| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165 |
- From 6019f1795b4e3b72507b84b0e02dc8c32024f562 Mon Sep 17 00:00:00 2001
- From: Dan Fandrich <dan@coneharvesters.com>
- Date: Sat, 11 Mar 2017 10:59:34 +0100
- Subject: [PATCH] CVE-2017-7407: fixed
- Bug: https://curl.haxx.se/docs/adv_20170403.html
- Reported-by: Brian Carpenter
- ---
- src/tool_writeout.c | 6 +++---
- tests/data/Makefile.inc | 2 +-
- tests/data/test1440 | 31 +++++++++++++++++++++++++++++++
- tests/data/test1441 | 31 +++++++++++++++++++++++++++++++
- tests/data/test1442 | 35 +++++++++++++++++++++++++++++++++++
- 5 files changed, 101 insertions(+), 4 deletions(-)
- create mode 100644 tests/data/test1440
- create mode 100644 tests/data/test1441
- create mode 100644 tests/data/test1442
- --- a/src/tool_writeout.c
- +++ b/src/tool_writeout.c
- @@ -5,7 +5,7 @@
- * | (__| |_| | _ <| |___
- * \___|\___/|_| \_\_____|
- *
- - * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
- + * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- @@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutS
- double doubleinfo;
-
- while(ptr && *ptr) {
- - if('%' == *ptr) {
- + if('%' == *ptr && ptr[1]) {
- if('%' == ptr[1]) {
- /* an escaped %-letter */
- fputc('%', stream);
- @@ -341,7 +341,7 @@ void ourWriteOut(CURL *curl, struct OutS
- }
- }
- }
- - else if('\\' == *ptr) {
- + else if('\\' == *ptr && ptr[1]) {
- switch(ptr[1]) {
- case 'r':
- fputc('\r', stream);
- --- a/tests/data/Makefile.inc
- +++ b/tests/data/Makefile.inc
- @@ -150,7 +150,7 @@ test1408 test1409 test1410 test1411 test
- test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \
- test1424 \
- test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \
- -test1436 test1437 test1438 test1439 \
- +test1436 test1437 test1438 test1439 test1440 test1441 test1442 \
- \
- test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
- test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
- --- /dev/null
- +++ b/tests/data/test1440
- @@ -0,0 +1,31 @@
- +<testcase>
- +<info>
- +<keywords>
- +--write-out
- +</keywords>
- +</info>
- +# Server-side
- +<reply>
- +</reply>
- +
- +# Client-side
- +<client>
- +<server>
- +file
- +</server>
- +
- +<name>
- +Check --write-out with trailing %{
- +</name>
- +<command>
- +file://localhost/%PWD/log/ --write-out '%{'
- +</command>
- +</client>
- +
- +# Verify data
- +<verify>
- +<stdout nonewline="yes">
- +%{
- +</stdout>
- +</verify>
- +</testcase>
- --- /dev/null
- +++ b/tests/data/test1441
- @@ -0,0 +1,31 @@
- +<testcase>
- +<info>
- +<keywords>
- +--write-out
- +</keywords>
- +</info>
- +# Server-side
- +<reply>
- +</reply>
- +
- +# Client-side
- +<client>
- +<server>
- +file
- +</server>
- +
- +<name>
- +Check --write-out with trailing %
- +</name>
- +<command>
- +file://localhost/%PWD/log/ --write-out '%'
- +</command>
- +</client>
- +
- +# Verify data
- +<verify>
- +<stdout nonewline="yes">
- +%
- +</stdout>
- +</verify>
- +</testcase>
- --- /dev/null
- +++ b/tests/data/test1442
- @@ -0,0 +1,35 @@
- +<testcase>
- +<info>
- +<keywords>
- +--write-out
- +FILE
- +</keywords>
- +</info>
- +# Server-side
- +<reply>
- +</reply>
- +
- +# Client-side
- +<client>
- +<server>
- +file
- +</server>
- +
- +<name>
- +Check --write-out with trailing \
- +</name>
- +<command>
- +file://localhost/%PWD/log/non-existent-file.txt --write-out '\'
- +</command>
- +</client>
- +
- +# Verify data
- +<verify>
- +<errorcode>
- +37
- +</errorcode>
- +<stdout nonewline="yes">
- +\
- +</stdout>
- +</verify>
- +</testcase>
|
