From 7a26092a9e21f1e0dc3cad69a580a7e2c7822ad0 Mon Sep 17 00:00:00 2001

From: Daniel Stenberg <daniel@haxx.se>

Date: Sun, 16 Aug 2020 11:34:35 +0200

Subject: [PATCH] Curl_easy: remember last connection by id, not by pointer

CVE-2020-8231

Bug: https://curl.haxx.se/docs/CVE-2020-8231.html

Reported-by: Marc Aldorasi

Closes #5824

Upstream-commit: 3c9e021f86872baae412a427e807fbfa2f3e8a22

Signed-off-by: Kamil Dudka <kdudka@redhat.com>

---

 lib/connect.c | 19 ++++++++++---------

 lib/easy.c    |  3 +--

 lib/multi.c   |  5 +++--

 lib/url.c     |  2 +-

 lib/urldata.h |  2 +-

 5 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/lib/connect.c b/lib/connect.c

index 41f2202..f724646 100644

--- a/lib/connect.c

+++ b/lib/connect.c

@@ -1214,15 +1214,15 @@ CURLcode Curl_connecthost(struct connectdata *conn,  /* context */

 }

 struct connfind {

-  struct connectdata *tofind;

-  bool found;

+  long id_tofind;

+  struct connectdata *found;

 };

 static int conn_is_conn(struct connectdata *conn, void *param)

 {

   struct connfind *f = (struct connfind *)param;

-  if(conn == f->tofind) {

-    f->found = TRUE;

+  if(conn->connection_id == f->id_tofind) {

+    f->found = conn;

     return 1;

   }

   return 0;

@@ -1244,21 +1244,22 @@ curl_socket_t Curl_getconnectinfo(struct Curl_easy *data,

    * - that is associated with a multi handle, and whose connection

    *   was detached with CURLOPT_CONNECT_ONLY

    */

-  if(data->state.lastconnect && (data->multi_easy || data->multi)) {

-    struct connectdata *c = data->state.lastconnect;

+  if((data->state.lastconnect_id != -1) && (data->multi_easy || data->multi)) {

+    struct connectdata *c;

     struct connfind find;

-    find.tofind = data->state.lastconnect;

-    find.found = FALSE;

+    find.id_tofind = data->state.lastconnect_id;

+    find.found = NULL;

     Curl_conncache_foreach(data, data->multi_easy?

                            &data->multi_easy->conn_cache:

                            &data->multi->conn_cache, &find, conn_is_conn);

     if(!find.found) {

-      data->state.lastconnect = NULL;

+      data->state.lastconnect_id = -1;

       return CURL_SOCKET_BAD;

     }

+    c = find.found;

     if(connp) {

       /* only store this if the caller cares for it */

       *connp = c;

diff --git a/lib/easy.c b/lib/easy.c

index 027d0be..fe61cdd 100644

--- a/lib/easy.c

+++ b/lib/easy.c

@@ -919,8 +919,7 @@ struct Curl_easy *curl_easy_duphandle(struct Curl_easy *data)

   /* the connection cache is setup on demand */

   outcurl->state.conn_cache = NULL;

-

-  outcurl->state.lastconnect = NULL;

+  outcurl->state.lastconnect_id = -1;

   outcurl->progress.flags    = data->progress.flags;

   outcurl->progress.callback = data->progress.callback;

diff --git a/lib/multi.c b/lib/multi.c

index 0caf943..0f57fd5 100644

--- a/lib/multi.c

+++ b/lib/multi.c

@@ -427,6 +427,7 @@ CURLMcode curl_multi_add_handle(struct Curl_multi *multi,

     data->state.conn_cache = &data->share->conn_cache;

   else

     data->state.conn_cache = &multi->conn_cache;

+  data->state.lastconnect_id = -1;

 #ifdef USE_LIBPSL

   /* Do the same for PSL. */

@@ -644,11 +645,11 @@ static CURLcode multi_done(struct connectdata **connp,

     /* the connection is no longer in use by this transfer */

     if(Curl_conncache_return_conn(conn)) {

       /* remember the most recently used connection */

-      data->state.lastconnect = conn;

+      data->state.lastconnect_id = conn->connection_id;

       infof(data, "%s\n", buffer);

     }

     else

-      data->state.lastconnect = NULL;

+      data->state.lastconnect_id = -1;

   }

   *connp = NULL; /* to make the caller of this function better detect that

diff --git a/lib/url.c b/lib/url.c

index dcc6cc8..d65d17d 100644

--- a/lib/url.c

+++ b/lib/url.c

@@ -592,7 +592,7 @@ CURLcode Curl_open(struct Curl_easy **curl)

       Curl_initinfo(data);

       /* most recent connection is not yet defined */

-      data->state.lastconnect = NULL;

+      data->state.lastconnect_id = -1;

       data->progress.flags |= PGRS_HIDE;

       data->state.current_speed = -1; /* init to negative == impossible */

diff --git a/lib/urldata.h b/lib/urldata.h

index 67db3b2..4b70cc5 100644

--- a/lib/urldata.h

+++ b/lib/urldata.h

@@ -1219,7 +1219,7 @@ struct UrlState {

   /* buffers to store authentication data in, as parsed from input options */

   struct curltime keeps_speed; /* for the progress meter really */

-  struct connectdata *lastconnect; /* The last connection, NULL if undefined */

+  long lastconnect_id; /* The last connection, -1 if undefined */

   char *headerbuff; /* allocated buffer to store headers in */

   size_t headersize;   /* size of the allocation */

-- 

2.25.4