aboutsummaryrefslogtreecommitdiffstats
path: root/main/curl/CVE-2017-1000257.patch
diff options
context:
space:
mode:
Diffstat (limited to 'main/curl/CVE-2017-1000257.patch')
-rw-r--r--main/curl/CVE-2017-1000257.patch37
1 files changed, 37 insertions, 0 deletions
diff --git a/main/curl/CVE-2017-1000257.patch b/main/curl/CVE-2017-1000257.patch
new file mode 100644
index 0000000000..4159a89981
--- /dev/null
+++ b/main/curl/CVE-2017-1000257.patch
@@ -0,0 +1,37 @@
+From 13c9a9ded3ae744a1e11cbc14e9146d9fa427040 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sat, 7 Oct 2017 00:11:31 +0200
+Subject: [PATCH] imap: if a FETCH response has no size, don't call write
+ callback
+
+CVE-2017-1000257
+
+Reported-by: Brian Carpenter and 0xd34db347
+Also detected by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3586
+---
+ lib/imap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/imap.c b/lib/imap.c
+index 954d18f37..baa31a2f8 100644
+--- a/lib/imap.c
++++ b/lib/imap.c
+@@ -1124,10 +1124,15 @@ static CURLcode imap_state_fetch_resp(struct connectdata *conn, int imapcode,
+
+ if(chunk > (size_t)size)
+ /* The conversion from curl_off_t to size_t is always fine here */
+ chunk = (size_t)size;
+
++ if(!chunk) {
++ /* no size, we're done with the data */
++ state(conn, IMAP_STOP);
++ return CURLE_OK;
++ }
+ result = Curl_client_write(conn, CLIENTWRITE_BODY, pp->cache, chunk);
+ if(result)
+ return result;
+
+ data->req.bytecount += chunk;
+--
+2.15.0.rc1
+