Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:11.2:Test
curl
curl-CVE-2013-1944.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File curl-CVE-2013-1944.patch of Package curl
--- curl-7.19.6/lib/cookie.c.orig 2013-04-23 18:31:39.530967852 +0200 +++ curl-7.19.6/lib/cookie.c 2013-04-23 18:33:32.317093748 +0200 @@ -122,15 +122,29 @@ free(co); } -static bool tailmatch(const char *little, const char *bigone) +static bool tailmatch(const char *cooke_domain, const char *hostname) { - size_t littlelen = strlen(little); - size_t biglen = strlen(bigone); + size_t cookie_domain_len = strlen(cooke_domain); + size_t hostname_len = strlen(hostname); - if(littlelen > biglen) + if(hostname_len < cookie_domain_len) return FALSE; - return (bool)Curl_raw_equal(little, bigone+biglen-littlelen); + if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len)) + return FALSE; + + /* A lead char of cookie_domain is not '.'. + RFC6265 4.1.2.3. The Domain Attribute says: + For example, if the value of the Domain attribute is + "example.com", the user agent will include the cookie in the Cookie + header when making HTTP requests to example.com, www.example.com, and + www.corp.example.com. + */ + if(hostname_len == cookie_domain_len) + return TRUE; + if('.' == *(hostname + hostname_len - cookie_domain_len - 1)) + return TRUE; + return FALSE; } /* --- curl-7.19.6/tests/data/Makefile.am.orig 2013-04-23 18:31:39.510968716 +0200 +++ curl-7.19.6/tests/data/Makefile.am 2013-04-23 18:36:18.196924576 +0200 @@ -62,7 +62,7 @@ test635 test636 test637 test558 test559 test1086 test1087 test1088 \ test1089 test1090 test1091 test1092 test1093 test1094 test1095 test1096 \ test1097 test560 test561 test1098 test1099 test562 test563 test1100 \ - test564 test1101 + test564 test1101 test1218 filecheck: @mkdir test-place; \ Index: curl-7.22.0/tests/data/test1218 =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ curl-7.22.0/tests/data/test1218 2013-04-15 16:30:54.800644419 +0200 @@ -0,0 +1,61 @@ +<testcase> +<info> +<keywords> +HTTP +HTTP GET +HTTP proxy +cookies +</keywords> +</info> + +# This test is very similar to 1216, only that it sets the cookies from the +# first site instead of reading from a file +<reply> +<data> +HTTP/1.1 200 OK +Date: Tue, 25 Sep 2001 19:37:44 GMT +Set-Cookie: domain=.example.fake; bug=fixed; +Content-Length: 21 + +This server says moo +</data> +</reply> + +# Client-side +<client> +<server> +http +</server> + <name> +HTTP cookies and domains with same prefix + </name> + <command> +http://example.fake/c/1218 http://example.fake/c/1218 http://bexample.fake/c/1218 -b nonexisting -x %HOSTIP:%HTTPPORT +</command> +</client> + +# Verify data after the test has been "shot" +<verify> +<strip> +^User-Agent:.* +</strip> +<protocol> +GET http://example.fake/c/1218 HTTP/1.1 +Host: example.fake +Accept: */* +Proxy-Connection: Keep-Alive + +GET http://example.fake/c/1218 HTTP/1.1 +Host: example.fake +Accept: */* +Proxy-Connection: Keep-Alive +Cookie: bug=fixed + +GET http://bexample.fake/c/1218 HTTP/1.1 +Host: bexample.fake +Accept: */* +Proxy-Connection: Keep-Alive + +</protocol> +</verify> +</testcase>
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor