Blame SOURCES/0011-curl-7.76.1-CVE-2022-27775.patch

2bcbe9
From 187d0795030ccb4f410eb6089e265ac3571e56dd Mon Sep 17 00:00:00 2001
2bcbe9
From: Daniel Stenberg <daniel@haxx.se>
2bcbe9
Date: Mon, 25 Apr 2022 11:48:00 +0200
2bcbe9
Subject: [PATCH] conncache: include the zone id in the "bundle" hashkey
2bcbe9
2bcbe9
Make connections to two separate IPv6 zone ids create separate
2bcbe9
connections.
2bcbe9
2bcbe9
Reported-by: Harry Sintonen
2bcbe9
Bug: https://curl.se/docs/CVE-2022-27775.html
2bcbe9
Closes #8747
2bcbe9
2bcbe9
Upstream-commit: 058f98dc3fe595f21dc26a5b9b1699e519ba5705
2bcbe9
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
2bcbe9
---
2bcbe9
 lib/conncache.c | 8 ++++++--
2bcbe9
 1 file changed, 6 insertions(+), 2 deletions(-)
2bcbe9
2bcbe9
diff --git a/lib/conncache.c b/lib/conncache.c
2bcbe9
index cd5756a..9b9f683 100644
2bcbe9
--- a/lib/conncache.c
2bcbe9
+++ b/lib/conncache.c
2bcbe9
@@ -159,8 +159,12 @@ static void hashkey(struct connectdata *conn, char *buf,
2bcbe9
     /* report back which name we used */
2bcbe9
     *hostp = hostname;
2bcbe9
 
2bcbe9
-  /* put the number first so that the hostname gets cut off if too long */
2bcbe9
-  msnprintf(buf, len, "%ld%s", port, hostname);
2bcbe9
+  /* put the numbers first so that the hostname gets cut off if too long */
2bcbe9
+#ifdef ENABLE_IPV6
2bcbe9
+  msnprintf(buf, len, "%u/%ld/%s", conn->scope_id, port, hostname);
2bcbe9
+#else
2bcbe9
+  msnprintf(buf, len, "%ld/%s", port, hostname);
2bcbe9
+#endif
2bcbe9
 }
2bcbe9
 
2bcbe9
 /* Returns number of connections currently held in the connection cache.
2bcbe9
-- 
2bcbe9
2.34.1
2bcbe9