diff options
| author | sunpoet <sunpoet@FreeBSD.org> | 2017-04-06 03:56:58 +0800 |
|---|---|---|
| committer | sunpoet <sunpoet@FreeBSD.org> | 2017-04-06 03:56:58 +0800 |
| commit | 411d9a5d6e37b2dc253ebaa28d5f47110ab757aa (patch) | |
| tree | 31f4f6901cf85a51871c994f7e514d92db7ee5ad /ftp | |
| parent | de55e8522770282e5d5d7822a415dac44e1bcdf5 (diff) | |
| download | freebsd-ports-gnome-411d9a5d6e37b2dc253ebaa28d5f47110ab757aa.tar.gz freebsd-ports-gnome-411d9a5d6e37b2dc253ebaa28d5f47110ab757aa.tar.zst freebsd-ports-gnome-411d9a5d6e37b2dc253ebaa28d5f47110ab757aa.zip | |
Fix CVE-2017-7407
- Bump PORTREVISION for package change
Obtained from: https://curl.haxx.se/CVE-2017-7407.patch
https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13
https://github.com/curl/curl/commit/8e65877870c1fac920b65219adec720df810aab9
Security: 04f29189-1a05-11e7-bc6e-b499baebfeaf
MFH: 2017Q2
Diffstat (limited to 'ftp')
| -rw-r--r-- | ftp/curl/Makefile | 1 | ||||
| -rw-r--r-- | ftp/curl/files/patch-CVE-2017-7407 | 164 |
2 files changed, 165 insertions, 0 deletions
diff --git a/ftp/curl/Makefile b/ftp/curl/Makefile index a0a890bf51df..62f34f6d6384 100644 --- a/ftp/curl/Makefile +++ b/ftp/curl/Makefile @@ -3,6 +3,7 @@ PORTNAME= curl PORTVERSION= 7.53.1 +PORTREVISION= 1 CATEGORIES= ftp net www MASTER_SITES= http://curl.haxx.se/download/ \ LOCAL/sunpoet diff --git a/ftp/curl/files/patch-CVE-2017-7407 b/ftp/curl/files/patch-CVE-2017-7407 new file mode 100644 index 000000000000..5b9fd25d91e3 --- /dev/null +++ b/ftp/curl/files/patch-CVE-2017-7407 @@ -0,0 +1,164 @@ +From 6019f1795b4e3b72507b84b0e02dc8c32024f562 Mon Sep 17 00:00:00 2001 +From: Dan Fandrich <dan@coneharvesters.com> +Date: Sat, 11 Mar 2017 10:59:34 +0100 +Subject: [PATCH] CVE-2017-7407: fixed + +Bug: https://curl.haxx.se/docs/adv_20170403.html + +Reported-by: Brian Carpenter +--- src/tool_writeout.c.orig 2017-01-13 09:55:20 UTC ++++ src/tool_writeout.c +@@ -5,7 +5,7 @@ + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * +- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al. ++ * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms +@@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutS + double doubleinfo; + + while(ptr && *ptr) { +- if('%' == *ptr) { ++ if('%' == *ptr && ptr[1]) { + if('%' == ptr[1]) { + /* an escaped %-letter */ + fputc('%', stream); +@@ -341,7 +341,7 @@ void ourWriteOut(CURL *curl, struct OutS + } + } + } +- else if('\\' == *ptr) { ++ else if('\\' == *ptr && ptr[1]) { + switch(ptr[1]) { + case 'r': + fputc('\r', stream); + src/tool_writeout.c | 6 +++--- + tests/data/Makefile.inc | 2 +- + tests/data/test1440 | 31 +++++++++++++++++++++++++++++++ + tests/data/test1441 | 31 +++++++++++++++++++++++++++++++ + tests/data/test1442 | 35 +++++++++++++++++++++++++++++++++++ + 5 files changed, 101 insertions(+), 4 deletions(-) + create mode 100644 tests/data/test1440 + create mode 100644 tests/data/test1441 + create mode 100644 tests/data/test1442 + +--- tests/data/Makefile.inc.orig 2017-02-21 07:09:13 UTC ++++ tests/data/Makefile.inc +@@ -151,7 +151,7 @@ test1408 test1409 test1410 test1411 test + test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \ + test1424 \ + test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \ +-test1436 test1437 test1438 test1439 \ ++test1436 test1437 test1438 test1439 test1440 test1441 test1442 \ + \ + test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \ + test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \ +--- tests/data/test1440.orig 2017-04-05 17:06:44 UTC ++++ tests/data/test1440 +@@ -0,0 +1,31 @@ ++<testcase> ++<info> ++<keywords> ++--write-out ++</keywords> ++</info> ++# Server-side ++<reply> ++</reply> ++ ++# Client-side ++<client> ++<server> ++file ++</server> ++ ++<name> ++Check --write-out with trailing %{ ++</name> ++<command> ++file://localhost/%PWD/log/ --write-out '%{' ++</command> ++</client> ++ ++# Verify data ++<verify> ++<stdout nonewline="yes"> ++%{ ++</stdout> ++</verify> ++</testcase> +--- tests/data/test1441.orig 2017-04-05 17:06:44 UTC ++++ tests/data/test1441 +@@ -0,0 +1,31 @@ ++<testcase> ++<info> ++<keywords> ++--write-out ++</keywords> ++</info> ++# Server-side ++<reply> ++</reply> ++ ++# Client-side ++<client> ++<server> ++file ++</server> ++ ++<name> ++Check --write-out with trailing % ++</name> ++<command> ++file://localhost/%PWD/log/ --write-out '%' ++</command> ++</client> ++ ++# Verify data ++<verify> ++<stdout nonewline="yes"> ++% ++</stdout> ++</verify> ++</testcase> +--- tests/data/test1442.orig 2017-04-05 17:06:44 UTC ++++ tests/data/test1442 +@@ -0,0 +1,35 @@ ++<testcase> ++<info> ++<keywords> ++--write-out ++FILE ++</keywords> ++</info> ++# Server-side ++<reply> ++</reply> ++ ++# Client-side ++<client> ++<server> ++file ++</server> ++ ++<name> ++Check --write-out with trailing \ ++</name> ++<command> ++file://localhost/%PWD/log/non-existent-file.txt --write-out '\' ++</command> ++</client> ++ ++# Verify data ++<verify> ++<errorcode> ++37 ++</errorcode> ++<stdout nonewline="yes"> ++\ ++</stdout> ++</verify> ++</testcase> |