  40. - else if('\\' == *ptr) {
  41. + else if('\\' == *ptr && ptr[1]) {
  42. switch(ptr[1]) {
  43. case 'r':
  44. fputc('\r', stream);
  45. --- a/tests/data/Makefile.inc
  46. +++ b/tests/data/Makefile.inc
  47. @@ -150,7 +150,7 @@ test1408 test1409 test1410 test1411 test
  48. test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \
  49. test1424 \
  50. test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \
  51. -test1436 test1437 test1438 test1439 \
  52. +test1436 test1437 test1438 test1439 test1440 test1441 test1442 \
  53. \
  54. test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
  55. test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
  56. --- /dev/null
  57. +++ b/tests/data/test1440
  58. @@ -0,0 +1,31 @@
  59. +<testcase>
  60. +<info>
  61. +<keywords>
  62. +--write-out
  63. +</keywords>
  64. +</info>
  65. +# Server-side
  66. +<reply>
  67. +</reply>
  68. +
  69. +# Client-side
  70. +<client>
  71. +<server>
  72. +file
  73. +</server>
  74. +
  75. +<name>
  76. +Check --write-out with trailing %{
  77. +</name>
  78. +<command>
  79. +file://localhost/%PWD/log/ --write-out '%{'
  80. +</command>
  81. +</client>
  82. +
  83. +# Verify data
  84. +<verify>
  85. +<stdout nonewline="yes">
  86. +%{
  87. +</stdout>
  88. +</verify>
  89. +</testcase>
  90. --- /dev/null
  91. +++ b/tests/data/test1441
  92. @@ -0,0 +1,31 @@
  93. +<testcase>
  94. +<info>
  95. +<keywords>
  96. +--write-out
  97. +</keywords>
  98. +</info>
  99. +# Server-side
  100. +<reply>
  101. +</reply>
  102. +
  103. +# Client-side
  104. +<client>
  105. +<server>
  106. +file
  107. +</server>
  108. +
  109. +<name>
  110. +Check --write-out with trailing %
  111. +</name>
  112. +<command>
  113. +file://localhost/%PWD/log/ --write-out '%'
  114. +</command>
  115. +</client>
  116. +
  117. +# Verify data
  118. +<verify>
  119. +<stdout nonewline="yes">
  120. +%
  121. +</stdout>
  122. +</verify>
  123. +</testcase>
  124. --- /dev/null
  125. +++ b/tests/data/test1442
  126. @@ -0,0 +1,35 @@
  127. +<testcase>
  128. +<info>
  129. +<keywords>
  130. +--write-out
  131. +FILE
  132. +</keywords>
  133. +</info>
  134. +# Server-side
  135. +<reply>
  136. +</reply>
  137. +
  138. +# Client-side
  139. +<client>
  140. +<server>
  141. +file
  142. +</server>
  143. +
  144. +<name>
  145. +Check --write-out with trailing \
  146. +</name>
  147. +<command>
  148. +file://localhost/%PWD/log/non-existent-file.txt --write-out '\'
  149. +</command>
  150. +</client>
  151. +
  152. +# Verify data
  153. +<verify>
  154. +<errorcode>
  155. +37
  156. +</errorcode>
  157. +<stdout nonewline="yes">
  158. +\
  159. +</stdout>
  160. +</verify>
  161. +</testcase>