curl: upgrade to release 7.87.0

Fixes CVE-2022-43551 and CVE-2022-43552.

https://curl.se/docs/CVE-2022-43551.html
https://curl.se/docs/CVE-2022-43552.html

Change-Id: I979ed11c212aef226ad9f26420462e5f9dbe15e5
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145116
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

14 files changed, 81 insertions, 141 deletions

diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk
index b43773812ef4..82584d157ccc 100644
--- a/RepositoryExternal.mk
+++ b/RepositoryExternal.mk
@@ -2805,7 +2805,7 @@ $(call gb_LinkTarget_set_include,$(1),\
 
 ifeq ($(COM),MSC)
 $(call gb_LinkTarget_add_libs,$(1),\
-	$(call gb_UnpackedTarball_get_dir,curl)/builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-ipv6-sspi-schannel/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \
+	$(call gb_UnpackedTarball_get_dir,curl)/builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-zlib-static-ipv6-sspi-schannel/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \
 )
 else
 $(call gb_LinkTarget_add_libs,$(1),\
diff --git a/download.lst b/download.lst
index cd96bcd09506..909f93b8d5a8 100644
--- a/download.lst
+++ b/download.lst
@@ -37,8 +37,8 @@ export CPPUNIT_SHA256SUM := 89c5c6665337f56fd2db36bc3805a5619709d51fb136e5193707
 export CPPUNIT_TARBALL := cppunit-1.15.1.tar.gz
 export CT2N_SHA256SUM := 71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3
 export CT2N_TARBALL := 1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt
-export CURL_SHA256SUM := 0606f74b1182ab732a17c11613cbbaf7084f2e6cca432642d0e3ad7c224c3689
-export CURL_TARBALL := curl-7.79.1.tar.xz
+export CURL_SHA256SUM := ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff
+export CURL_TARBALL := curl-7.87.0.tar.xz
 export EBOOK_SHA256SUM := 7e8d8ff34f27831aca3bc6f9cc532c2f90d2057c778963b884ff3d1e34dfe1f9
 export EBOOK_TARBALL := libe-book-0.1.3.tar.xz
 export EPOXY_SHA256SUM := 002958c5528321edd53440235d3c44e71b5b1e09b9177e8daf677450b6c4433d
diff --git a/external/curl/ExternalPackage_curl.mk b/external/curl/ExternalPackage_curl.mk
index 924fc53ebd62..ee0cf4501478 100644
--- a/external/curl/ExternalPackage_curl.mk
+++ b/external/curl/ExternalPackage_curl.mk
@@ -14,13 +14,13 @@ $(eval $(call gb_ExternalPackage_use_external_project,curl,curl))
 ifneq ($(DISABLE_DYNLOADING),TRUE)
 
 ifeq ($(COM),MSC)
-$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-ipv6-sspi-schannel/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll))
+$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-zlib-static-ipv6-sspi-schannel/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll))
 else ifeq ($(OS),MACOSX)
 $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.4.dylib,lib/.libs/libcurl.4.dylib))
 else ifeq ($(OS),AIX)
 $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so,lib/.libs/libcurl.so.4))
 else
-$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so.4,lib/.libs/libcurl.so.4.7.0))
+$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so.4,lib/.libs/libcurl.so.4.8.0))
 endif
 
 endif # $(DISABLE_DYNLOADING)
diff --git a/external/curl/ExternalProject_curl.mk b/external/curl/ExternalProject_curl.mk
index 11beda8c7c5c..5a516651c608 100644
--- a/external/curl/ExternalProject_curl.mk
+++ b/external/curl/ExternalProject_curl.mk
@@ -43,8 +43,8 @@ $(call gb_ExternalProject_get_state_target,curl,build):
 		$(gb_RUN_CONFIGURE) ./configure \
 			$(if $(filter iOS MACOSX,$(OS)),\
 				--with-secure-transport,\
-				$(if $(ENABLE_NSS),--with-nss$(if $(SYSTEM_NSS),,="$(call gb_UnpackedTarball_get_dir,nss)/dist/out"),--without-nss)) \
-			--without-ssl --without-gnutls --without-polarssl --without-cyassl --without-axtls --without-mbedtls \
+				$(if $(ENABLE_NSS),--with-nss$(if $(SYSTEM_NSS),,="$(call gb_UnpackedTarball_get_dir,nss)/dist/out") --with-nss-deprecated,--without-nss)) \
+			--without-openssl --without-gnutls --without-polarssl --without-cyassl --without-axtls --without-mbedtls \
 			--enable-ftp --enable-http --enable-ipv6 \
 			--without-libidn2 --without-libpsl --without-librtmp \
 			--without-libssh2 --without-metalink --without-nghttp2 \
@@ -84,10 +84,12 @@ $(call gb_ExternalProject_get_state_target,curl,build):
 			VC=12 \
 			MACHINE=$(gb_MSBUILD_PLATFORM) \
 			GEN_PDB=$(if $(call gb_Module__symbols_enabled,curl),yes,no) \
+			$(if $(call gb_Module__symbols_enabled,curl),CFLAGS_PDB_VALUE="$(gb_DEBUGINFO_FLAGS)") \
 			DEBUG=$(if $(MSVC_USE_DEBUG_RUNTIME),yes,no) \
 			ENABLE_IPV6=yes \
 			ENABLE_SSPI=yes \
 			ENABLE_WINSSL=yes \
+			WITH_ZLIB=static \
 	,winbuild)
 	$(call gb_Trace_EndRange,curl,EXTERNAL)
 
diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk
index 2cdfbfc08632..e78adabb8d07 100644
--- a/external/curl/UnpackedTarball_curl.mk
+++ b/external/curl/UnpackedTarball_curl.mk
@@ -21,9 +21,10 @@ $(eval $(call gb_UnpackedTarball_fix_end_of_line,curl,\
 
 $(eval $(call gb_UnpackedTarball_add_patches,curl,\
 	external/curl/curl-msvc.patch.1 \
+	external/curl/curl-msvc-zlib.patch.1 \
 	external/curl/curl-msvc-disable-protocols.patch.1 \
-	external/curl/curl-7.26.0_win-proxy.patch \
 	external/curl/zlib.patch.0 \
+	external/curl/configurable-z-option.patch.0 \
 ))
 
 ifeq ($(SYSTEM_NSS),)
@@ -38,4 +39,10 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl, \
 ))
 endif
 
+ifneq ($(filter -fsanitize=%,$(CC)),)
+$(eval $(call gb_UnpackedTarball_add_patches,curl, \
+    external/curl/asan-poison-nsspem.patch.0 \
+))
+endif
+
 # vim: set noet sw=4 ts=4:
diff --git a/external/curl/asan-poison-nsspem.patch.0 b/external/curl/asan-poison-nsspem.patch.0
new file mode 100644
index 000000000000..1f490bd6bf86
--- /dev/null
+++ b/external/curl/asan-poison-nsspem.patch.0
@@ -0,0 +1,11 @@
+--- lib/vtls/nss.c
++++ lib/vtls/nss.c
+@@ -1945,7 +1945,7 @@
+ 
+   PK11_SetPasswordFunc(nss_get_password);
+ 
+-  result = nss_load_module(&pem_module, pem_library, "PEM");
++  result = CURLE_FAILED_INIT;
+   PR_Unlock(nss_initlock);
+   if(result == CURLE_FAILED_INIT)
+     infof(data, "WARNING: failed to load NSS PEM library %s. Using "
diff --git a/external/curl/clang-cl.patch.0 b/external/curl/clang-cl.patch.0
index 2fbb10c2a9aa..5dfb19d5ba59 100644
--- a/external/curl/clang-cl.patch.0
+++ b/external/curl/clang-cl.patch.0
@@ -1,6 +1,6 @@
 --- winbuild/MakefileBuild.vc
 +++ winbuild/MakefileBuild.vc
-@@ -60,7 +60,7 @@
+@@ -52,7 +52,7 @@
  !ELSE
  CC_NODEBUG  = $(CC) /O2 /DNDEBUG
  CC_DEBUG    = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd
diff --git a/external/curl/configurable-z-option.patch.0 b/external/curl/configurable-z-option.patch.0
new file mode 100644
index 000000000000..84516ad21917
--- /dev/null
+++ b/external/curl/configurable-z-option.patch.0
@@ -0,0 +1,20 @@
+--- winbuild/MakefileBuild.vc.sav	2021-11-13 11:43:40.756226600 +0000
++++ winbuild/MakefileBuild.vc	2021-11-13 11:52:08.921692300 +0000
+@@ -47,7 +47,7 @@
+ 
+ !IF "$(VC)"=="6"
+ CC_NODEBUG  = $(CC) /O2 /DNDEBUG
+-CC_DEBUG    = $(CC) /Od /Gm /Zi /D_DEBUG /GZ
++CC_DEBUG    = $(CC) /Od /Gm $(DEBUG_FLAGS_VALUE) /D_DEBUG /GZ
+ CFLAGS      = /I. /I../lib /I../include /nologo /W4 /GX /DWIN32 /YX /FD /c /DBUILDING_LIBCURL
+ !ELSE
+ CC_NODEBUG  = $(CC) /O2 /DNDEBUG
+@@ -64,7 +64,7 @@
+ # Instead of id: just create an archive, that contains all objects
+ LNKLIB     = lib.exe
+ 
+-CFLAGS_PDB = /Zi
++CFLAGS_PDB = $(DEBUG_FLAGS_VALUE)
+ LFLAGS_PDB = /incremental:no /opt:ref,icf /DEBUG
+ 
+ CFLAGS_LIBCURL_STATIC  = /DCURL_STATICLIB
diff --git a/external/curl/curl-7.26.0_win-proxy.patch b/external/curl/curl-7.26.0_win-proxy.patch
deleted file mode 100644
index 46cdcc739d80..000000000000
--- a/external/curl/curl-7.26.0_win-proxy.patch
+++ /dev/null
@@ -1,121 +0,0 @@
---- curl/winbuild/MakefileBuild.vc.orig	2017-10-23 17:15:22.969492548 +0200
-+++ curl/winbuild/MakefileBuild.vc	2017-10-23 17:16:38.491490679 +0200
-@@ -72,7 +72,7 @@
- 
- CFLAGS_LIBCURL_STATIC  = /DCURL_STATICLIB
- 
--WIN_LIBS    = ws2_32.lib wldap32.lib advapi32.lib crypt32.lib
-+WIN_LIBS    = ws2_32.lib wldap32.lib advapi32.lib crypt32.lib winhttp.lib
- 
- BASE_NAME              = libcurl
- BASE_NAME_DEBUG        = $(BASE_NAME)_debug
---- curl-7.26.0/lib/url.c
-+++ misc/build/curl-7.26.0/lib/url.c
-@@ -78,6 +78,10 @@
- bool curl_win32_idn_to_ascii(const char *in, char **out);
- #endif  /* USE_LIBIDN2 */
- 
-+#ifdef _WIN32
-+#include <WinHttp.h>
-+#endif
-+
- #include "urldata.h"
- #include "netrc.h"
- 
-@@ -4586,6 +4590,21 @@
- }
- 
- #ifndef CURL_DISABLE_HTTP
-+#ifdef _WIN32
-+static char *wstrToCstr(LPWSTR wStr)
-+{
-+  int bufSize;
-+  char *out = NULL;
-+  if(wStr != NULL) {
-+    bufSize = WideCharToMultiByte(
-+      CP_ACP,  0, wStr, -1, NULL, 0, NULL, NULL);
-+    out = (char *)malloc(bufSize * sizeof(char));
-+    WideCharToMultiByte(CP_ACP, 0, wStr, -1, out, bufSize, NULL, NULL);
-+  }
-+  return out;
-+}
-+#endif
-+
- /****************************************************************
- * Detect what (if any) proxy to use. Remember that this selects a host
- * name and is not limited to HTTP proxies only.
-@@ -4613,6 +4633,66 @@
-    * For compatibility, the all-uppercase versions of these variables are
-    * checked if the lowercase versions don't exist.
-    */
-+#ifdef _WIN32
-+  char *no_proxy = NULL;
-+  WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *ieProxyConfig;
-+  ieProxyConfig = (WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *)
-+    malloc(sizeof(WINHTTP_CURRENT_USER_IE_PROXY_CONFIG));
-+  if(WinHttpGetIEProxyConfigForCurrentUser(ieProxyConfig)) {
-+    if(!ieProxyConfig->fAutoDetect) {
-+      char *ieProxy;
-+      char *ieNoProxy;
-+      char *pos;
-+
-+      ieProxy = wstrToCstr(ieProxyConfig->lpszProxy);
-+      ieNoProxy = wstrToCstr(ieProxyConfig->lpszProxyBypass);
-+
-+      /* Convert the ieNoProxy into a proper no_proxy value */
-+      if(NULL != ieNoProxy) {
-+        no_proxy = strdup(ieNoProxy);
-+        pos = strpbrk(no_proxy, "; ");
-+        while(NULL != pos) {
-+          no_proxy[pos-no_proxy] = ',';
-+          pos = strpbrk(no_proxy, "; ");
-+        }
-+      }
-+
-+      if(!check_noproxy(conn->host.name, no_proxy)) {
-+        /* Look for the http proxy setting */
-+        char *tok;
-+        char *saveptr;
-+
-+        if(NULL != ieProxy) {
-+          tok = strtok_s(ieProxy, ";", &saveptr);
-+          if(strchr(tok, '=') == NULL) {
-+            proxy = strdup(ieProxy);
-+          }
-+          else {
-+            do {
-+              if(strncmp(tok, "http=", 5) == 0) {
-+                /* We found HTTP proxy value, then use it */
-+                proxy = strdup(tok + 5);
-+              }
-+              tok = strtok_s(NULL, ";", &saveptr);
-+            }
-+            while(NULL != tok);
-+          }
-+        }
-+      }
-+
-+      free(ieProxy);
-+      free(ieNoProxy);
-+    }
-+    else {
-+      /* TODO Handle the Proxy config Auto Detection case */
-+    }
-+
-+    GlobalFree(ieProxyConfig->lpszAutoConfigUrl);
-+    GlobalFree(ieProxyConfig->lpszProxy);
-+    GlobalFree(ieProxyConfig->lpszProxyBypass);
-+  }
-+  free(no_proxy);
-+#else /* !_WIN32 */
-   char proxy_env[128];
-   const char *protop = conn->handler->scheme;
-   char *envp = proxy_env;
-@@ -4663,6 +4739,7 @@
-   }
-   if(proxy)
-     infof(data, "Uses proxy env variable %s == '%s'", envp, proxy);
-+#endif /* _WIN32 */
- 
-   return proxy;
- }
diff --git a/external/curl/curl-msvc-disable-protocols.patch.1 b/external/curl/curl-msvc-disable-protocols.patch.1
index a6d06c69b004..71ff0c01a028 100644
--- a/external/curl/curl-msvc-disable-protocols.patch.1
+++ b/external/curl/curl-msvc-disable-protocols.patch.1
@@ -2,7 +2,7 @@ disable protocols nobody needs in MSVC build
 
 --- curl/lib/config-win32.h.orig	2017-08-09 16:43:29.464000000 +0200
 +++ curl/lib/config-win32.h	2017-08-09 16:47:38.549200000 +0200
-@@ -733,4 +733,20 @@
+@@ -654,4 +654,20 @@
  #  define ENABLE_IPV6 1
  #endif
  
@@ -25,7 +25,7 @@ disable protocols nobody needs in MSVC build
  #endif /* HEADER_CURL_CONFIG_WIN32_H */
 --- curl/winbuild/MakefileBuild.vc.orig	2017-10-23 23:41:21.393200000 +0200
 +++ curl/winbuild/MakefileBuild.vc	2017-10-23 23:34:16.028000000 +0200
-@@ -431,7 +431,7 @@
+@@ -562,7 +562,7 @@
  
  EXE_OBJS = $(CURL_OBJS) $(CURL_DIROBJ)\curl.res
  
diff --git a/external/curl/curl-msvc-zlib.patch.1 b/external/curl/curl-msvc-zlib.patch.1
new file mode 100644
index 000000000000..a9ee0013d50b
--- /dev/null
+++ b/external/curl/curl-msvc-zlib.patch.1
@@ -0,0 +1,16 @@
+find internal zlib in nmake buildsystem
+
+--- curl/winbuild/MakefileBuild.vc.orig2	2021-10-27 20:44:48.685237000 +0200
++++ curl/winbuild/MakefileBuild.vc	2021-10-27 20:47:23.792407400 +0200
+@@ -244,8 +244,9 @@
+ ZLIB_LIB_DIR = $(ZLIB_PATH)\lib
+ ZLIB_LFLAGS  = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)"
+ !ELSE
+-ZLIB_INC_DIR = $(DEVEL_INCLUDE)
+-ZLIB_LIB_DIR = $(DEVEL_LIB)
++ZLIB_INC_DIR = $(WORKDIR)/UnpackedTarball/zlib
++ZLIB_LIB_DIR = $(WORKDIR)/LinkTarget/StaticLibrary
++ZLIB_LFLAGS  = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)"
+ !ENDIF
+ 
+ # Depending on how zlib is built the libraries have different names, we
diff --git a/external/curl/curl-msvc.patch.1 b/external/curl/curl-msvc.patch.1
index a5b79a8e9c49..54ad026ec8c7 100644
--- a/external/curl/curl-msvc.patch.1
+++ b/external/curl/curl-msvc.patch.1
@@ -2,7 +2,7 @@ MSVC: using SOLARINC
 
 --- curl/winbuild/MakefileBuild.vc.orig	2017-10-23 16:36:07.713550851 +0200
 +++ curl/winbuild/MakefileBuild.vc	2017-10-23 16:38:19.301547594 +0200
-@@ -60,7 +60,7 @@
+@@ -52,7 +52,7 @@
  !ELSE
  CC_NODEBUG  = $(CC) /O2 /DNDEBUG
  CC_DEBUG    = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd
@@ -11,7 +11,7 @@ MSVC: using SOLARINC
  !ENDIF
  
  LFLAGS     = /nologo /machine:$(MACHINE)
-@@ -300,11 +300,11 @@
+@@ -426,11 +426,11 @@
  # CURL_XX macros are for the curl.exe command
  
  !IF "$(DEBUG)"=="yes"
diff --git a/external/curl/curl-nss.patch.1 b/external/curl/curl-nss.patch.1
index d4dad7eba77e..2128849369e7 100644
--- a/external/curl/curl-nss.patch.1
+++ b/external/curl/curl-nss.patch.1
@@ -1,12 +1,17 @@
 diff -ur curl.org/configure curl/configure
 --- curl.org/configure	2016-03-13 15:14:07.177000076 +0100
 +++ curl/configure	2016-03-13 15:16:44.132000076 +0100
-@@ -28216,7 +28216,7 @@
+@@ -28230,7 +28230,12 @@
        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Using hard-wired libraries and compilation flags for NSS." >&5
  printf "%s\n" "$as_me: WARNING: Using hard-wired libraries and compilation flags for NSS." >&2;}
        addld="-L$OPT_NSS/lib"
 -      addlib="-lssl3 -lsmime3 -lnss3 -lplds4 -lplc4 -lnspr4"
 +      addlib="-lssl3 -lsmime3 -lnss3 -lplds4 -lplc4 -lnspr4 -lnssutil3"
++      case $host_os in
++        *android*)
++          addlib="${addlib} -llog"
++          ;;
++      esac
        addcflags="-I$OPT_NSS/include"
        version="unknown"
        nssprefix=$OPT_NSS
diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0
index e0f579f8675a..b4442ba262d1 100644
--- a/external/curl/zlib.patch.0
+++ b/external/curl/zlib.patch.0
@@ -1,6 +1,6 @@
 --- configure
 +++ configure
-@@ -22699,7 +22699,6 @@
+@@ -23035,7 +23035,6 @@
  clean_CPPFLAGS=$CPPFLAGS
  clean_LDFLAGS=$LDFLAGS
  clean_LIBS=$LIBS
@@ -8,7 +8,7 @@
  
  # Check whether --with-zlib was given.
  if test ${with_zlib+y}
-@@ -22709,6 +22708,7 @@
+@@ -23045,6 +23044,7 @@
  
  
  if test "$OPT_ZLIB" = "no" ; then
@@ -16,7 +16,7 @@
      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5
  printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;}
  else
-@@ -22716,6 +22716,21 @@
+@@ -23052,6 +23052,21 @@
      OPT_ZLIB=""
    fi
  
@@ -38,7 +38,7 @@
    if test -z "$OPT_ZLIB" ; then
  
      if test -n "$PKG_CONFIG"; then
-@@ -23011,6 +23026,7 @@
+@@ -23344,6 +23359,7 @@
  printf "%s\n" "$as_me: found both libz and libz.h header" >&6;}
      curl_zlib_msg="enabled"
    fi
@@ -48,7 +48,7 @@
   if test x"$AMFIXLIB" = x1; then
 --- configure.ac
 +++ configure.ac
-@@ -880,19 +880,30 @@
+@@ -1243,19 +1243,30 @@
  clean_CPPFLAGS=$CPPFLAGS
  clean_LDFLAGS=$LDFLAGS
  clean_LIBS=$LIBS
@@ -80,7 +80,7 @@
    if test -z "$OPT_ZLIB" ; then
      CURL_CHECK_PKGCONFIG(zlib)
  
-@@ -975,6 +986,7 @@
+@@ -1336,6 +1347,7 @@
      AC_MSG_NOTICE([found both libz and libz.h header])
      curl_zlib_msg="enabled"
    fi