aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2014-10-17 12:59:32 +0200
committerDaniel Stenberg <daniel@haxx.se>2014-11-05 08:05:14 +0100
commitb3875606925536f82fc61f3114ac42f29eaf6945 (patch)
tree229666d262222b2f34967e00fb5300ec69cda258 /src
parentd997c8b2f6521d78c6ef63411cfeb226f7927281 (diff)
curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds
When duplicating a handle, the data to post was duplicated using strdup() when it could be binary and contain zeroes and it was not even zero terminated! This caused read out of bounds crashes/segfaults. Since the lib/strdup.c file no longer is easily shared with the curl tool with this change, it now uses its own version instead. Bug: http://curl.haxx.se/docs/adv_20141105.html CVE: CVE-2014-3707 Reported-By: Symeon Paraschoudis
Diffstat (limited to 'src')
-rw-r--r--src/Makefile.inc4
-rw-r--r--src/tool_setup.h5
-rw-r--r--src/tool_strdup.c47
-rw-r--r--src/tool_strdup.h30
4 files changed, 81 insertions, 5 deletions
diff --git a/src/Makefile.inc b/src/Makefile.inc
index 64d55ecf9..401a635ad 100644
--- a/src/Makefile.inc
+++ b/src/Makefile.inc
@@ -11,7 +11,6 @@
# the official API, but we re-use the code here to avoid duplication.
CURLX_CFILES = \
../lib/strtoofft.c \
- ../lib/strdup.c \
../lib/rawstr.c \
../lib/nonblock.c \
../lib/warnless.c
@@ -19,7 +18,6 @@ CURLX_CFILES = \
CURLX_HFILES = \
../lib/curl_setup.h \
../lib/strtoofft.h \
- ../lib/strdup.h \
../lib/rawstr.h \
../lib/nonblock.h \
../lib/warnless.h
@@ -55,6 +53,7 @@ CURL_CFILES = \
tool_panykey.c \
tool_paramhlp.c \
tool_parsecfg.c \
+ tool_strdup.c \
tool_setopt.c \
tool_sleep.c \
tool_urlglob.c \
@@ -99,6 +98,7 @@ CURL_HFILES = \
tool_setopt.h \
tool_setup.h \
tool_sleep.h \
+ tool_strdup.h \
tool_urlglob.h \
tool_util.h \
tool_version.h \
diff --git a/src/tool_setup.h b/src/tool_setup.h
index c94686f96..3d7c15809 100644
--- a/src/tool_setup.h
+++ b/src/tool_setup.h
@@ -7,7 +7,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
- * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@@ -67,8 +67,7 @@
#endif
#ifndef HAVE_STRDUP
-# include "strdup.h"
-# define strdup(ptr) curlx_strdup(ptr)
+# include "tool_strdup.h"
#endif
#endif /* HEADER_CURL_TOOL_SETUP_H */
diff --git a/src/tool_strdup.c b/src/tool_strdup.c
new file mode 100644
index 000000000..d661a82f7
--- /dev/null
+++ b/src/tool_strdup.c
@@ -0,0 +1,47 @@
+/***************************************************************************
+ * _ _ ____ _
+ * Project ___| | | | _ \| |
+ * / __| | | | |_) | |
+ * | (__| |_| | _ <| |___
+ * \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at http://curl.haxx.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ***************************************************************************/
+#include "strdup.h"
+
+#ifndef HAVE_STRDUP
+char *strdup(const char *str)
+{
+ size_t len;
+ char *newstr;
+
+ if(!str)
+ return (char *)NULL;
+
+ len = strlen(str);
+
+ if(len >= ((size_t)-1) / sizeof(char))
+ return (char *)NULL;
+
+ newstr = malloc((len+1)*sizeof(char));
+ if(!newstr)
+ return (char *)NULL;
+
+ memcpy(newstr,str,(len+1)*sizeof(char));
+
+ return newstr;
+
+}
+#endif
diff --git a/src/tool_strdup.h b/src/tool_strdup.h
new file mode 100644
index 000000000..83c8102c3
--- /dev/null
+++ b/src/tool_strdup.h
@@ -0,0 +1,30 @@
+#ifndef HEADER_TOOL_STRDUP_H
+#define HEADER_TOOL_STRDUP_H
+/***************************************************************************
+ * _ _ ____ _
+ * Project ___| | | | _ \| |
+ * / __| | | | |_) | |
+ * | (__| |_| | _ <| |___
+ * \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at http://curl.haxx.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ***************************************************************************/
+#include "tool_setup.h"
+
+#ifndef HAVE_STRDUP
+extern char *strdup(const char *str);
+#endif
+
+#endif /* HEADER_TOOL_STRDUP_H */