File curl-CVE-2016-8616.patch of Package curl

Overview Repositories Revisions Requests Users Attributes Meta

File curl-CVE-2016-8616.patch of Package curl

From 62fd988392b5a0410a01a9d8f3c470280350b4c5 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 27 Sep 2016 18:01:53 +0200
Subject: [PATCH] connectionexists: use case sensitive user/password
 comparisons

---
 lib/url.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

Index: curl-7.37.0/lib/url.c
===================================================================
--- curl-7.37.0.orig/lib/url.c	2016-10-21 14:03:03.633663341 +0200
+++ curl-7.37.0/lib/url.c	2016-10-21 14:03:27.405824069 +0200
@@ -3103,8 +3103,8 @@ ConnectionExists(struct SessionHandle *d
       if(!(needle->handler->flags & PROTOPT_CREDSPERREQUEST)) {
         /* This protocol requires credentials per connection,
            so verify that we're using the same name and password as well */
-        if(!strequal(needle->user, check->user) ||
-           !strequal(needle->passwd, check->passwd)) {
+        if(strcmp(needle->user, check->user) ||
+           strcmp(needle->passwd, check->passwd)) {
           /* one of them was different */
           continue;
         }
@@ -3165,8 +3165,8 @@ ConnectionExists(struct SessionHandle *d
            possible. (Especially we must not reuse the same connection if
            partway through a handshake!) */
         if(wantNTLMhttp) {
-          if(!strequal(needle->user, check->user) ||
-             !strequal(needle->passwd, check->passwd))
+          if(strcmp(needle->user, check->user) ||
+             strcmp(needle->passwd, check->passwd))
             continue;
         }
         else if(check->ntlm.state != NTLMSTATE_NONE) {
@@ -3176,8 +3176,8 @@ ConnectionExists(struct SessionHandle *d
 
         /* Same for Proxy NTLM authentication */
         if(wantProxyNTLMhttp) {
-          if(!strequal(needle->proxyuser, check->proxyuser) ||
-             !strequal(needle->proxypasswd, check->proxypasswd))
+          if(strcmp(needle->proxyuser, check->proxyuser) ||
+             strcmp(needle->proxypasswd, check->proxypasswd))
             continue;
         }
         else if(check->proxyntlm.state != NTLMSTATE_NONE) {

Places

File curl-CVE-2016-8616.patch of Package curl

Places