File curl-CVE-2025-10148.patch of Package curl.39870

From 84db7a9eae8468c0445b15aa806fa7fa806fa0f2 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 8 Sep 2025 14:14:15 +0200
Subject: [PATCH] ws: get a new mask for each new outgoing frame

Reported-by: Calvin Ruocco
Closes #18496
---
 lib/ws.c | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

Index: curl-8.14.1/lib/ws.c
===================================================================
--- curl-8.14.1.orig/lib/ws.c
+++ curl-8.14.1/lib/ws.c
@@ -758,6 +758,7 @@ static ssize_t ws_enc_write_head(struct
   unsigned char head[14];
   size_t hlen;
   ssize_t n;
+  CURLcode result;
 
   if(payload_len < 0) {
     failf(data, "[WS] starting new frame with negative payload length %"
@@ -831,6 +831,17 @@ static ssize_t ws_enc_write_head(struct
   enc->payload_remain = enc->payload_len = payload_len;
   ws_enc_info(enc, data, "sending");
 
+  /* 4 bytes random */
+  result = Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask));
+  if(result)
+    return result;
+
+#ifdef DEBUGBUILD
+  if(getenv("CURL_WS_FORCE_ZERO_MASK"))
+    /* force the bit mask to 0x00000000, effectively disabling masking */
+    memset(&enc->mask, 0, sizeof(enc->mask));
+#endif
+
   /* add 4 bytes mask */
   memcpy(&head[hlen], &enc->mask, 4);
   hlen += 4;
@@ -1025,21 +1036,7 @@ CURLcode Curl_ws_accept(struct Curl_easy
      subprotocol not requested by the client), the client MUST Fail
      the WebSocket Connection. */
 
-  /* 4 bytes random */
-
-  result = Curl_rand(data, (unsigned char *)&ws->enc.mask,
-                     sizeof(ws->enc.mask));
-  if(result)
-    return result;
-
-#ifdef DEBUGBUILD
-  if(getenv("CURL_WS_FORCE_ZERO_MASK"))
-    /* force the bit mask to 0x00000000, effectively disabling masking */
-    memset(ws->enc.mask, 0, sizeof(ws->enc.mask));
-#endif
-
-  infof(data, "[WS] Received 101, switch to WebSocket; mask %02x%02x%02x%02x",
-        ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]);
+  infof(data, "[WS] Received 101, switch to WebSocket");
 
   /* Install our client writer that decodes WS frames payload */
   result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode,