From ce2c30a81630cdc9f58f31424394f418c2ea4de5 Mon Sep 17 00:00:00 2001 From: Nishant Chaprana Date: Sat, 9 Mar 2019 12:21:06 +0530 Subject: [PATCH] NTLM: fix size check condition for type2 received data Bug: https://curl.haxx.se/docs/CVE-2018-16890.html Reported-by: Wenxiang Qian CVE-2018-16890 Backported patch details:- Link: https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb.patch Change-Id: I15fc8002280680a7cf194dd02a5d7751cc7dbc71 Signed-off-by: Nishant Chaprana --- lib/vauth/ntlm.c | 7 ++++--- packaging/curl.spec | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/lib/vauth/ntlm.c b/lib/vauth/ntlm.c index 82b59f6..1bef9ee 100644 --- a/lib/vauth/ntlm.c +++ b/lib/vauth/ntlm.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2017, Daniel Stenberg, , et al. + * Copyright (C) 1998 - 2019, Daniel Stenberg, , et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -182,10 +182,11 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data, target_info_len = Curl_read16_le(&buffer[40]); target_info_offset = Curl_read32_le(&buffer[44]); if(target_info_len > 0) { - if(((target_info_offset + target_info_len) > size) || + if((target_info_offset >= size) || + ((target_info_offset + target_info_len) > size) || (target_info_offset < 48)) { infof(data, "NTLM handshake failure (bad type-2 message). " - "Target Info Offset Len is set incorrect by the peer\n"); + "Target Info Offset Len is set incorrect by the peer\n"); return CURLE_BAD_CONTENT_ENCODING; } diff --git a/packaging/curl.spec b/packaging/curl.spec index 42a93ba..8e4f447 100644 --- a/packaging/curl.spec +++ b/packaging/curl.spec @@ -1,7 +1,7 @@ Name: curl Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Version: 7.62.0 -Release: 3 +Release: 4 Group: Applications/Internet License: MIT URL: http://curl.haxx.se/ -- 2.7.4