From: RISCi_ATOM Date: Mon, 1 Oct 2018 19:52:08 +0000 (-0400) Subject: Bump bzip2 and curl X-Git-Tag: v1.4.5~3 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=c80aa0d476c447ae9f49ab4a1127ac792d0927a8;p=librecmc%2Flibrecmc.git Bump bzip2 and curl --- diff --git a/package/network/utils/curl/Config.in b/package/network/utils/curl/Config.in index 6fa10b6781..9afeb00bc7 100644 --- a/package/network/utils/curl/Config.in +++ b/package/network/utils/curl/Config.in @@ -9,8 +9,8 @@ choice config LIBCURL_MBEDTLS bool "mbed TLS" - config LIBCURL_CYASSL - bool "CyaSSL" + config LIBCURL_WOLFSSL + bool "wolfSSL" config LIBCURL_OPENSSL bool "OpenSSL" @@ -101,6 +101,10 @@ config LIBCURL_TFTP bool "TFTP protocol" default n +config LIBCURL_NGHTTP2 + bool "HTTP2 protocol" + default n + comment "Miscellaneous" config LIBCURL_PROXY @@ -115,8 +119,8 @@ config LIBCURL_TLS_SRP bool "Enable TLS-SRP authentication" default n -config LIBCURL_LIBIDN - bool "Enable IDN support" +config LIBCURL_LIBIDN2 + bool "Enable IDN2 support" default n config LIBCURL_THREADED_RESOLVER diff --git a/package/network/utils/curl/Makefile b/package/network/utils/curl/Makefile index 07056a2cd0..db726407b9 100644 --- a/package/network/utils/curl/Makefile +++ b/package/network/utils/curl/Makefile @@ -8,20 +8,19 @@ include $(TOPDIR)/rules.mk PKG_NAME:=curl -PKG_VERSION:=7.52.1 -PKG_RELEASE:=8 - -PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 -PKG_SOURCE_URL:=http://curl.haxx.se/download/ \ - http://www.mirrorspace.org/curl/ \ - ftp://ftp.sunet.se/pub/www/utilities/curl/ \ - ftp://ftp.planetmirror.com/pub/curl/ \ - http://www.mirrormonster.com/curl/download/ \ - http://curl.mirrors.cyberservers.net/download/ -PKG_HASH:=d16185a767cb2c1ba3d5b9096ec54e5ec198b213f45864a38b3bda4bbf87389b +PKG_VERSION:=7.60.0 +PKG_RELEASE:=3 + +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz +PKG_SOURCE_URL:=https://dl.uxnr.de/mirror/curl/ \ + http://curl.mirror.anstey.ca/ \ + http://curl.askapache.com/download/ \ + https://curl.haxx.se/download/ +PKG_HASH:=8736ff8ded89ddf7e926eec7b16f82597d029fc1469f3a551f1fafaac164e6a0 PKG_LICENSE:=MIT PKG_LICENSE_FILES:=COPYING +PKG_CPE_ID:=cpe:/a:haxx:libcurl PKG_FIXUP:=autoreconf PKG_BUILD_PARALLEL:=1 @@ -29,13 +28,13 @@ PKG_BUILD_PARALLEL:=1 PKG_CONFIG_DEPENDS:= \ CONFIG_IPV6 \ \ - CONFIG_LIBCURL_CYASSL \ + CONFIG_LIBCURL_WOLFSSL \ CONFIG_LIBCURL_GNUTLS \ CONFIG_LIBCURL_OPENSSL \ CONFIG_LIBCURL_MBEDTLS \ CONFIG_LIBCURL_NOSSL \ \ - CONFIG_LIBCURL_LIBIDN \ + CONFIG_LIBCURL_LIBIDN2 \ CONFIG_LIBCURL_SSH2 \ CONFIG_LIBCURL_ZLIB \ \ @@ -55,6 +54,7 @@ PKG_CONFIG_DEPENDS:= \ CONFIG_LIBCURL_SMTP \ CONFIG_LIBCURL_TELNET \ CONFIG_LIBCURL_TFTP \ + CONFIG_LIBCURL_NGHTTP2 \ \ CONFIG_LIBCURL_COOKIES \ CONFIG_LIBCURL_CRYPTO_AUTH \ @@ -86,8 +86,9 @@ define Package/libcurl $(call Package/curl/Default) SECTION:=libs CATEGORY:=Libraries - DEPENDS:= +LIBCURL_CYASSL:libcyassl +LIBCURL_OPENSSL:libopenssl +LIBCURL_GNUTLS:libgnutls +LIBCURL_MBEDTLS:libmbedtls - DEPENDS += +LIBCURL_ZLIB:zlib +LIBCURL_THREADED_RESOLVER:libpthread +LIBCURL_LDAP:libopenldap +LIBCURL_LIBIDN:libidn +LIBCURL_SSH2:libssh2 + DEPENDS:= +LIBCURL_WOLFSSL:libwolfssl +LIBCURL_OPENSSL:libopenssl +LIBCURL_GNUTLS:libgnutls +LIBCURL_MBEDTLS:libmbedtls + DEPENDS += +LIBCURL_ZLIB:zlib +LIBCURL_THREADED_RESOLVER:libpthread +LIBCURL_LDAP:libopenldap +LIBCURL_LIBIDN2:libidn2 + DEPENDS += +LIBCURL_SSH2:libssh2 +LIBCURL_NGHTTP2:libnghttp2 TITLE:=A client-side URL transfer library MENU:=1 endef @@ -110,17 +111,19 @@ CONFIGURE_ARGS += \ --without-nss \ --without-libmetalink \ --without-librtmp \ + --without-libidn \ \ $(call autoconf_bool,CONFIG_IPV6,ipv6) \ \ - $(if $(CONFIG_LIBCURL_CYASSL),--with-cyassl="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-cyassl) \ + $(if $(CONFIG_LIBCURL_WOLFSSL),--with-cyassl="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-cyassl) \ $(if $(CONFIG_LIBCURL_GNUTLS),--with-gnutls="$(STAGING_DIR)/usr" --without-ca-bundle --with-ca-path=/etc/ssl/certs,--without-gnutls) \ $(if $(CONFIG_LIBCURL_OPENSSL),--with-ssl="$(STAGING_DIR)/usr" --without-ca-bundle --with-ca-path=/etc/ssl/certs,--without-ssl) \ $(if $(CONFIG_LIBCURL_MBEDTLS),--with-mbedtls="$(STAGING_DIR)/usr" --without-ca-path --with-ca-bundle=/etc/ssl/certs/ca-certificates.crt,--without-mbedtls) \ \ - $(if $(CONFIG_LIBCURL_LIBIDN),--with-libidn="$(STAGING_DIR)/usr",--without-libidn) \ + $(if $(CONFIG_LIBCURL_LIBIDN2),--with-libidn2="$(STAGING_DIR)/usr",--without-libidn2) \ $(if $(CONFIG_LIBCURL_SSH2),--with-libssh2="$(STAGING_DIR)/usr",--without-libssh2) \ $(if $(CONFIG_LIBCURL_ZLIB),--with-zlib="$(STAGING_DIR)/usr",--without-zlib) \ + $(if $(CONFIG_LIBCURL_NGHTTP2),--with-nghttp2="$(STAGING_DIR)/usr",--without-nghttp2) \ \ $(call autoconf_bool,CONFIG_LIBCURL_DICT,dict) \ $(call autoconf_bool,CONFIG_LIBCURL_FILE,file) \ diff --git a/package/network/utils/curl/patches/001-curl-https-openssl-fix.patch b/package/network/utils/curl/patches/001-curl-https-openssl-fix.patch deleted file mode 100644 index 9658ef554b..0000000000 --- a/package/network/utils/curl/patches/001-curl-https-openssl-fix.patch +++ /dev/null @@ -1,34 +0,0 @@ -From a7b38c9dc98481e4a5fc37e51a8690337c674dfb Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 26 Dec 2016 00:06:33 +0100 -Subject: [PATCH] vtls: s/SSLEAY/OPENSSL - -Fixed an old leftover use of the USE_SSLEAY define which would make a -socket get removed from the applications sockets to monitor when the -multi_socket API was used, leading to timeouts. - -Bug: #1174 ---- - lib/vtls/vtls.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/lib/vtls/vtls.c -+++ b/lib/vtls/vtls.c -@@ -484,7 +484,7 @@ void Curl_ssl_close_all(struct Curl_easy - curlssl_close_all(data); - } - --#if defined(USE_SSLEAY) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \ -+#if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \ - defined(USE_DARWINSSL) || defined(USE_NSS) - /* This function is for OpenSSL, GnuTLS, darwinssl, and schannel only. */ - int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks, -@@ -518,7 +518,7 @@ int Curl_ssl_getsock(struct connectdata - (void)numsocks; - return GETSOCK_BLANK; - } --/* USE_SSLEAY || USE_GNUTLS || USE_SCHANNEL || USE_DARWINSSL || USE_NSS */ -+/* USE_OPENSSL || USE_GNUTLS || USE_SCHANNEL || USE_DARWINSSL || USE_NSS */ - #endif - - void Curl_ssl_close(struct connectdata *conn, int sockindex) diff --git a/package/network/utils/curl/patches/100-CVE-2017-2629.patch b/package/network/utils/curl/patches/100-CVE-2017-2629.patch deleted file mode 100644 index f2cd869c5b..0000000000 --- a/package/network/utils/curl/patches/100-CVE-2017-2629.patch +++ /dev/null @@ -1,33 +0,0 @@ -From a00a42b4abe8363a46071bb3b43b1b7138f5259b Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Sun, 22 Jan 2017 18:11:55 +0100 -Subject: [PATCH] TLS: make SSL_VERIFYSTATUS work again - -The CURLOPT_SSL_VERIFYSTATUS option was not properly handled by libcurl -and thus even if the status couldn't be verified, the connection would -be allowed and the user would not be told about the failed verification. - -Regression since cb4e2be7c6d42ca - -CVE-2017-2629 -Bug: https://curl.haxx.se/docs/adv_20170222.html - -Reported-by: Marcus Hoffmann ---- - lib/url.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/lib/url.c -+++ b/lib/url.c -@@ -4141,8 +4141,11 @@ static struct connectdata *allocate_conn - conn->bits.ftp_use_epsv = data->set.ftp_use_epsv; - conn->bits.ftp_use_eprt = data->set.ftp_use_eprt; - -+ conn->ssl_config.verifystatus = data->set.ssl.primary.verifystatus; - conn->ssl_config.verifypeer = data->set.ssl.primary.verifypeer; - conn->ssl_config.verifyhost = data->set.ssl.primary.verifyhost; -+ conn->proxy_ssl_config.verifystatus = -+ data->set.proxy_ssl.primary.verifystatus; - conn->proxy_ssl_config.verifypeer = data->set.proxy_ssl.primary.verifypeer; - conn->proxy_ssl_config.verifyhost = data->set.proxy_ssl.primary.verifyhost; - diff --git a/package/network/utils/curl/patches/101-CVE-2017-7407.patch b/package/network/utils/curl/patches/101-CVE-2017-7407.patch deleted file mode 100644 index ba8097b0e6..0000000000 --- a/package/network/utils/curl/patches/101-CVE-2017-7407.patch +++ /dev/null @@ -1,165 +0,0 @@ -From 6019f1795b4e3b72507b84b0e02dc8c32024f562 Mon Sep 17 00:00:00 2001 -From: Dan Fandrich -Date: Sat, 11 Mar 2017 10:59:34 +0100 -Subject: [PATCH] CVE-2017-7407: fixed - -Bug: https://curl.haxx.se/docs/adv_20170403.html - -Reported-by: Brian Carpenter ---- - src/tool_writeout.c | 6 +++--- - tests/data/Makefile.inc | 2 +- - tests/data/test1440 | 31 +++++++++++++++++++++++++++++++ - tests/data/test1441 | 31 +++++++++++++++++++++++++++++++ - tests/data/test1442 | 35 +++++++++++++++++++++++++++++++++++ - 5 files changed, 101 insertions(+), 4 deletions(-) - create mode 100644 tests/data/test1440 - create mode 100644 tests/data/test1441 - create mode 100644 tests/data/test1442 - ---- a/src/tool_writeout.c -+++ b/src/tool_writeout.c -@@ -5,7 +5,7 @@ - * | (__| |_| | _ <| |___ - * \___|\___/|_| \_\_____| - * -- * Copyright (C) 1998 - 2016, Daniel Stenberg, , et al. -+ * Copyright (C) 1998 - 2017, Daniel Stenberg, , et al. - * - * This software is licensed as described in the file COPYING, which - * you should have received as part of this distribution. The terms -@@ -113,7 +113,7 @@ void ourWriteOut(CURL *curl, struct OutS - double doubleinfo; - - while(ptr && *ptr) { -- if('%' == *ptr) { -+ if('%' == *ptr && ptr[1]) { - if('%' == ptr[1]) { - /* an escaped %-letter */ - fputc('%', stream); -@@ -341,7 +341,7 @@ void ourWriteOut(CURL *curl, struct OutS - } - } - } -- else if('\\' == *ptr) { -+ else if('\\' == *ptr && ptr[1]) { - switch(ptr[1]) { - case 'r': - fputc('\r', stream); ---- a/tests/data/Makefile.inc -+++ b/tests/data/Makefile.inc -@@ -150,7 +150,7 @@ test1408 test1409 test1410 test1411 test - test1416 test1417 test1418 test1419 test1420 test1421 test1422 test1423 \ - test1424 \ - test1428 test1429 test1430 test1431 test1432 test1433 test1434 test1435 \ --test1436 test1437 test1438 test1439 \ -+test1436 test1437 test1438 test1439 test1440 test1441 test1442 \ - \ - test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \ - test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \ ---- /dev/null -+++ b/tests/data/test1440 -@@ -0,0 +1,31 @@ -+ -+ -+ -+--write-out -+ -+ -+# Server-side -+ -+ -+ -+# Client-side -+ -+ -+file -+ -+ -+ -+Check --write-out with trailing %{ -+ -+ -+file://localhost/%PWD/log/ --write-out '%{' -+ -+ -+ -+# Verify data -+ -+ -+%{ -+ -+ -+ ---- /dev/null -+++ b/tests/data/test1441 -@@ -0,0 +1,31 @@ -+ -+ -+ -+--write-out -+ -+ -+# Server-side -+ -+ -+ -+# Client-side -+ -+ -+file -+ -+ -+ -+Check --write-out with trailing % -+ -+ -+file://localhost/%PWD/log/ --write-out '%' -+ -+ -+ -+# Verify data -+ -+ -+% -+ -+ -+ ---- /dev/null -+++ b/tests/data/test1442 -@@ -0,0 +1,35 @@ -+ -+ -+ -+--write-out -+FILE -+ -+ -+# Server-side -+ -+ -+ -+# Client-side -+ -+ -+file -+ -+ -+ -+Check --write-out with trailing \ -+ -+ -+file://localhost/%PWD/log/non-existent-file.txt --write-out '\' -+ -+ -+ -+# Verify data -+ -+ -+37 -+ -+ -+\ -+ -+ -+ diff --git a/package/network/utils/curl/patches/102-CVE-2017-7468.patch b/package/network/utils/curl/patches/102-CVE-2017-7468.patch deleted file mode 100644 index 72f51455dc..0000000000 --- a/package/network/utils/curl/patches/102-CVE-2017-7468.patch +++ /dev/null @@ -1,264 +0,0 @@ -From 8166b637bce299f4ac64d371c20cd5afea72c364 Mon Sep 17 00:00:00 2001 -From: Jay Satiro -Date: Wed, 22 Mar 2017 01:59:49 -0400 -Subject: [PATCH] TLS: Fix switching off SSL session id when client cert is - used - -- Move the sessionid flag to ssl_primary_config so that ssl and - proxy_ssl will each have their own sessionid flag. - -Regression since HTTPS-Proxy support was added in cb4e2be. Prior to that -this issue had been fixed in 247d890, CVE-2016-5419. - -Bug: https://github.com/curl/curl/issues/1341 -Reported-by: lijian996@users.noreply.github.com ---- - lib/url.c | 5 +++-- - lib/urldata.h | 2 +- - lib/vtls/axtls.c | 4 ++-- - lib/vtls/cyassl.c | 4 ++-- - lib/vtls/darwinssl.c | 2 +- - lib/vtls/gtls.c | 4 ++-- - lib/vtls/mbedtls.c | 4 ++-- - lib/vtls/nss.c | 2 +- - lib/vtls/openssl.c | 4 ++-- - lib/vtls/polarssl.c | 4 ++-- - lib/vtls/schannel.c | 4 ++-- - lib/vtls/vtls.c | 9 ++++++--- - 12 files changed, 26 insertions(+), 22 deletions(-) - ---- a/lib/url.c -+++ b/lib/url.c -@@ -548,7 +548,7 @@ CURLcode Curl_init_userdefined(struct Us - #endif - set->ssh_auth_types = CURLSSH_AUTH_DEFAULT; /* defaults to any auth - type */ -- set->general_ssl.sessionid = TRUE; /* session ID caching enabled by -+ set->ssl.primary.sessionid = TRUE; /* session ID caching enabled by - default */ - set->proxy_ssl = set->ssl; - -@@ -2470,8 +2470,9 @@ CURLcode Curl_setopt(struct Curl_easy *d - break; - - case CURLOPT_SSL_SESSIONID_CACHE: -- data->set.general_ssl.sessionid = (0 != va_arg(param, long)) ? -+ data->set.ssl.primary.sessionid = (0 != va_arg(param, long)) ? - TRUE : FALSE; -+ data->set.proxy_ssl.primary.sessionid = data->set.ssl.primary.sessionid; - break; - - #ifdef USE_LIBSSH2 ---- a/lib/urldata.h -+++ b/lib/urldata.h -@@ -354,6 +354,7 @@ struct ssl_primary_config { - char *random_file; /* path to file containing "random" data */ - char *egdsocket; /* path to file containing the EGD daemon socket */ - char *cipher_list; /* list of ciphers to use */ -+ bool sessionid; /* cache session IDs or not */ - }; - - struct ssl_config_data { -@@ -383,7 +384,6 @@ struct ssl_config_data { - }; - - struct ssl_general_config { -- bool sessionid; /* cache session IDs or not */ - size_t max_ssl_sessions; /* SSL session id cache size */ - }; - ---- a/lib/vtls/axtls.c -+++ b/lib/vtls/axtls.c -@@ -256,7 +256,7 @@ static CURLcode connect_prep(struct conn - * 2) setting up callbacks. these seem gnutls specific - */ - -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - const uint8_t *ssl_sessionid; - size_t ssl_idsize; - -@@ -386,7 +386,7 @@ static CURLcode connect_finish(struct co - conn->send[sockindex] = axtls_send; - - /* Put our freshly minted SSL session in cache */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - const uint8_t *ssl_sessionid = ssl_get_session_id_size(ssl); - size_t ssl_idsize = ssl_get_session_id(ssl); - Curl_ssl_sessionid_lock(conn); ---- a/lib/vtls/cyassl.c -+++ b/lib/vtls/cyassl.c -@@ -383,7 +383,7 @@ cyassl_connect_step1(struct connectdata - #endif /* HAVE_ALPN */ - - /* Check if there's a cached ID we can/should use here! */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - void *ssl_sessionid = NULL; - - Curl_ssl_sessionid_lock(conn); -@@ -597,7 +597,7 @@ cyassl_connect_step3(struct connectdata - - DEBUGASSERT(ssl_connect_3 == connssl->connecting_state); - -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - bool incache; - SSL_SESSION *our_ssl_sessionid; - void *old_ssl_sessionid = NULL; ---- a/lib/vtls/darwinssl.c -+++ b/lib/vtls/darwinssl.c -@@ -1541,7 +1541,7 @@ static CURLcode darwinssl_connect_step1( - #endif /* CURL_BUILD_MAC_10_9 || CURL_BUILD_IOS_7 */ - - /* Check if there's a cached ID we can/should use here! */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - char *ssl_sessionid; - size_t ssl_sessionid_len; - ---- a/lib/vtls/gtls.c -+++ b/lib/vtls/gtls.c -@@ -782,7 +782,7 @@ gtls_connect_step1(struct connectdata *c - - /* This might be a reconnect, so we check for a session ID in the cache - to speed up things */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - void *ssl_sessionid; - size_t ssl_idsize; - -@@ -1311,7 +1311,7 @@ gtls_connect_step3(struct connectdata *c - conn->recv[sockindex] = gtls_recv; - conn->send[sockindex] = gtls_send; - -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - /* we always unconditionally get the session id here, as even if we - already got it from the cache and asked to use it in the connection, it - might've been rejected and then a new one is in use now and we need to ---- a/lib/vtls/mbedtls.c -+++ b/lib/vtls/mbedtls.c -@@ -374,7 +374,7 @@ mbed_connect_step1(struct connectdata *c - mbedtls_ssl_list_ciphersuites()); - - /* Check if there's a cached ID we can/should use here! */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - void *old_session = NULL; - - Curl_ssl_sessionid_lock(conn); -@@ -618,7 +618,7 @@ mbed_connect_step3(struct connectdata *c - - DEBUGASSERT(ssl_connect_3 == connssl->connecting_state); - -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - int ret; - mbedtls_ssl_session *our_ssl_sessionid; - void *old_ssl_sessionid = NULL; ---- a/lib/vtls/nss.c -+++ b/lib/vtls/nss.c -@@ -1696,7 +1696,7 @@ static CURLcode nss_setup_connect(struct - goto error; - - /* do not use SSL cache if disabled or we are not going to verify peer */ -- ssl_no_cache = (data->set.general_ssl.sessionid -+ ssl_no_cache = (SSL_SET_OPTION(primary.sessionid) - && SSL_CONN_CONFIG(verifypeer)) ? PR_FALSE : PR_TRUE; - if(SSL_OptionSet(model, SSL_NO_CACHE, ssl_no_cache) != SECSuccess) - goto error; ---- a/lib/vtls/openssl.c -+++ b/lib/vtls/openssl.c -@@ -2161,7 +2161,7 @@ static CURLcode ossl_connect_step1(struc - #endif - - /* Check if there's a cached ID we can/should use here! */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - void *ssl_sessionid = NULL; - - Curl_ssl_sessionid_lock(conn); -@@ -2915,7 +2915,7 @@ static CURLcode ossl_connect_step3(struc - - DEBUGASSERT(ssl_connect_3 == connssl->connecting_state); - -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - bool incache; - SSL_SESSION *our_ssl_sessionid; - void *old_ssl_sessionid = NULL; ---- a/lib/vtls/polarssl.c -+++ b/lib/vtls/polarssl.c -@@ -327,7 +327,7 @@ polarssl_connect_step1(struct connectdat - ssl_set_ciphersuites(&connssl->ssl, ssl_list_ciphersuites()); - - /* Check if there's a cached ID we can/should use here! */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - void *old_session = NULL; - - Curl_ssl_sessionid_lock(conn); -@@ -555,7 +555,7 @@ polarssl_connect_step3(struct connectdat - - DEBUGASSERT(ssl_connect_3 == connssl->connecting_state); - -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - int ret; - ssl_session *our_ssl_sessionid; - void *old_ssl_sessionid = NULL; ---- a/lib/vtls/schannel.c -+++ b/lib/vtls/schannel.c -@@ -145,7 +145,7 @@ schannel_connect_step1(struct connectdat - connssl->cred = NULL; - - /* check for an existing re-usable credential handle */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - Curl_ssl_sessionid_lock(conn); - if(!Curl_ssl_getsessionid(conn, (void **)&old_cred, NULL, sockindex)) { - connssl->cred = old_cred; -@@ -714,7 +714,7 @@ schannel_connect_step3(struct connectdat - #endif - - /* save the current session data for possible re-use */ -- if(data->set.general_ssl.sessionid) { -+ if(SSL_SET_OPTION(primary.sessionid)) { - bool incache; - struct curl_schannel_cred *old_cred = NULL; - ---- a/lib/vtls/vtls.c -+++ b/lib/vtls/vtls.c -@@ -120,6 +120,9 @@ Curl_clone_primary_ssl_config(struct ssl - CLONE_STRING(egdsocket); - CLONE_STRING(random_file); - CLONE_STRING(clientcert); -+ -+ /* Disable dest sessionid cache if a client cert is used, CVE-2016-5419. */ -+ dest->sessionid = (dest->clientcert ? false : source->sessionid); - return TRUE; - } - -@@ -293,9 +296,9 @@ bool Curl_ssl_getsessionid(struct connec - int port = isProxy ? (int)conn->port : conn->remote_port; - *ssl_sessionid = NULL; - -- DEBUGASSERT(data->set.general_ssl.sessionid); -+ DEBUGASSERT(SSL_SET_OPTION(primary.sessionid)); - -- if(!data->set.general_ssl.sessionid) -+ if(!SSL_SET_OPTION(primary.sessionid)) - /* session ID re-use is disabled */ - return TRUE; - -@@ -397,7 +400,7 @@ CURLcode Curl_ssl_addsessionid(struct co - &conn->proxy_ssl_config : - &conn->ssl_config; - -- DEBUGASSERT(data->set.general_ssl.sessionid); -+ DEBUGASSERT(SSL_SET_OPTION(primary.sessionid)); - - clone_host = strdup(isProxy ? conn->http_proxy.host.name : conn->host.name); - if(!clone_host) diff --git a/package/network/utils/curl/patches/103-CVE-2017-1000100.patch b/package/network/utils/curl/patches/103-CVE-2017-1000100.patch deleted file mode 100644 index 93ab97bd14..0000000000 --- a/package/network/utils/curl/patches/103-CVE-2017-1000100.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 358b2b131ad6c095696f20dcfa62b8305263f898 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Tue, 1 Aug 2017 17:16:46 +0200 -Subject: [PATCH] tftp: reject file name lengths that don't fit - -... and thereby avoid telling send() to send off more bytes than the -size of the buffer! - -CVE-2017-1000100 - -Bug: https://curl.haxx.se/docs/adv_20170809B.html -Reported-by: Even Rouault - -Credit to OSS-Fuzz for the discovery ---- - lib/tftp.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - ---- a/lib/tftp.c -+++ b/lib/tftp.c -@@ -5,7 +5,7 @@ - * | (__| |_| | _ <| |___ - * \___|\___/|_| \_\_____| - * -- * Copyright (C) 1998 - 2016, Daniel Stenberg, , et al. -+ * Copyright (C) 1998 - 2017, Daniel Stenberg, , et al. - * - * This software is licensed as described in the file COPYING, which - * you should have received as part of this distribution. The terms -@@ -490,6 +490,11 @@ static CURLcode tftp_send_first(tftp_sta - if(result) - return result; - -+ if(strlen(filename) > (state->blksize - strlen(mode) - 4)) { -+ failf(data, "TFTP file name too long\n"); -+ return CURLE_TFTP_ILLEGAL; /* too long file name field */ -+ } -+ - snprintf((char *)state->spacket.data+2, - state->blksize, - "%s%c%s%c", filename, '\0', mode, '\0'); diff --git a/package/network/utils/curl/patches/104-CVE-2017-1000101.patch b/package/network/utils/curl/patches/104-CVE-2017-1000101.patch deleted file mode 100644 index 835b73eef9..0000000000 --- a/package/network/utils/curl/patches/104-CVE-2017-1000101.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 453e7a7a03a2cec749abd3878a48e728c515cca7 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Tue, 1 Aug 2017 17:16:07 +0200 -Subject: [PATCH] glob: do not continue parsing after a strtoul() overflow - range - -Added test 1289 to verify. - -CVE-2017-1000101 - -Bug: https://curl.haxx.se/docs/adv_20170809A.html -Reported-by: Brian Carpenter ---- - src/tool_urlglob.c | 5 ++++- - tests/data/Makefile.inc | 2 +- - tests/data/test1289 | 35 +++++++++++++++++++++++++++++++++++ - 3 files changed, 40 insertions(+), 2 deletions(-) - create mode 100644 tests/data/test1289 - ---- a/src/tool_urlglob.c -+++ b/src/tool_urlglob.c -@@ -272,7 +272,10 @@ static CURLcode glob_range(URLGlob *glob - } - errno = 0; - max_n = strtoul(pattern, &endp, 10); -- if(errno || (*endp == ':')) { -+ if(errno) -+ /* overflow */ -+ endp = NULL; -+ else if(*endp == ':') { - pattern = endp+1; - errno = 0; - step_n = strtoul(pattern, &endp, 10); diff --git a/package/network/utils/curl/patches/105-CVE-2017-8816.patch b/package/network/utils/curl/patches/105-CVE-2017-8816.patch deleted file mode 100644 index 4d2b3162a8..0000000000 --- a/package/network/utils/curl/patches/105-CVE-2017-8816.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 7947c50bcd09cf471c95511739bc66d2cb506ee2 Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Mon, 6 Nov 2017 23:51:52 +0100 -Subject: [PATCH] ntlm: avoid integer overflow for malloc size - -Reported-by: Alex Nichols -Assisted-by: Kamil Dudka and Max Dymond - -CVE-2017-8816 - -Bug: https://curl.haxx.se/docs/adv_2017-11e7.html ---- - lib/curl_ntlm_core.c | 23 +++++++++++++++++++++-- - 1 file changed, 21 insertions(+), 2 deletions(-) - -diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c -index 1309bf0d9..e8962769c 100644 ---- a/lib/curl_ntlm_core.c -+++ b/lib/curl_ntlm_core.c -@@ -616,23 +616,42 @@ CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen, - Curl_HMAC_final(ctxt, output); - - return CURLE_OK; - } - -+#ifndef SIZE_T_MAX -+/* some limits.h headers have this defined, some don't */ -+#if defined(_LP64) || defined(_I32LPx) -+#define SIZE_T_MAX 18446744073709551615U -+#else -+#define SIZE_T_MAX 4294967295U -+#endif -+#endif -+ - /* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode - * (uppercase UserName + Domain) as the data - */ - CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen, - const char *domain, size_t domlen, - unsigned char *ntlmhash, - unsigned char *ntlmv2hash) - { - /* Unicode representation */ -- size_t identity_len = (userlen + domlen) * 2; -- unsigned char *identity = malloc(identity_len); -+ size_t identity_len; -+ unsigned char *identity; - CURLcode result = CURLE_OK; - -+ /* we do the length checks below separately to avoid integer overflow risk -+ on extreme data lengths */ -+ if((userlen > SIZE_T_MAX/2) || -+ (domlen > SIZE_T_MAX/2) || -+ ((userlen + domlen) > SIZE_T_MAX/2)) -+ return CURLE_OUT_OF_MEMORY; -+ -+ identity_len = (userlen + domlen) * 2; -+ identity = malloc(identity_len); -+ - if(!identity) - return CURLE_OUT_OF_MEMORY; - - ascii_uppercase_to_unicode_le(identity, user, userlen); - ascii_to_unicode_le(identity + (userlen << 1), domain, domlen); --- -2.15.0 - diff --git a/package/network/utils/curl/patches/106-CVE-2017-8817.patch b/package/network/utils/curl/patches/106-CVE-2017-8817.patch deleted file mode 100644 index 9e904f0b40..0000000000 --- a/package/network/utils/curl/patches/106-CVE-2017-8817.patch +++ /dev/null @@ -1,141 +0,0 @@ -From 0acc0c7c120afa6d60bfc7932c04361720b6e74d Mon Sep 17 00:00:00 2001 -From: Daniel Stenberg -Date: Fri, 10 Nov 2017 08:52:45 +0100 -Subject: [PATCH] wildcardmatch: fix heap buffer overflow in setcharset - -The code would previous read beyond the end of the pattern string if the -match pattern ends with an open bracket when the default pattern -matching function is used. - -Detected by OSS-Fuzz: -https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4161 - -CVE-2017-8817 - -Bug: https://curl.haxx.se/docs/adv_2017-ae72.html ---- - lib/curl_fnmatch.c | 9 +++------ - tests/data/Makefile.inc | 2 +- - tests/data/test1163 | 52 +++++++++++++++++++++++++++++++++++++++++++++++++ - 3 files changed, 56 insertions(+), 7 deletions(-) - create mode 100644 tests/data/test1163 - -diff --git a/lib/curl_fnmatch.c b/lib/curl_fnmatch.c -index da83393b4..8a1e106c4 100644 ---- a/lib/curl_fnmatch.c -+++ b/lib/curl_fnmatch.c -@@ -131,10 +131,13 @@ static int setcharset(unsigned char **p, unsigned char *charset) - unsigned char lastchar = 0; - bool something_found = FALSE; - unsigned char c; - for(;;) { - c = **p; -+ if(!c) -+ return SETCHARSET_FAIL; -+ - switch(state) { - case CURLFNM_SCHS_DEFAULT: - if(ISALNUM(c)) { /* ASCII value */ - rangestart = c; - charset[c] = 1; -@@ -195,13 +198,10 @@ static int setcharset(unsigned char **p, unsigned char *charset) - (*p)++; - } - else - return SETCHARSET_FAIL; - } -- else if(c == '\0') { -- return SETCHARSET_FAIL; -- } - else { - charset[c] = 1; - (*p)++; - something_found = TRUE; - } -@@ -276,13 +276,10 @@ static int setcharset(unsigned char **p, unsigned char *charset) - (*p)++; - } - else if(c == ']') { - return SETCHARSET_OK; - } -- else if(c == '\0') { -- return SETCHARSET_FAIL; -- } - else if(ISPRINT(c)) { - charset[c] = 1; - (*p)++; - state = CURLFNM_SCHS_DEFAULT; - } -diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc -index dc1cc03bc..6eb37d81d 100644 ---- a/tests/data/Makefile.inc.1 2017-11-29 20:00:26.126452486 +0000 -+++ b/tests/data/Makefile.inc 2017-11-29 20:01:13.057783732 +0000 -@@ -121,6 +121,7 @@ - test1128 test1129 test1130 test1131 test1132 test1133 test1134 test1135 \ - test1136 test1137 test1138 test1139 test1140 test1141 test1142 test1143 \ - test1144 \ -+test1163 \ - test1200 test1201 test1202 test1203 test1204 test1205 test1206 test1207 \ - test1208 test1209 test1210 test1211 test1212 test1213 test1214 test1215 \ - test1216 test1217 test1218 test1219 \ -diff --git a/tests/data/test1163 b/tests/data/test1163 -new file mode 100644 -index 000000000..a109b511b ---- /dev/null -+++ b/tests/data/test1163 -@@ -0,0 +1,52 @@ -+ -+ -+ -+FTP -+RETR -+LIST -+wildcardmatch -+ftplistparser -+flaky -+ -+ -+ -+# -+# Server-side -+ -+ -+ -+ -+ -+# Client-side -+ -+ -+ftp -+ -+ -+lib576 -+ -+ -+FTP wildcard with pattern ending with an open-bracket -+ -+ -+"ftp://%HOSTIP:%FTPPORT/fully_simulated/DOS/*[][" -+ -+ -+ -+ -+USER anonymous -+PASS ftp@example.com -+PWD -+CWD fully_simulated -+CWD DOS -+EPSV -+TYPE A -+LIST -+QUIT -+ -+# 78 == CURLE_REMOTE_FILE_NOT_FOUND -+ -+78 -+ -+ -+ --- -2.15.0 - diff --git a/package/network/utils/curl/patches/200-no_docs_tests.patch b/package/network/utils/curl/patches/200-no_docs_tests.patch index 139c05e64b..1aa86a7e49 100644 --- a/package/network/utils/curl/patches/200-no_docs_tests.patch +++ b/package/network/utils/curl/patches/200-no_docs_tests.patch @@ -1,22 +1,22 @@ --- a/Makefile.am +++ b/Makefile.am -@@ -153,7 +153,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP) +@@ -168,7 +168,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP) bin_SCRIPTS = curl-config - SUBDIRS = lib src include --DIST_SUBDIRS = $(SUBDIRS) tests packages docs scripts -+DIST_SUBDIRS = $(SUBDIRS) packages + SUBDIRS = lib src +-DIST_SUBDIRS = $(SUBDIRS) tests packages scripts include docs ++DIST_SUBDIRS = $(SUBDIRS) packages include pkgconfigdir = $(libdir)/pkgconfig pkgconfig_DATA = libcurl.pc ---- a/Makefile.in -+++ b/Makefile.in -@@ -613,7 +613,7 @@ CLEANFILES = $(VC6_LIBDSP) $(VC6_SRCDSP) +@@ -279,8 +279,8 @@ cygwinbin: + # We extend the standard install with a custom hook: + install-data-hook: + cd include && $(MAKE) install +- cd docs && $(MAKE) install +- cd docs/libcurl && $(MAKE) install ++ #cd docs && $(MAKE) install ++ #cd docs/libcurl && $(MAKE) install - bin_SCRIPTS = curl-config - SUBDIRS = lib src include --DIST_SUBDIRS = $(SUBDIRS) tests packages docs scripts -+DIST_SUBDIRS = $(SUBDIRS) packages - pkgconfigdir = $(libdir)/pkgconfig - pkgconfig_DATA = libcurl.pc - LIB_VAUTH_CFILES = vauth/vauth.c vauth/cleartext.c vauth/cram.c \ + # We extend the standard uninstall with a custom hook: + uninstall-hook: diff --git a/package/network/utils/curl/patches/310-mbedtls-disable-runtime-version-check.patch b/package/network/utils/curl/patches/310-mbedtls-disable-runtime-version-check.patch index 22b838daa0..4d34426a36 100644 --- a/package/network/utils/curl/patches/310-mbedtls-disable-runtime-version-check.patch +++ b/package/network/utils/curl/patches/310-mbedtls-disable-runtime-version-check.patch @@ -1,11 +1,11 @@ --- a/lib/vtls/mbedtls.c +++ b/lib/vtls/mbedtls.c -@@ -724,7 +724,7 @@ void Curl_mbedtls_session_free(void *ptr +@@ -814,7 +814,7 @@ static void Curl_mbedtls_session_free(vo - size_t Curl_mbedtls_version(char *buffer, size_t size) + static size_t Curl_mbedtls_version(char *buffer, size_t size) { - unsigned int version = mbedtls_version_get_number(); + unsigned int version = MBEDTLS_VERSION_NUMBER; - return snprintf(buffer, size, "mbedTLS/%d.%d.%d", version>>24, + return snprintf(buffer, size, "mbedTLS/%u.%u.%u", version>>24, (version>>16)&0xff, (version>>8)&0xff); } diff --git a/package/network/utils/curl/patches/320-mbedtls-nonblocking-handshake.patch b/package/network/utils/curl/patches/320-mbedtls-nonblocking-handshake.patch deleted file mode 100644 index 33ab296e56..0000000000 --- a/package/network/utils/curl/patches/320-mbedtls-nonblocking-handshake.patch +++ /dev/null @@ -1,27 +0,0 @@ -From b993d2cca536870ecdf3b4611de9f77215af8eb8 Mon Sep 17 00:00:00 2001 -From: Antoine Aubert -Date: Fri, 20 Jan 2017 08:10:28 +0100 -Subject: [PATCH] vtls: fix mbedtls multi non blocking handshake. - -When using multi, mbedtls handshake is in non blocking mode. -vtls must set wait for read/write flags for the socket. ---- - lib/vtls/vtls.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c -index fad9335bbf..871622fef1 100644 ---- a/lib/vtls/vtls.c -+++ b/lib/vtls/vtls.c -@@ -485,8 +485,9 @@ void Curl_ssl_close_all(struct Curl_easy *data) - } - - #if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \ -- defined(USE_DARWINSSL) || defined(USE_NSS) --/* This function is for OpenSSL, GnuTLS, darwinssl, and schannel only. */ -+ defined(USE_DARWINSSL) || defined(USE_NSS) || defined(USE_MBEDTLS) -+/* This function is for OpenSSL, GnuTLS, darwinssl, mbedtls, and schannel -+ only. */ - int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks, - int numsocks) - { diff --git a/package/network/utils/curl/patches/400-CVE-2018-0500.patch b/package/network/utils/curl/patches/400-CVE-2018-0500.patch new file mode 100644 index 0000000000..9ef4111aea --- /dev/null +++ b/package/network/utils/curl/patches/400-CVE-2018-0500.patch @@ -0,0 +1,32 @@ +From ba1dbd78e5f1ed67c1b8d37ac89d90e5e330b628 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 13 Jun 2018 12:24:40 +0200 +Subject: [PATCH] smtp: use the upload buffer size for scratch buffer malloc + +... not the read buffer size, as that can be set smaller and thus cause +a buffer overflow! CVE-2018-0500 + +Reported-by: Peter Wu +Bug: https://curl.haxx.se/docs/adv_2018-70a2.html +--- + lib/smtp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/lib/smtp.c ++++ b/lib/smtp.c +@@ -1563,13 +1563,14 @@ CURLcode Curl_smtp_escape_eob(struct con + if(!scratch || data->set.crlf) { + oldscratch = scratch; + +- scratch = newscratch = malloc(2 * data->set.buffer_size); ++ scratch = newscratch = malloc(2 * UPLOAD_BUFSIZE); + if(!newscratch) { + failf(data, "Failed to alloc scratch buffer!"); + + return CURLE_OUT_OF_MEMORY; + } + } ++ DEBUGASSERT(UPLOAD_BUFSIZE >= nread); + + /* Have we already sent part of the EOB? */ + eob_sent = smtp->eob; diff --git a/package/utils/bzip2/Makefile b/package/utils/bzip2/Makefile index c17dee136b..ea2fc76833 100644 --- a/package/utils/bzip2/Makefile +++ b/package/utils/bzip2/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=bzip2 PKG_VERSION:=1.0.6 -PKG_RELEASE:=2 +PKG_RELEASE:=4 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=http://www.bzip.org/$(PKG_VERSION) @@ -18,6 +18,7 @@ PKG_MAINTAINER:=Steven Barth PKG_LICENSE:=BZIP2 PKG_LICENSE_FILES:=LICENSE +PKG_CPE_ID:=cpe:/a:bzip:bzip2 include $(INCLUDE_DIR)/host-build.mk include $(INCLUDE_DIR)/package.mk @@ -82,6 +83,8 @@ endef define Package/bzip2/install $(INSTALL_DIR) $(1)/usr/bin/ $(INSTALL_BIN) $(PKG_BUILD_DIR)/bzip2-shared $(1)/usr/bin/bzip2 + $(INSTALL_DIR) $(1)/bin/ + $(LN) ../usr/bin/bzip2 $(1)/bin/bzip2 endef HOST_CFLAGS += \ diff --git a/package/utils/bzip2/patches/010-CVE-2016-3189.patch b/package/utils/bzip2/patches/010-CVE-2016-3189.patch new file mode 100644 index 0000000000..064f982c48 --- /dev/null +++ b/package/utils/bzip2/patches/010-CVE-2016-3189.patch @@ -0,0 +1,11 @@ +diff -up ./bzip2recover.c.old ./bzip2recover.c +--- ./bzip2recover.c.old 2016-03-22 08:49:38.855620000 +0100 ++++ ./bzip2recover.c 2016-03-30 10:22:27.341430099 +0200 +@@ -457,6 +457,7 @@ Int32 main ( Int32 argc, Char** argv ) + bsPutUChar ( bsWr, 0x50 ); bsPutUChar ( bsWr, 0x90 ); + bsPutUInt32 ( bsWr, blockCRC ); + bsClose ( bsWr ); ++ outFile = NULL; + } + if (wrBlock >= rbCtr) break; + wrBlock++;