mirror of
git://git.yoctoproject.org/poky
synced 2026-10-02 17:38:52 +00:00
2ac597044a
Backport fixes for: - CVE-2022-32221 POST following PUT confusion - CVE-2022-35260 .netrc parser out-of-bounds access - CVE-2022-42915 HTTP proxy double-free - CVE-2022-42916 HSTS bypass via IDN (From OE-Core rev: 724c8b65fe307af602b6bf7e3704dfb25bc51ee9) Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
54 lines
1.8 KiB
Diff
54 lines
1.8 KiB
Diff
From 3ede0e72aaad6447d2a5ab07dac43e1b9d7e617b Mon Sep 17 00:00:00 2001
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
|
Date: Thu, 6 Oct 2022 14:13:36 +0200
|
|
Subject: [PATCH] http_proxy: restore the protocol pointer on error
|
|
|
|
Reported-by: Trail of Bits
|
|
|
|
Closes #9790
|
|
|
|
Upstream-Status: Backport [https://github.com/curl/curl/commit/55e1875729f9d9fc7315ce]
|
|
Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
|
|
---
|
|
lib/http_proxy.c | 6 ++----
|
|
lib/url.c | 9 ---------
|
|
2 files changed, 2 insertions(+), 13 deletions(-)
|
|
|
|
diff --git a/lib/http_proxy.c b/lib/http_proxy.c
|
|
index 1f87f6c..cc20b3a 100644
|
|
--- a/lib/http_proxy.c
|
|
+++ b/lib/http_proxy.c
|
|
@@ -212,10 +212,8 @@ void Curl_connect_done(struct Curl_easy *data)
|
|
Curl_dyn_free(&s->rcvbuf);
|
|
Curl_dyn_free(&s->req);
|
|
|
|
- /* restore the protocol pointer, if not already done */
|
|
- if(s->prot_save)
|
|
- data->req.p.http = s->prot_save;
|
|
- s->prot_save = NULL;
|
|
+ /* restore the protocol pointer */
|
|
+ data->req.p.http = s->prot_save;
|
|
data->info.httpcode = 0; /* clear it as it might've been used for the
|
|
proxy */
|
|
data->req.ignorebody = FALSE;
|
|
diff --git a/lib/url.c b/lib/url.c
|
|
index bfc784f..61c99d2 100644
|
|
--- a/lib/url.c
|
|
+++ b/lib/url.c
|
|
@@ -746,15 +746,6 @@ static void conn_shutdown(struct Curl_easy *data, struct connectdata *conn)
|
|
DEBUGASSERT(data);
|
|
infof(data, "Closing connection %ld", conn->connection_id);
|
|
|
|
-#ifndef USE_HYPER
|
|
- if(conn->connect_state && conn->connect_state->prot_save) {
|
|
- /* If this was closed with a CONNECT in progress, cleanup this temporary
|
|
- struct arrangement */
|
|
- data->req.p.http = NULL;
|
|
- Curl_safefree(conn->connect_state->prot_save);
|
|
- }
|
|
-#endif
|
|
-
|
|
/* possible left-overs from the async name resolvers */
|
|
Curl_resolver_cancel(data);
|
|
|