diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2014-10-17 12:59:32 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2014-11-05 08:05:14 +0100 |
| commit | b3875606925536f82fc61f3114ac42f29eaf6945 (patch) | |
| tree | 229666d262222b2f34967e00fb5300ec69cda258 /src/tool_strdup.h | |
| parent | d997c8b2f6521d78c6ef63411cfeb226f7927281 (diff) | |
| download | curl-b3875606925536f82fc61f3114ac42f29eaf6945.tar.gz | |
curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds
When duplicating a handle, the data to post was duplicated using
strdup() when it could be binary and contain zeroes and it was not even
zero terminated! This caused read out of bounds crashes/segfaults.
Since the lib/strdup.c file no longer is easily shared with the curl
tool with this change, it now uses its own version instead.
Bug: http://curl.haxx.se/docs/adv_20141105.html
CVE: CVE-2014-3707
Reported-By: Symeon Paraschoudis
Diffstat (limited to 'src/tool_strdup.h')
| -rw-r--r-- | src/tool_strdup.h | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/src/tool_strdup.h b/src/tool_strdup.h new file mode 100644 index 000000000..83c8102c3 --- /dev/null +++ b/src/tool_strdup.h @@ -0,0 +1,30 @@ +#ifndef HEADER_TOOL_STRDUP_H +#define HEADER_TOOL_STRDUP_H +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at http://curl.haxx.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + ***************************************************************************/ +#include "tool_setup.h" + +#ifndef HAVE_STRDUP +extern char *strdup(const char *str); +#endif + +#endif /* HEADER_TOOL_STRDUP_H */ |