1From 8313ef3f507b5bdc54e985cae71aa9df00609d55 Mon Sep 17 00:00:00 2001 2From: Daniel Stenberg <daniel@haxx.se> 3Date: Mon, 9 May 2022 08:13:55 +0200 4Subject: [PATCH] hsts: ignore trailing dots when comparing hosts names 5 6CVE-2022-30115 7 8Reported-by: Axel Chong 9Bug: https://curl.se/docs/CVE-2022-30115.html 10Closes #8821 11 12Upstream-Status: Backport [https://github.com/curl/curl/commit/fae6fea209a2d4db1582f608bd8cc8000721733a] 13Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> 14--- 15 lib/hsts.c | 30 +++++++++++++++++++++++++----- 16 1 file changed, 25 insertions(+), 5 deletions(-) 17 18diff --git a/lib/hsts.c b/lib/hsts.c 19index 03fcc9e..b9fa6f7 100644 20--- a/lib/hsts.c 21+++ b/lib/hsts.c 22@@ -114,16 +114,25 @@ static CURLcode hsts_create(struct hsts *h, 23 curl_off_t expires) 24 { 25 struct stsentry *sts = hsts_entry(); 26+ char *duphost; 27+ size_t hlen; 28 if(!sts) 29 return CURLE_OUT_OF_MEMORY; 30 31- sts->expires = expires; 32- sts->includeSubDomains = subdomains; 33- sts->host = strdup(hostname); 34- if(!sts->host) { 35+ duphost = strdup(hostname); 36+ if(!duphost) { 37 free(sts); 38 return CURLE_OUT_OF_MEMORY; 39 } 40+ 41+ hlen = strlen(duphost); 42+ if(duphost[hlen - 1] == '.') 43+ /* strip off trailing any dot */ 44+ duphost[--hlen] = 0; 45+ 46+ sts->host = duphost; 47+ sts->expires = expires; 48+ sts->includeSubDomains = subdomains; 49 Curl_llist_insert_next(&h->list, h->list.tail, sts, &sts->node); 50 return CURLE_OK; 51 } 52@@ -238,10 +247,21 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname, 53 bool subdomain) 54 { 55 if(h) { 56+ char buffer[MAX_HSTS_HOSTLEN + 1]; 57 time_t now = time(NULL); 58 size_t hlen = strlen(hostname); 59 struct Curl_llist_element *e; 60 struct Curl_llist_element *n; 61+ 62+ if((hlen > MAX_HSTS_HOSTLEN) || !hlen) 63+ return NULL; 64+ memcpy(buffer, hostname, hlen); 65+ if(hostname[hlen-1] == '.') 66+ /* remove the trailing dot */ 67+ --hlen; 68+ buffer[hlen] = 0; 69+ hostname = buffer; 70+ 71 for(e = h->list.head; e; e = n) { 72 struct stsentry *sts = e->ptr; 73 n = e->next; 74@@ -440,7 +460,7 @@ static CURLcode hsts_pull(struct Curl_easy *data, struct hsts *h) 75 CURLSTScode sc; 76 DEBUGASSERT(h); 77 do { 78- char buffer[257]; 79+ char buffer[MAX_HSTS_HOSTLEN + 1]; 80 struct curl_hstsentry e; 81 e.name = buffer; 82 e.namelen = sizeof(buffer)-1; 83