]> granicus.if.org Git - curl/commit
curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds
authorDaniel Stenberg <daniel@haxx.se>
Fri, 17 Oct 2014 10:59:32 +0000 (12:59 +0200)
committerDaniel Stenberg <daniel@haxx.se>
Wed, 5 Nov 2014 07:05:14 +0000 (08:05 +0100)
commitb3875606925536f82fc61f3114ac42f29eaf6945
tree229666d262222b2f34967e00fb5300ec69cda258
parentd997c8b2f6521d78c6ef63411cfeb226f7927281
curl_easy_duphandle: CURLOPT_COPYPOSTFIELDS read out of bounds

When duplicating a handle, the data to post was duplicated using
strdup() when it could be binary and contain zeroes and it was not even
zero terminated! This caused read out of bounds crashes/segfaults.

Since the lib/strdup.c file no longer is easily shared with the curl
tool with this change, it now uses its own version instead.

Bug: http://curl.haxx.se/docs/adv_20141105.html
CVE: CVE-2014-3707
Reported-By: Symeon Paraschoudis
lib/formdata.c
lib/strdup.c
lib/strdup.h
lib/url.c
lib/urldata.h
src/Makefile.inc
src/tool_setup.h
src/tool_strdup.c [new file with mode: 0644]
src/tool_strdup.h [new file with mode: 0644]