File curl-CVE-2022-27776-strcasecompare.patch of Package curl.24055

Overview Repositories Revisions Requests Users Attributes Meta

File curl-CVE-2022-27776-strcasecompare.patch of Package curl.24055

Index: curl-7.37.0/lib/strequal.c
===================================================================
--- curl-7.37.0.orig/lib/strequal.c
+++ curl-7.37.0/lib/strequal.c
@@ -27,6 +27,7 @@
 #endif
 
 #include "strequal.h"
+#include "rawstr.h"
 
 /*
  * @unittest: 1301
@@ -77,3 +78,29 @@ int curl_strnequal(const char *first, co
   return toupper(*first) == toupper(*second);
 #endif
 }
+
+
+/*
+ * Curl_strcasecompare() is for doing "raw" case insensitive strings. This is
+ * meant to be locale independent and only compare strings we know are safe
+ * for this.  See
+ * https://daniel.haxx.se/blog/2008/10/15/strcasecmp-in-turkish/ for some
+ * further explanation to why this function is necessary.
+ *
+ * @unittest: 1301
+ */
+
+int Curl_strcasecompare(const char *first, const char *second)
+{
+  while(*first && *second) {
+    if(Curl_raw_toupper(*first) != Curl_raw_toupper(*second))
+      /* get out of the loop as soon as they don't match */
+      break;
+    first++;
+    second++;
+  }
+  /* we do the comparison here (possibly again), just to make sure that if the
+     loop above is skipped because one of the strings reached zero, we must not
+     return this as a successful match */
+  return (Curl_raw_toupper(*first) == Curl_raw_toupper(*second));
+}
\ No newline at end of file
Index: curl-7.37.0/lib/strequal.h
===================================================================
--- curl-7.37.0.orig/lib/strequal.h
+++ curl-7.37.0/lib/strequal.h
@@ -27,5 +27,8 @@
 #define strequal(a,b) curl_strequal(a,b)
 #define strnequal(a,b,c) curl_strnequal(a,b,c)
 
+#define strcasecompare(a,b) Curl_strcasecompare(a,b)
+int Curl_strcasecompare(const char *first, const char *second);
+
 #endif /* HEADER_CURL_STREQUAL_H */
 
Index: curl-7.37.0/lib/rawstr.c
===================================================================
--- curl-7.37.0.orig/lib/rawstr.c
+++ curl-7.37.0/lib/rawstr.c
@@ -24,64 +24,12 @@
 
 #include "rawstr.h"
 
-/* Portable, consistent toupper (remember EBCDIC). Do not use toupper() because
-   its behavior is altered by the current locale. */
+/* Portable, consistent toupper. Do not use toupper() because its behavior is
+   altered by the current locale. */
 char Curl_raw_toupper(char in)
 {
-  switch (in) {
-  case 'a':
-    return 'A';
-  case 'b':
-    return 'B';
-  case 'c':
-    return 'C';
-  case 'd':
-    return 'D';
-  case 'e':
-    return 'E';
-  case 'f':
-    return 'F';
-  case 'g':
-    return 'G';
-  case 'h':
-    return 'H';
-  case 'i':
-    return 'I';
-  case 'j':
-    return 'J';
-  case 'k':
-    return 'K';
-  case 'l':
-    return 'L';
-  case 'm':
-    return 'M';
-  case 'n':
-    return 'N';
-  case 'o':
-    return 'O';
-  case 'p':
-    return 'P';
-  case 'q':
-    return 'Q';
-  case 'r':
-    return 'R';
-  case 's':
-    return 'S';
-  case 't':
-    return 'T';
-  case 'u':
-    return 'U';
-  case 'v':
-    return 'V';
-  case 'w':
-    return 'W';
-  case 'x':
-    return 'X';
-  case 'y':
-    return 'Y';
-  case 'z':
-    return 'Z';
-  }
+  if(in >= 'a' && in <= 'z')
+    return (char)('A' + in - 'a');
   return in;
 }

Places

File curl-CVE-2022-27776-strcasecompare.patch of Package curl.24055

Places