Skip to content

Commit 5b772da

Browse files
amitkarsaleamitkarsale
committed
(PA-6878) Patch agent-runtime-7.x and main Curl for CVE-2024-7264 
1 parent d9873e5 commit 5b772da

File tree

3 files changed

+265
-2
lines changed

3 files changed

+265
-2
lines changed

‎configs/components/curl.rb

+2-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
case version
77
when '7.88.1'
88
pkg.sha256sum 'cdb38b72e36bc5d33d5b8810f8018ece1baa29a8f215b4495e495ded82bbf3c7'
9-
when '8.7.1'
9+
when '8.9.1'
1010
pkg.sha256sum 'f91249c87f68ea00cf27c44fdfa5a78423e41e71b7d408e5901a9896d905c495'
1111
else
1212
raise "curl version #{version} has not been configured; Cannot continue."
@@ -47,6 +47,7 @@
4747
pkg.apply_patch 'resources/patches/curl/CVE-2023-46218.patch'
4848
pkg.apply_patch 'resources/patches/curl/CVE-2024-2004.patch'
4949
pkg.apply_patch 'resources/patches/curl/CVE-2024-2398.patch'
50+
pkg.apply_patch 'resources/patches/curl/CVE-2024-7264.patch'
5051
end
5152

5253
configure_options = []

‎configs/projects/agent-runtime-main.rb

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
proj.setting :augeas_version, '1.14.1'
1515
end
1616

17-
proj.setting :curl_version, '8.7.1'
17+
proj.setting :curl_version, '8.9.1'
1818

1919
########
2020
# Load shared agent settings

‎resources/patches/curl/CVE-2024-7264.patch

+262
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
--- a/lib/x509asn1.c
2+
+++ b/lib/x509asn1.c
3+
@@ -493,12 +493,13 @@ static const char *GTime2str(const char
4+
fracl = 0; /* no fractional seconds detected so far */
5+
if(fracp < end && (*fracp == '.' || *fracp == ',')) {
6+
/* Have fractional seconds, e.g. "[.,]\d+". How many? */
7+
- tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
8+
+ fracp++; /* should be a digit char or BAD ARGUMENT */
9+
+ tzp = fracp;
10+
while(tzp < end && ISDIGIT(*tzp))
11+
tzp++;
12+
if(tzp == fracp) /* never looped, no digit after [.,] */
13+
return CURLE_BAD_FUNCTION_ARGUMENT;
14+
- fracl = tzp - fracp - 1; /* number of fractional sec digits */
15+
+ fracl = tzp - fracp; /* number of fractional sec digits */
16+
DEBUGASSERT(fracl > 0);
17+
/* Strip trailing zeroes in fractional seconds.
18+
* May reduce fracl to 0 if only '0's are present. */
19+
@@ -507,18 +508,24 @@ static const char *GTime2str(const char
20+
}
21+
22+
/* Process timezone. */
23+
- if(tzp >= end)
24+
- ; /* Nothing to do. */
25+
+ if(tzp >= end) {
26+
+ tzp = "";
27+
+ tzl = 0;
28+
+ }
29+
else if(*tzp == 'Z') {
30+
- tzp = " GMT";
31+
- end = tzp + 4;
32+
+ sep = " ";
33+
+ tzp = "GMT";
34+
+ tzl = 3;
35+
+ }
36+
+ else if((*tzp == '+') || (*tzp == '-')) {
37+
+ sep = " UTC";
38+
+ tzl = end - tzp;
39+
}
40+
else {
41+
sep = " ";
42+
- tzp++;
43+
+ tzl = end - tzp;
44+
}
45+
46+
- tzl = end - tzp;
47+
return curl_maprintf("%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
48+
beg, beg + 4, beg + 6,
49+
beg + 8, beg + 10, sec1, sec2,
50+
@@ -526,6 +533,15 @@ static const char *GTime2str(const char
51+
sep, tzl, tzp);
52+
}
53+
54+
+#ifdef UNITTESTS
55+
+/* used by unit1656.c */
56+
+CURLcode Curl_x509_GTime2str(struct dynbuf *store,
57+
+ const char *beg, const char *end)
58+
+{
59+
+ return GTime2str(store, beg, end);
60+
+}
61+
+#endif
62+
+
63+
/*
64+
* Convert an ASN.1 UTC time to a printable string.
65+
* Return the dynamically allocated string, or NULL if an error occurs.
66+
--- a/lib/x509asn1.h
67+
+++ b/lib/x509asn1.h
68+
@@ -130,5 +130,16 @@ CURLcode Curl_extract_certinfo(struct co
69+
const char *beg, const char *end);
70+
CURLcode Curl_verifyhost(struct connectdata *conn,
71+
const char *beg, const char *end);
72+
+
73+
+#ifdef UNITTESTS
74+
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
75+
+ defined(USE_MBEDTLS)
76+
+
77+
+/* used by unit1656.c */
78+
+CURLcode Curl_x509_GTime2str(struct dynbuf *store,
79+
+ const char *beg, const char *end);
80+
+#endif
81+
+#endif
82+
+
83+
#endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL */
84+
#endif /* HEADER_CURL_X509ASN1_H */
85+
--- /dev/null
86+
+++ b/tests/data/test1656
87+
@@ -0,0 +1,22 @@
88+
+<testcase>
89+
+<info>
90+
+<keywords>
91+
+unittest
92+
+Curl_x509_GTime2str
93+
+</keywords>
94+
+</info>
95+
+
96+
+#
97+
+# Client-side
98+
+<client>
99+
+<server>
100+
+none
101+
+</server>
102+
+<features>
103+
+unittest
104+
+</features>
105+
+<name>
106+
+Curl_x509_GTime2str unit tests
107+
+</name>
108+
+</client>
109+
+</testcase>
110+
--- a/tests/unit/Makefile.inc
111+
+++ b/tests/unit/Makefile.inc
112+
@@ -11,7 +11,7 @@ UNITPROGS = unit1300 unit1301 unit1302 u
113+
unit1399 \
114+
unit1600 unit1601 unit1602 unit1603 unit1604 unit1605 unit1606 unit1607 \
115+
unit1608 unit1609 unit1620 unit1621 \
116+
- unit1650 unit1651 unit1652 unit1653 unit1654 unit1655
117+
+ unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 unit1656
118+
119+
unit1300_SOURCES = unit1300.c $(UNITFILES)
120+
unit1300_CPPFLAGS = $(AM_CPPFLAGS)
121+
@@ -122,3 +122,5 @@ unit1654_CPPFLAGS = $(AM_CPPFLAGS)
122+
unit1655_SOURCES = unit1655.c $(UNITFILES)
123+
unit1655_CPPFLAGS = $(AM_CPPFLAGS)
124+
125+
+unit1656_SOURCES = unit1656.c $(UNITFILES)
126+
+
127+
--- /dev/null
128+
+++ b/tests/unit/unit1656.c
129+
@@ -0,0 +1,133 @@
130+
+/***************************************************************************
131+
+ * _ _ ____ _
132+
+ * Project ___| | | | _ \| |
133+
+ * / __| | | | |_) | |
134+
+ * | (__| |_| | _ <| |___
135+
+ * \___|\___/|_| \_\_____|
136+
+ *
137+
+ * Copyright (C) Daniel Stenberg, <[email protected]>, et al.
138+
+ *
139+
+ * This software is licensed as described in the file COPYING, which
140+
+ * you should have received as part of this distribution. The terms
141+
+ * are also available at https://curl.se/docs/copyright.html.
142+
+ *
143+
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
144+
+ * copies of the Software, and permit persons to whom the Software is
145+
+ * furnished to do so, under the terms of the COPYING file.
146+
+ *
147+
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
148+
+ * KIND, either express or implied.
149+
+ *
150+
+ * SPDX-License-Identifier: curl
151+
+ *
152+
+ ***************************************************************************/
153+
+#include "curlcheck.h"
154+
+
155+
+#include "vtls/x509asn1.h"
156+
+
157+
+static CURLcode unit_setup(void)
158+
+{
159+
+ return CURLE_OK;
160+
+}
161+
+
162+
+static void unit_stop(void)
163+
+{
164+
+
165+
+}
166+
+
167+
+#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
168+
+ defined(USE_MBEDTLS)
169+
+
170+
+#ifndef ARRAYSIZE
171+
+#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
172+
+#endif
173+
+
174+
+struct test_spec {
175+
+ const char *input;
176+
+ const char *exp_output;
177+
+ CURLcode exp_result;
178+
+};
179+
+
180+
+static struct test_spec test_specs[] = {
181+
+ { "190321134340", "1903-21-13 43:40:00", CURLE_OK },
182+
+ { "", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
183+
+ { "WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
184+
+ { "0WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
185+
+ { "19032113434", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
186+
+ { "19032113434WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
187+
+ { "190321134340.", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
188+
+ { "190321134340.1", "1903-21-13 43:40:00.1", CURLE_OK },
189+
+ { "19032113434017.0", "1903-21-13 43:40:17", CURLE_OK },
190+
+ { "19032113434017.01", "1903-21-13 43:40:17.01", CURLE_OK },
191+
+ { "19032113434003.001", "1903-21-13 43:40:03.001", CURLE_OK },
192+
+ { "19032113434003.090", "1903-21-13 43:40:03.09", CURLE_OK },
193+
+ { "190321134340Z", "1903-21-13 43:40:00 GMT", CURLE_OK },
194+
+ { "19032113434017.0Z", "1903-21-13 43:40:17 GMT", CURLE_OK },
195+
+ { "19032113434017.01Z", "1903-21-13 43:40:17.01 GMT", CURLE_OK },
196+
+ { "19032113434003.001Z", "1903-21-13 43:40:03.001 GMT", CURLE_OK },
197+
+ { "19032113434003.090Z", "1903-21-13 43:40:03.09 GMT", CURLE_OK },
198+
+ { "190321134340CET", "1903-21-13 43:40:00 CET", CURLE_OK },
199+
+ { "19032113434017.0CET", "1903-21-13 43:40:17 CET", CURLE_OK },
200+
+ { "19032113434017.01CET", "1903-21-13 43:40:17.01 CET", CURLE_OK },
201+
+ { "190321134340+02:30", "1903-21-13 43:40:00 UTC+02:30", CURLE_OK },
202+
+ { "19032113434017.0+02:30", "1903-21-13 43:40:17 UTC+02:30", CURLE_OK },
203+
+ { "19032113434017.01+02:30", "1903-21-13 43:40:17.01 UTC+02:30", CURLE_OK },
204+
+ { "190321134340-3", "1903-21-13 43:40:00 UTC-3", CURLE_OK },
205+
+ { "19032113434017.0-04", "1903-21-13 43:40:17 UTC-04", CURLE_OK },
206+
+ { "19032113434017.01-01:10", "1903-21-13 43:40:17.01 UTC-01:10", CURLE_OK },
207+
+};
208+
+
209+
+static bool do_test(struct test_spec *spec, size_t i, struct dynbuf *dbuf)
210+
+{
211+
+ CURLcode result;
212+
+ const char *in = spec->input;
213+
+
214+
+ Curl_dyn_reset(dbuf);
215+
+ result = Curl_x509_GTime2str(dbuf, in, in + strlen(in));
216+
+ if(result != spec->exp_result) {
217+
+ fprintf(stderr, "test %zu: expect result %d, got %d\n",
218+
+ i, spec->exp_result, result);
219+
+ return FALSE;
220+
+ }
221+
+ else if(!result && strcmp(spec->exp_output, Curl_dyn_ptr(dbuf))) {
222+
+ fprintf(stderr, "test %zu: input '%s', expected output '%s', got '%s'\n",
223+
+ i, in, spec->exp_output, Curl_dyn_ptr(dbuf));
224+
+ return FALSE;
225+
+ }
226+
+
227+
+ return TRUE;
228+
+}
229+
+
230+
+UNITTEST_START
231+
+{
232+
+ size_t i;
233+
+ struct dynbuf dbuf;
234+
+ bool all_ok = TRUE;
235+
+
236+
+ Curl_dyn_init(&dbuf, 32*1024);
237+
+
238+
+ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
239+
+ fprintf(stderr, "curl_global_init() failed\n");
240+
+ return TEST_ERR_MAJOR_BAD;
241+
+ }
242+
+
243+
+ for(i = 0; i < ARRAYSIZE(test_specs); ++i) {
244+
+ if(!do_test(&test_specs[i], i, &dbuf))
245+
+ all_ok = FALSE;
246+
+ }
247+
+ fail_unless(all_ok, "some tests of Curl_x509_GTime2str() fails");
248+
+
249+
+ Curl_dyn_free(&dbuf);
250+
+ curl_global_cleanup();
251+
+}
252+
+UNITTEST_STOP
253+
+
254+
+#else
255+
+
256+
+UNITTEST_START
257+
+{
258+
+ puts("not tested since Curl_x509_GTime2str() is not built-in");
259+
+}
260+
+UNITTEST_STOP
261+
+
262+
+#endif

0 commit comments

Comments
 (0)