diff options
| author | Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> | 2017-04-05 19:56:58 +0000 |
|---|---|---|
| committer | Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> | 2017-04-05 19:56:58 +0000 |
| commit | fca9a15726cda3e0a8a193ff41e79a23bc9dd075 (patch) | |
| tree | 31f4f6901cf85a51871c994f7e514d92db7ee5ad /ftp/curl | |
| parent | d9505b8dfa9517e1aac62f4baa232062033901d4 (diff) | |
| download | ports-fca9a15726cda3e0a8a193ff41e79a23bc9dd075.tar.gz ports-fca9a15726cda3e0a8a193ff41e79a23bc9dd075.zip | |
Notes
Diffstat (limited to 'ftp/curl')
| -rw-r--r-- | ftp/curl/Makefile | 1 | ||||
| -rw-r--r-- | ftp/curl/files/patch-CVE-2017-7407 | 164 |
2 files changed, 165 insertions, 0 deletions
diff --git a/ftp/curl/Makefile b/ftp/curl/Makefile index a0a890bf51df..62f34f6d6384 100644 --- a/ftp/curl/Makefile +++ b/ftp/curl/Makefile @@ -3,6 +3,7 @@ PORTNAME= curl PORTVERSION= 7.53.1 +PORTREVISION= 1 CATEGORIES= ftp net www MASTER_SITES= http://curl.haxx.se/download/ \ LOCAL/sunpoet diff --git a/ftp/curl/files/patch-CVE-2017-7407 b/ftp/curl/files/patch-CVE-2017-7407 new file mode 100644 index 000000000000..5b9fd25d91e3 --- /dev/null +++ b/ftp/curl/files/patch-CVE-2017-7407 @@ -0,0 +1,164 @@ +From 6019f1795b4e3b72507b84b0e02dc8c32024f562 Mon Sep 17 00:00:00 2001 +From: Dan Fandrich <dan@coneharvesters.com> +Date: Sat, 11 Mar 2017 10:59:34 +0100 +Subject: [PATCH] CVE-2017-7407: fixed + +Bug: https://curl.haxx.se/docs/adv_20170403.html + +Reported-by: Brian Carpenter +--- src/tool_writeout.c.orig 2017-01-13 09:55:20 UTC ++++ src/tool_writeout.c +@@ -5,7 +5,7 @@ + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * +- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al. ++ * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms +@@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutS + double doubleinfo; + + while(ptr && *ptr) { +- if('%' == *ptr) { ++ if('%' == *ptr && ptr[1]) { + if('%' == ptr[1]) { + /* an escaped %-letter */ + fputc('%', stream); +@@ -341,7 +341,7 @@ void ourWriteOut(CURL *curl, struct OutS + } + } + } +- else if('\\' == *ptr) { ++ else if('\\' == *ptr && ptr[1]) { + switch(ptr[1]) { + case 'r': + fputc('\r', stream); + src/tool_writeout.c | 6 +++--- + tests/data/Makefile.inc | 2 +- + tests/data/test1440 | 31 +++++++++++++++++++++++++++++++ + tests/data/test1441 | 31 +++++++++++++++++++++++++++++++ + tests/data/test1442 | 35 +++++++++++++++++++++++++++++++++++ + 5 files changed, 101 insertions(+), 4 deletions(-) + create mode 100644 tests/data/test1440 + create mode 100644 tests/data/test1441 + create mode 100644 tests/data/test1442 + +--- tests/data/Makefile.inc.orig 2017-02-21 07:09:13 UTC ++++ tests/data/Makefile.inc +@@ -151,7 +151,7 @@ test1408 test1409 test1410 test1411 test + test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \ + test1424 \ + test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \ +-test1436 test1437 test1438 test1439 \ ++test1436 test1437 test1438 test1439 test1440 test1441 test1442 \ + \ + test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \ + test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \ +--- tests/data/test1440.orig 2017-04-05 17:06:44 UTC ++++ tests/data/test1440 +@@ -0,0 +1,31 @@ ++<testcase> ++<info> ++<keywords> ++--write-out ++</keywords> ++</info> ++# Server-side ++<reply> ++</reply> ++ ++# Client-side ++<client> ++<server> ++file ++</server> ++ ++<name> ++Check --write-out with trailing %{ ++</name> ++<command> ++file://localhost/%PWD/log/ --write-out '%{' ++</command> ++</client> ++ ++# Verify data ++<verify> ++<stdout nonewline="yes"> ++%{ ++</stdout> ++</verify> ++</testcase> +--- tests/data/test1441.orig 2017-04-05 17:06:44 UTC ++++ tests/data/test1441 +@@ -0,0 +1,31 @@ ++<testcase> ++<info> ++<keywords> ++--write-out ++</keywords> ++</info> ++# Server-side ++<reply> ++</reply> ++ ++# Client-side ++<client> ++<server> ++file ++</server> ++ ++<name> ++Check --write-out with trailing % ++</name> ++<command> ++file://localhost/%PWD/log/ --write-out '%' ++</command> ++</client> ++ ++# Verify data ++<verify> ++<stdout nonewline="yes"> ++% ++</stdout> ++</verify> ++</testcase> +--- tests/data/test1442.orig 2017-04-05 17:06:44 UTC ++++ tests/data/test1442 +@@ -0,0 +1,35 @@ ++<testcase> ++<info> ++<keywords> ++--write-out ++FILE ++</keywords> ++</info> ++# Server-side ++<reply> ++</reply> ++ ++# Client-side ++<client> ++<server> ++file ++</server> ++ ++<name> ++Check --write-out with trailing \ ++</name> ++<command> ++file://localhost/%PWD/log/non-existent-file.txt --write-out '\' ++</command> ++</client> ++ ++# Verify data ++<verify> ++<errorcode> ++37 ++</errorcode> ++<stdout nonewline="yes"> ++\ ++</stdout> ++</verify> ++</testcase> |