File curl-CVE-2023-28322.patch of Package curl.37304
From 7815647d6582c0a4900be2e1de6c5e61272c496b Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 25 Apr 2023 08:28:01 +0200
Subject: [PATCH] lib: unify the upload/method handling
By making sure we set state.upload based on the set.method value and not
independently as set.upload, we reduce confusion and mixup risks, both
internally and externally.
Closes #11017
---
lib/curl_rtmp.c | 4 ++--
lib/file.c | 4 ++--
lib/ftp.c | 8 ++++----
lib/http.c | 4 ++--
lib/imap.c | 6 +++---
lib/rtsp.c | 4 ++--
lib/setopt.c | 6 ++----
lib/smb.c | 6 +++---
lib/smtp.c | 4 ++--
lib/tftp.c | 8 ++++----
lib/transfer.c | 4 ++--
lib/urldata.h | 2 +-
lib/vssh/libssh.c | 6 +++---
lib/vssh/libssh2.c | 6 +++---
lib/vssh/wolfssh.c | 2 +-
15 files changed, 36 insertions(+), 38 deletions(-)
Index: curl-7.37.0/lib/curl_rtmp.c
===================================================================
--- curl-7.37.0.orig/lib/curl_rtmp.c
+++ curl-7.37.0/lib/curl_rtmp.c
@@ -209,7 +209,7 @@ static CURLcode rtmp_connect(struct conn
/* We have to know if it's a write before we send the
* connect request packet
*/
- if(conn->data->set.upload)
+ if(conn->data->state.upload)
r->Link.protocol |= RTMP_FEATURE_WRITE;
/* For plain streams, use the buffer toggle trick to keep data flowing */
@@ -240,7 +240,7 @@ static CURLcode rtmp_do(struct connectda
if(!RTMP_ConnectStream(r, 0))
return CURLE_FAILED_INIT;
- if(conn->data->set.upload) {
+ if(conn->data->state.upload) {
Curl_pgrsSetUploadSize(conn->data, conn->data->state.infilesize);
Curl_setup_transfer(conn, -1, -1, FALSE, NULL, FIRSTSOCKET, NULL);
}
Index: curl-7.37.0/lib/file.c
===================================================================
--- curl-7.37.0.orig/lib/file.c
+++ curl-7.37.0/lib/file.c
@@ -238,7 +238,7 @@ static CURLcode file_connect(struct conn
file->freepath = real_path; /* free this when done */
file->fd = fd;
- if(!data->set.upload && (fd == -1)) {
+ if(!data->state.upload && (fd == -1)) {
failf(data, "Couldn't open file %s", data->state.path);
file_done(conn, CURLE_FILE_COULDNT_READ_FILE, FALSE);
return CURLE_FILE_COULDNT_READ_FILE;
@@ -436,7 +436,7 @@ static CURLcode file_do(struct connectda
Curl_initinfo(data);
Curl_pgrsStartNow(data);
- if(data->set.upload)
+ if(data->state.upload)
return file_upload(conn);
file = conn->data->req.protop;
Index: curl-7.37.0/lib/ftp.c
===================================================================
--- curl-7.37.0.orig/lib/ftp.c
+++ curl-7.37.0/lib/ftp.c
@@ -1412,7 +1412,7 @@ static CURLcode ftp_state_prepare_transf
data->set.str[STRING_CUSTOMREQUEST]:
(data->set.ftp_list_only?"NLST":"LIST"));
}
- else if(data->set.upload) {
+ else if(data->state.upload) {
PPSENDF(&conn->proto.ftpc.pp, "PRET STOR %s", conn->proto.ftpc.file);
}
else {
@@ -3379,7 +3379,7 @@ static CURLcode ftp_done(struct connectd
/* the response code from the transfer showed an error already so no
use checking further */
;
- else if(data->set.upload) {
+ else if(data->state.upload) {
if((-1 != data->state.infilesize) &&
(data->state.infilesize != *ftp->bytecountp) &&
!data->set.crlf &&
@@ -3694,7 +3694,7 @@ static CURLcode ftp_do_more(struct conne
connected back to us */
}
}
- else if(data->set.upload) {
+ else if(data->state.upload) {
result = ftp_nb_type(conn, data->set.prefer_ascii, FTP_STOR_TYPE);
if(result)
return result;
@@ -4363,7 +4363,7 @@ CURLcode ftp_parse_url_path(struct conne
ftpc->file=NULL; /* instead of point to a zero byte, we make it a NULL
pointer */
- if(data->set.upload && !ftpc->file && (ftp->transfer == FTPTRANSFER_BODY)) {
+ if(data->state.upload && !ftpc->file && (ftp->transfer == FTPTRANSFER_BODY)) {
/* We need a file name when uploading. Return error! */
failf(data, "Uploading to a URL without a file name!");
return CURLE_URL_MALFORMAT;
Index: curl-7.37.0/lib/http.c
===================================================================
--- curl-7.37.0.orig/lib/http.c
+++ curl-7.37.0/lib/http.c
@@ -1815,7 +1815,7 @@ CURLcode Curl_http(struct connectdata *c
http->writebytecount = http->readbytecount = 0;
if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
- data->set.upload) {
+ data->state.upload) {
httpreq = HTTPREQ_PUT;
}
@@ -1927,7 +1927,7 @@ CURLcode Curl_http(struct connectdata *c
}
else {
if((conn->handler->protocol&PROTO_FAMILY_HTTP) &&
- data->set.upload &&
+ data->state.upload &&
(data->state.infilesize == -1)) {
if(conn->bits.authneg)
/* don't enable chunked during auth neg */
Index: curl-7.37.0/lib/imap.c
===================================================================
--- curl-7.37.0.orig/lib/imap.c
+++ curl-7.37.0/lib/imap.c
@@ -1949,9 +1949,9 @@ static CURLcode imap_done(struct connect
result = status; /* use the already set error code */
}
else if(!data->set.connect_only && !imap->custom &&
- (imap->uid || data->set.upload)) {
+ (imap->uid || data->state.upload)) {
/* Handle responses after FETCH or APPEND transfer has finished */
- if(!data->set.upload)
+ if(!data->state.upload)
state(conn, IMAP_FETCH_FINAL);
else {
/* End the APPEND command first by sending an empty line */
@@ -2022,7 +2022,7 @@ static CURLcode imap_perform(struct conn
selected = TRUE;
/* Start the first command in the DO phase */
- if(conn->data->set.upload)
+ if(conn->data->state.upload)
/* APPEND can be executed directly */
result = imap_perform_append(conn);
else if(imap->custom && (selected || !imap->mailbox))
Index: curl-7.37.0/lib/rtsp.c
===================================================================
--- curl-7.37.0.orig/lib/rtsp.c
+++ curl-7.37.0/lib/rtsp.c
@@ -492,7 +492,7 @@ static CURLcode rtsp_do(struct connectda
rtspreq == RTSPREQ_SET_PARAMETER ||
rtspreq == RTSPREQ_GET_PARAMETER) {
- if(data->set.upload) {
+ if(data->state.upload) {
putsize = data->state.infilesize;
data->set.httpreq = HTTPREQ_PUT;
@@ -510,7 +510,7 @@ static CURLcode rtsp_do(struct connectda
if(!Curl_checkheaders(conn, "Content-Length:")) {
result = Curl_add_bufferf(req_buffer,
"Content-Length: %" CURL_FORMAT_CURL_OFF_T"\r\n",
- (data->set.upload ? putsize : postsize));
+ (data->state.upload ? putsize : postsize));
if(result)
return result;
}
Index: curl-7.37.0/lib/smtp.c
===================================================================
--- curl-7.37.0.orig/lib/smtp.c
+++ curl-7.37.0/lib/smtp.c
@@ -1661,7 +1661,7 @@ static CURLcode smtp_done(struct connect
conn->bits.close = TRUE; /* marked for closure */
result = status; /* use the already set error code */
}
- else if(!data->set.connect_only && data->set.upload && data->set.mail_rcpt) {
+ else if(!data->set.connect_only && data->state.upload && data->set.mail_rcpt) {
/* Calculate the EOB taking into account any terminating CRLF from the
previous line of the email or the CRLF of the DATA command when there
is "no mail data". RFC-5321, sect. 4.1.1.4. */
@@ -1737,7 +1737,7 @@ static CURLcode smtp_perform(struct conn
smtp->rcpt = data->set.mail_rcpt;
/* Start the first command in the DO phase */
- if(data->set.upload && data->set.mail_rcpt)
+ if(data->state.upload && data->set.mail_rcpt)
/* MAIL transfer */
result = smtp_perform_mail(conn);
else
Index: curl-7.37.0/lib/tftp.c
===================================================================
--- curl-7.37.0.orig/lib/tftp.c
+++ curl-7.37.0/lib/tftp.c
@@ -392,7 +392,7 @@ static CURLcode tftp_parse_option_ack(tf
/* tsize should be ignored on upload: Who cares about the size of the
remote file? */
- if(!data->set.upload) {
+ if(!data->state.upload) {
if(!tsize) {
failf(data, "invalid tsize -:%s:- value in OACK packet", value);
return CURLE_TFTP_ILLEGAL;
@@ -472,7 +472,7 @@ static CURLcode tftp_send_first(tftp_sta
return res;
}
- if(data->set.upload) {
+ if(data->state.upload) {
/* If we are uploading, send an WRQ */
setpacketevent(&state->spacket, TFTP_EVENT_WRQ);
state->conn->data->req.upload_fromhere =
@@ -503,7 +503,7 @@ static CURLcode tftp_send_first(tftp_sta
sbytes = 4 + strlen(filename) + strlen(mode);
/* add tsize option */
- if(data->set.upload && (data->state.infilesize != -1))
+ if(data->state.upload && (data->state.infilesize != -1))
snprintf(buf, sizeof(buf), "%" CURL_FORMAT_CURL_OFF_T,
data->state.infilesize);
else
@@ -543,7 +543,7 @@ static CURLcode tftp_send_first(tftp_sta
break;
case TFTP_EVENT_OACK:
- if(data->set.upload) {
+ if(data->state.upload) {
res = tftp_connect_for_tx(state, event);
}
else {
Index: curl-7.37.0/lib/transfer.c
===================================================================
--- curl-7.37.0.orig/lib/transfer.c
+++ curl-7.37.0/lib/transfer.c
@@ -1898,7 +1898,7 @@ CURLcode Curl_retry_request(struct conne
/* if we're talking upload, we can't do the checks below, unless the protocol
is HTTP as when uploading over HTTP we will still get a response */
- if(data->set.upload &&
+ if(data->state.upload &&
!(conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_RTSP)))
return CURLE_OK;
Index: curl-7.37.0/lib/urldata.h
===================================================================
--- curl-7.37.0.orig/lib/urldata.h
+++ curl-7.37.0/lib/urldata.h
@@ -1320,6 +1320,7 @@ struct UrlState {
bool ssl_connect_retry;
curl_off_t infilesize; /* size of file to upload, -1 means unknown.
Copied from set.filesize at start of operation */
+ bool upload; /* upload request */
};
@@ -1560,7 +1561,6 @@ struct UserDefined {
bool http_auto_referer; /* set "correct" referer when following location: */
bool opt_no_body; /* as set with CURLOPT_NOBODY */
bool set_port; /* custom port number used */
- bool upload; /* upload request */
enum CURL_NETRC_OPTION
use_netrc; /* defined in include/curl.h */
bool verbose; /* output verbosity */
Index: curl-7.37.0/lib/ssh.c
===================================================================
--- curl-7.37.0.orig/lib/ssh.c
+++ curl-7.37.0/lib/ssh.c
@@ -1574,7 +1574,7 @@ static CURLcode ssh_statemach_act(struct
break;
case SSH_SFTP_TRANS_INIT:
- if(data->set.upload)
+ if(data->state.upload)
state(conn, SSH_SFTP_UPLOAD_INIT);
else {
if(sftp_scp->path[strlen(sftp_scp->path)-1] == '/')
@@ -2258,7 +2258,7 @@ static CURLcode ssh_statemach_act(struct
break;
}
- if(data->set.upload) {
+ if(data->state.upload) {
if(data->state.infilesize < 0) {
failf(data, "SCP requires a known file size for upload");
sshc->actualcode = CURLE_UPLOAD_FAILED;
@@ -2383,7 +2383,7 @@ static CURLcode ssh_statemach_act(struct
break;
case SSH_SCP_DONE:
- if(data->set.upload)
+ if(data->state.upload)
state(conn, SSH_SCP_SEND_EOF);
else
state(conn, SSH_SCP_CHANNEL_FREE);
Index: curl-7.37.0/lib/url.c
===================================================================
--- curl-7.37.0.orig/lib/url.c
+++ curl-7.37.0/lib/url.c
@@ -763,8 +763,8 @@ CURLcode Curl_setopt(struct SessionHandl
* We want to sent data to the remote host. If this is HTTP, that equals
* using the PUT request.
*/
- data->set.upload = (0 != va_arg(param, long))?TRUE:FALSE;
- if(data->set.upload) {
+ data->state.upload = (0 != va_arg(param, long))?TRUE:FALSE;
+ if(data->state.upload) {
/* If this is HTTP, PUT is what's needed to "upload" */
data->set.httpreq = HTTPREQ_PUT;
data->set.opt_no_body = FALSE; /* this is implied */
@@ -956,7 +956,7 @@ CURLcode Curl_setopt(struct SessionHandl
}
else
data->set.httpreq = HTTPREQ_GET;
- data->set.upload = FALSE;
+ data->state.upload = FALSE;
break;
case CURLOPT_COPYPOSTFIELDS:
@@ -1231,7 +1231,7 @@ CURLcode Curl_setopt(struct SessionHandl
*/
if(va_arg(param, long)) {
data->set.httpreq = HTTPREQ_GET;
- data->set.upload = FALSE; /* switch off upload */
+ data->state.upload = FALSE; /* switch off upload */
data->set.opt_no_body = FALSE; /* this is implied */
}
break;
