1From 3c54eaf986d62a1f7482b8d5fff2d6ac42d19f23 Mon Sep 17 00:00:00 2001 2From: Daniel Stenberg <daniel@haxx.se> 3Date: Thu, 6 Oct 2022 14:13:36 +0200 4Subject: [PATCH 1/2] http_proxy: restore the protocol pointer on error 5 6Reported-by: Trail of Bits 7 8Closes #9790 9 10Upstream-commit: 55e1875729f9d9fc7315cec611bffbd2c817ad89 11Signed-off-by: Kamil Dudka <kdudka@redhat.com> 12 13Conflict: NA 14Reference:https://src.fedoraproject.org/rpms/curl/blob/f35/f/0017-curl-7.82.0-CVE-2022-42915.patch 15--- 16 lib/http_proxy.c | 3 +-- 17 lib/url.c | 9 --------- 18 2 files changed, 1 insertion(+), 11 deletions(-) 19 20diff --git a/lib/http_proxy.c b/lib/http_proxy.c 21index 1f87f6c..cc20b3a 100644 22--- a/lib/http_proxy.c 23+++ b/lib/http_proxy.c 24@@ -207,9 +207,8 @@ static void connect_done(struct Curl_easy *data) 25 Curl_dyn_free(&s->rcvbuf); 26 Curl_dyn_free(&s->req); 27 28- /* retore the protocol pointer */ 29+ /* restore the protocol pointer */ 30 data->req.p.http = s->prot_save; 31- s->prot_save = NULL; 32 infof(data, "CONNECT phase completed!"); 33 } 34 } 35diff --git a/lib/url.c b/lib/url.c 36index bfc784f..61c99d2 100644 37--- a/lib/url.c 38+++ b/lib/url.c 39@@ -735,15 +735,6 @@ static void conn_shutdown(struct Curl_easy *data, struct connectdata *conn) 40 DEBUGASSERT(data); 41 infof(data, "Closing connection %ld", conn->connection_id); 42 43-#ifndef USE_HYPER 44- if(conn->connect_state && conn->connect_state->prot_save) { 45- /* If this was closed with a CONNECT in progress, cleanup this temporary 46- struct arrangement */ 47- data->req.p.http = NULL; 48- Curl_safefree(conn->connect_state->prot_save); 49- } 50-#endif 51- 52 /* possible left-overs from the async name resolvers */ 53 Curl_resolver_cancel(data); 54 55-- 562.37.3 57 58 59From 5fdb5e8433c132dbb1e31a48d39a4a54ba4d7a9e Mon Sep 17 00:00:00 2001 60From: Daniel Stenberg <daniel@haxx.se> 61Date: Thu, 6 Oct 2022 14:14:25 +0200 62Subject: [PATCH 2/2] test445: verifies the protocols-over-http-proxy flaw and 63 fix 64 65Upstream-commit: 038bfb8522a93328b7e65bd2b6b8387c974b9ac8 66Signed-off-by: Kamil Dudka <kdudka@redhat.com> 67--- 68 tests/data/Makefile.inc | 2 +- 69 tests/data/test445 | 61 +++++++++++++++++++++++++++++++++++++++++ 70 2 files changed, 62 insertions(+), 1 deletion(-) 71 create mode 100644 tests/data/test445 72 73diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc 74index 1f774ce..f79b63e 100644 75--- a/tests/data/Makefile.inc 76+++ b/tests/data/Makefile.inc 77@@ -67,7 +67,7 @@ test392 test393 test394 test395 test396 test397 \ 78 test400 test401 test402 test403 test404 test405 test406 test407 test408 \ 79 test409 test410 \ 80 \ 81-test430 test431 test432 test433 test434 test435 \ 82+test430 test431 test432 test433 test434 test435 test445\ 83 \ 84 test490 test491 test492 test493 test494 \ 85 \ 86diff --git a/tests/data/test445 b/tests/data/test445 87new file mode 100644 88index 0000000..0406c0f 89--- /dev/null 90+++ b/tests/data/test445 91@@ -0,0 +1,61 @@ 92+<testcase> 93+<info> 94+<keywords> 95+HTTP 96+HTTP proxy 97+</keywords> 98+</info> 99+ 100+# 101+# Server-side 102+<reply> 103+<connect> 104+HTTP/1.1 503 no just no 105+Date: Tue, 09 Nov 2010 14:49:00 GMT 106+Server: test-server/fake 107+Accept-Ranges: bytes 108+Content-Length: 6 109+Connection: close 110+ 111+-foo- 112+</connect> 113+</reply> 114+ 115+# 116+# Client-side 117+<client> 118+<features> 119+gopher 120+dict 121+http 122+ftp 123+imap 124+ldap 125+mqtt 126+pop3 127+rtsp 128+scp 129+sftp 130+smb 131+smtp 132+</features> 133+<server> 134+http-proxy 135+</server> 136+ <name> 137+Refuse tunneling protocols through HTTP proxy 138+ </name> 139+ <command> 140+-x http://%HOSTIP:%PROXYPORT/%TESTNUMBER -p gopher://127.0.0.1 dict://127.0.0.1 http://moo https://example telnet://another ftp://yes ftps://again imap://more ldap://perhaps mqtt://yes pop3://mail rtsp://harder scp://copy sftp://files smb://wird smtp://send 141+</command> 142+</client> 143+ 144+# 145+# Verify data after the test has been "shot" 146+<verify> 147+# refused in the CONNECT 148+<errorcode> 149+56 150+</errorcode> 151+</verify> 152+</testcase> 153-- 1542.33.0 155 156