diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2014-10-17 12:59:32 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2014-11-05 08:05:14 +0100 |
| commit | b3875606925536f82fc61f3114ac42f29eaf6945 (patch) | |
| tree | 229666d262222b2f34967e00fb5300ec69cda258 /lib/urldata.h | |
| parent | d997c8b2f6521d78c6ef63411cfeb226f7927281 (diff) | |
curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds
When duplicating a handle, the data to post was duplicated using
strdup() when it could be binary and contain zeroes and it was not even
zero terminated! This caused read out of bounds crashes/segfaults.
Since the lib/strdup.c file no longer is easily shared with the curl
tool with this change, it now uses its own version instead.
Bug: http://curl.haxx.se/docs/adv_20141105.html
CVE: CVE-2014-3707
Reported-By: Symeon Paraschoudis
Diffstat (limited to 'lib/urldata.h')
| -rw-r--r-- | lib/urldata.h | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/lib/urldata.h b/lib/urldata.h index 5a65c4a74..62a2b8048 100644 --- a/lib/urldata.h +++ b/lib/urldata.h @@ -1372,7 +1372,6 @@ enum dupstring { STRING_KRB_LEVEL, /* krb security level */ STRING_NETRC_FILE, /* if not NULL, use this instead of trying to find $HOME/.netrc */ - STRING_COPYPOSTFIELDS, /* if POST, set the fields' values here */ STRING_PROXY, /* proxy to use */ STRING_SET_RANGE, /* range, if used */ STRING_SET_REFERER, /* custom string for the HTTP referer field */ @@ -1415,7 +1414,15 @@ enum dupstring { STRING_BEARER, /* <bearer>, if used */ - /* -- end of strings -- */ + /* -- end of zero-terminated strings -- */ + + STRING_LASTZEROTERMINATED, + + /* -- below this are pointers to binary data that cannot be strdup'ed. + Each such pointer must be added manually to Curl_dupset() --- */ + + STRING_COPYPOSTFIELDS, /* if POST, set the fields' values here */ + STRING_LAST /* not used, just an end-of-list marker */ }; |