office-gobmx/external/libcmis/http-session-cleanup.patch.1
Michael Stahl 31ac510f0d libcmis: fix UAF on invalid certificate
headers_slist may be used again on the 2nd call to curl_easy_perform()
in the CURLE_SSL_CACERT case.

Change-Id: I146d7f5dd72e2abd580a68c8ea4c9e56b7adeca3
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169267
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Tested-by: Jenkins
2024-06-20 15:56:46 +02:00

82 lines
3.8 KiB
Groff

--- libcmis/src/libcmis/http-session.cxx.orig 2024-06-19 18:04:14.198691623 +0200
+++ libcmis/src/libcmis/http-session.cxx 2024-06-19 18:09:08.853234764 +0200
@@ -670,16 +670,17 @@
curl_easy_setopt( m_curlHandle, CURLOPT_URL, url.c_str() );
// Set the headers
- struct curl_slist *headers_slist = NULL;
+ struct deleter { void operator()(curl_slist* p) const { curl_slist_free_all(p); } };
+ unique_ptr<struct curl_slist, deleter> headers_slist;
for ( vector< string >::iterator it = headers.begin( ); it != headers.end( ); ++it )
- headers_slist = curl_slist_append( headers_slist, it->c_str( ) );
+ headers_slist.reset(curl_slist_append(headers_slist.release(), it->c_str()));
// If we are using OAuth2, then add the proper header with token to authenticate
// Otherwise, just set the credentials normally using in libcurl options
if ( m_oauth2Handler != NULL && !m_oauth2Handler->getHttpHeader( ).empty() )
{
- headers_slist = curl_slist_append( headers_slist,
- m_oauth2Handler->getHttpHeader( ).c_str( ) );
+ headers_slist.reset(curl_slist_append(headers_slist.release(),
+ m_oauth2Handler->getHttpHeader().c_str()));
}
else if ( !getUsername().empty() )
{
@@ -693,7 +693,7 @@
#endif
}
- curl_easy_setopt( m_curlHandle, CURLOPT_HTTPHEADER, headers_slist );
+ curl_easy_setopt(m_curlHandle, CURLOPT_HTTPHEADER, headers_slist.get());
// Set the proxy configuration if any
if ( !libcmis::SessionFactory::getProxy( ).empty() )
@@ -747,9 +747,6 @@
// Perform the query
CURLcode errCode = curl_easy_perform( m_curlHandle );
- // Free the headers list
- curl_slist_free_all( headers_slist );
-
// Process the response
bool isHttpError = errCode == CURLE_HTTP_RETURNED_ERROR;
if ( CURLE_OK != errCode && !( m_noHttpErrors && isHttpError ) )
--- libcmis/src/libcmis/sharepoint-session.cxx.orig 2024-06-19 18:04:35.761804551 +0200
+++ libcmis/src/libcmis/sharepoint-session.cxx 2024-06-19 18:08:44.563107553 +0200
@@ -200,12 +200,13 @@
curl_easy_setopt( m_curlHandle, CURLOPT_URL, url.c_str() );
// Set the headers
- struct curl_slist *headers_slist = NULL;
+ struct deleter { void operator()(curl_slist* p) const { curl_slist_free_all(p); } };
+ unique_ptr<struct curl_slist, deleter> headers_slist;
for ( vector< string >::iterator it = headers.begin( ); it != headers.end( ); ++it )
- headers_slist = curl_slist_append( headers_slist, it->c_str( ) );
+ headers_slist.reset(curl_slist_append(headers_slist.release(), it->c_str()));
- headers_slist = curl_slist_append( headers_slist, "accept:application/json; odata=verbose" );
- headers_slist = curl_slist_append( headers_slist, ( "x-requestdigest:" + m_digestCode ).c_str( ) );
+ headers_slist.reset(curl_slist_append(headers_slist.release(), "accept:application/json; odata=verbose"));
+ headers_slist.reset(curl_slist_append(headers_slist.release(), ("x-requestdigest:" + m_digestCode).c_str()));
if ( !getUsername().empty() && !getPassword().empty() )
{
@@ -220,7 +219,7 @@
#endif
}
- curl_easy_setopt( m_curlHandle, CURLOPT_HTTPHEADER, headers_slist );
+ curl_easy_setopt(m_curlHandle, CURLOPT_HTTPHEADER, headers_slist.get());
// Set the proxy configuration if any
if ( !libcmis::SessionFactory::getProxy( ).empty() )
@@ -274,9 +273,6 @@
// Perform the query
CURLcode errCode = curl_easy_perform( m_curlHandle );
- // Free the headers list
- curl_slist_free_all( headers_slist );
-
// Process the response
bool isHttpError = errCode == CURLE_HTTP_RETURNED_ERROR;
if ( CURLE_OK != errCode && !( m_noHttpErrors && isHttpError ) )