Blame SOURCES/0023-curl-7.76.1-CVE-2022-43552.patch

4e3ab8
From 5cdcf1dbd39c64e18a81fc912a36942a3ec87565 Mon Sep 17 00:00:00 2001
4e3ab8
From: Daniel Stenberg <daniel@haxx.se>
4e3ab8
Date: Mon, 19 Dec 2022 08:38:37 +0100
4e3ab8
Subject: [PATCH] smb/telnet: do not free the protocol struct in *_done()
4e3ab8
4e3ab8
It is managed by the generic layer.
4e3ab8
4e3ab8
Reported-by: Trail of Bits
4e3ab8
4e3ab8
Closes #10112
4e3ab8
4e3ab8
Upstream-commit: 4f20188ac644afe174be6005ef4f6ffba232b8b2
4e3ab8
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
4e3ab8
---
4e3ab8
 lib/smb.c    | 14 ++------------
4e3ab8
 lib/telnet.c |  3 ---
4e3ab8
 2 files changed, 2 insertions(+), 15 deletions(-)
4e3ab8
4e3ab8
diff --git a/lib/smb.c b/lib/smb.c
4e3ab8
index 039d680..f682c1f 100644
4e3ab8
--- a/lib/smb.c
4e3ab8
+++ b/lib/smb.c
4e3ab8
@@ -60,8 +60,6 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done);
4e3ab8
 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
4e3ab8
 static CURLcode smb_do(struct Curl_easy *data, bool *done);
4e3ab8
 static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
4e3ab8
-static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
4e3ab8
-                         bool premature);
4e3ab8
 static CURLcode smb_disconnect(struct Curl_easy *data,
4e3ab8
                                struct connectdata *conn, bool dead);
4e3ab8
 static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
4e3ab8
@@ -76,7 +74,7 @@ const struct Curl_handler Curl_handler_smb = {
4e3ab8
   "SMB",                                /* scheme */
4e3ab8
   smb_setup_connection,                 /* setup_connection */
4e3ab8
   smb_do,                               /* do_it */
4e3ab8
-  smb_done,                             /* done */
4e3ab8
+  ZERO_NULL,                            /* done */
4e3ab8
   ZERO_NULL,                            /* do_more */
4e3ab8
   smb_connect,                          /* connect_it */
4e3ab8
   smb_connection_state,                 /* connecting */
4e3ab8
@@ -103,7 +101,7 @@ const struct Curl_handler Curl_handler_smbs = {
4e3ab8
   "SMBS",                               /* scheme */
4e3ab8
   smb_setup_connection,                 /* setup_connection */
4e3ab8
   smb_do,                               /* do_it */
4e3ab8
-  smb_done,                             /* done */
4e3ab8
+  ZERO_NULL,                            /* done */
4e3ab8
   ZERO_NULL,                            /* do_more */
4e3ab8
   smb_connect,                          /* connect_it */
4e3ab8
   smb_connection_state,                 /* connecting */
4e3ab8
@@ -941,14 +939,6 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
4e3ab8
   return CURLE_OK;
4e3ab8
 }
4e3ab8
 
4e3ab8
-static CURLcode smb_done(struct Curl_easy *data, CURLcode status,
4e3ab8
-                         bool premature)
4e3ab8
-{
4e3ab8
-  (void) premature;
4e3ab8
-  Curl_safefree(data->req.p.smb);
4e3ab8
-  return status;
4e3ab8
-}
4e3ab8
-
4e3ab8
 static CURLcode smb_disconnect(struct Curl_easy *data,
4e3ab8
                                struct connectdata *conn, bool dead)
4e3ab8
 {
4e3ab8
diff --git a/lib/telnet.c b/lib/telnet.c
4e3ab8
index 923c7f8..48cd0d7 100644
4e3ab8
--- a/lib/telnet.c
4e3ab8
+++ b/lib/telnet.c
4e3ab8
@@ -1248,9 +1248,6 @@ static CURLcode telnet_done(struct Curl_easy *data,
4e3ab8
 
4e3ab8
   curl_slist_free_all(tn->telnet_vars);
4e3ab8
   tn->telnet_vars = NULL;
4e3ab8
-
4e3ab8
-  Curl_safefree(data->req.p.telnet);
4e3ab8
-
4e3ab8
   return CURLE_OK;
4e3ab8
 }
4e3ab8
 
4e3ab8
-- 
4e3ab8
2.38.1
4e3ab8