summaryrefslogtreecommitdiff
path: root/meta-openbmc-mods/meta-common/recipes-support/curl/curl/CVE-2022-32206-return-error-on-too-many-compression-steps.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta-openbmc-mods/meta-common/recipes-support/curl/curl/CVE-2022-32206-return-error-on-too-many-compression-steps.patch')
-rw-r--r--meta-openbmc-mods/meta-common/recipes-support/curl/curl/CVE-2022-32206-return-error-on-too-many-compression-steps.patch48
1 files changed, 0 insertions, 48 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-support/curl/curl/CVE-2022-32206-return-error-on-too-many-compression-steps.patch b/meta-openbmc-mods/meta-common/recipes-support/curl/curl/CVE-2022-32206-return-error-on-too-many-compression-steps.patch
deleted file mode 100644
index bdf3ba35e..000000000
--- a/meta-openbmc-mods/meta-common/recipes-support/curl/curl/CVE-2022-32206-return-error-on-too-many-compression-steps.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 3a09fbb7f264c67c438d01a30669ce325aa508e2 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Mon, 16 May 2022 16:28:13 +0200
-Subject: [PATCH] content_encoding: return error on too many compression steps
-
-The max allowed steps is arbitrarily set to 5.
-
-Bug: https://curl.se/docs/CVE-2022-32206.html
-CVE-2022-32206
-Reported-by: Harry Sintonen
-Closes #9049
----
- lib/content_encoding.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/lib/content_encoding.c b/lib/content_encoding.c
-index c5591ca48ac78..95ba48a2dd563 100644
---- a/lib/content_encoding.c
-+++ b/lib/content_encoding.c
-@@ -1028,12 +1028,16 @@ static const struct content_encoding *find_encoding(const char *name,
- return NULL;
- }
-
-+/* allow no more than 5 "chained" compression steps */
-+#define MAX_ENCODE_STACK 5
-+
- /* Set-up the unencoding stack from the Content-Encoding header value.
- * See RFC 7231 section 3.1.2.2. */
- CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
- const char *enclist, int maybechunked)
- {
- struct SingleRequest *k = &data->req;
-+ int counter = 0;
-
- do {
- const char *name;
-@@ -1068,6 +1072,11 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
- if(!encoding)
- encoding = &error_encoding; /* Defer error at stack use. */
-
-+ if(++counter >= MAX_ENCODE_STACK) {
-+ failf(data, "Reject response due to %u content encodings",
-+ counter);
-+ return CURLE_BAD_CONTENT_ENCODING;
-+ }
- /* Stack the unencoding stage. */
- writer = new_unencoding_writer(data, encoding, k->writer_stack);
- if(!writer)