File curl-7.37.0-CVE-2018-14618.patch of Package curl.10931

Overview Repositories Revisions Requests Users Attributes Meta

File curl-7.37.0-CVE-2018-14618.patch of Package curl.10931

From 257c805e30b660d7ba44121b0d216f788ce15c99 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 13 Aug 2018 10:35:52 +0200
Subject: [PATCH] Curl_ntlm_core_mk_nt_hash: return error on too long password

... since it would cause an integer overflow if longer than (max size_t
/ 2).
---
 lib/curl_ntlm_core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Index: curl-7.37.0/lib/curl_ntlm_core.c
===================================================================
--- curl-7.37.0.orig/lib/curl_ntlm_core.c
+++ curl-7.37.0/lib/curl_ntlm_core.c
@@ -420,8 +420,11 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struc
                                    unsigned char *ntbuffer /* 21 bytes */)
 {
   size_t len = strlen(password);
-  unsigned char *pw = malloc(len * 2);
+  unsigned char *pw;
   CURLcode result;
+  if(len > SIZE_T_MAX/2) /* avoid integer overflow */
+    return CURLE_OUT_OF_MEMORY;
+  pw = len ? malloc(len * 2) : strdup("");
   if(!pw)
     return CURLE_OUT_OF_MEMORY;
 
@@ -492,12 +495,6 @@ CURLcode Curl_hmac_md5(const unsigned ch
   return CURLE_OK;
 }
 
-#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
-#define SIZE_T_MAX 18446744073709551615U
-#else
-#define SIZE_T_MAX 4294967295U
-#endif
-
 /* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode
  * (uppercase UserName + Domain) as the data
  */
Index: curl-7.37.0/lib/curl_setup.h
===================================================================
--- curl-7.37.0.orig/lib/curl_setup.h
+++ curl-7.37.0/lib/curl_setup.h
@@ -409,6 +409,15 @@
 #  endif
 #endif
 
+#ifndef SIZE_T_MAX
+/* some limits.h headers have this defined, some don't */
+#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
+#define SIZE_T_MAX 18446744073709551615U
+#else
+#define SIZE_T_MAX 4294967295U
+#endif
+#endif
+
 /*
  * Arg 2 type for gethostname in case it hasn't been defined in config file.
  */

Places

File curl-7.37.0-CVE-2018-14618.patch of Package curl.10931

Places