From d4b92a8e723e2d793eed20c4a5235370e7c5163f Mon Sep 17 00:00:00 2001 From: Taichi Haradaguchi <20001722@ymail.ne.jp> Date: Fri, 30 Dec 2022 21:29:58 +0900 Subject: curl: upgrade to release 7.87.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2022-43551 and CVE-2022-43552. https://curl.se/docs/CVE-2022-43551.html https://curl.se/docs/CVE-2022-43552.html Change-Id: I979ed11c212aef226ad9f26420462e5f9dbe15e5 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145116 Tested-by: Jenkins Reviewed-by: Caolán McNamara --- RepositoryExternal.mk | 2 +- download.lst | 4 +- external/curl/ExternalPackage_curl.mk | 4 +- external/curl/ExternalProject_curl.mk | 6 +- external/curl/UnpackedTarball_curl.mk | 9 +- external/curl/asan-poison-nsspem.patch.0 | 11 ++ external/curl/clang-cl.patch.0 | 2 +- external/curl/configurable-z-option.patch.0 | 20 ++++ external/curl/curl-7.26.0_win-proxy.patch | 121 ---------------------- external/curl/curl-msvc-disable-protocols.patch.1 | 4 +- external/curl/curl-msvc-zlib.patch.1 | 16 +++ external/curl/curl-msvc.patch.1 | 4 +- external/curl/curl-nss.patch.1 | 7 +- external/curl/zlib.patch.0 | 12 +-- 14 files changed, 81 insertions(+), 141 deletions(-) create mode 100644 external/curl/asan-poison-nsspem.patch.0 create mode 100644 external/curl/configurable-z-option.patch.0 delete mode 100644 external/curl/curl-7.26.0_win-proxy.patch create mode 100644 external/curl/curl-msvc-zlib.patch.1 diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk index b43773812ef4..82584d157ccc 100644 --- a/RepositoryExternal.mk +++ b/RepositoryExternal.mk @@ -2805,7 +2805,7 @@ $(call gb_LinkTarget_set_include,$(1),\ ifeq ($(COM),MSC) $(call gb_LinkTarget_add_libs,$(1),\ - $(call gb_UnpackedTarball_get_dir,curl)/builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-ipv6-sspi-schannel/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \ + $(call gb_UnpackedTarball_get_dir,curl)/builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-zlib-static-ipv6-sspi-schannel/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \ ) else $(call gb_LinkTarget_add_libs,$(1),\ diff --git a/download.lst b/download.lst index cd96bcd09506..909f93b8d5a8 100644 --- a/download.lst +++ b/download.lst @@ -37,8 +37,8 @@ export CPPUNIT_SHA256SUM := 89c5c6665337f56fd2db36bc3805a5619709d51fb136e5193707 export CPPUNIT_TARBALL := cppunit-1.15.1.tar.gz export CT2N_SHA256SUM := 71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3 export CT2N_TARBALL := 1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt -export CURL_SHA256SUM := 0606f74b1182ab732a17c11613cbbaf7084f2e6cca432642d0e3ad7c224c3689 -export CURL_TARBALL := curl-7.79.1.tar.xz +export CURL_SHA256SUM := ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff +export CURL_TARBALL := curl-7.87.0.tar.xz export EBOOK_SHA256SUM := 7e8d8ff34f27831aca3bc6f9cc532c2f90d2057c778963b884ff3d1e34dfe1f9 export EBOOK_TARBALL := libe-book-0.1.3.tar.xz export EPOXY_SHA256SUM := 002958c5528321edd53440235d3c44e71b5b1e09b9177e8daf677450b6c4433d diff --git a/external/curl/ExternalPackage_curl.mk b/external/curl/ExternalPackage_curl.mk index 924fc53ebd62..ee0cf4501478 100644 --- a/external/curl/ExternalPackage_curl.mk +++ b/external/curl/ExternalPackage_curl.mk @@ -14,13 +14,13 @@ $(eval $(call gb_ExternalPackage_use_external_project,curl,curl)) ifneq ($(DISABLE_DYNLOADING),TRUE) ifeq ($(COM),MSC) -$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-ipv6-sspi-schannel/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll)) +$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(gb_MSBUILD_PLATFORM)-$(gb_MSBUILD_CONFIG)-dll-zlib-static-ipv6-sspi-schannel/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll)) else ifeq ($(OS),MACOSX) $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.4.dylib,lib/.libs/libcurl.4.dylib)) else ifeq ($(OS),AIX) $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so,lib/.libs/libcurl.so.4)) else -$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so.4,lib/.libs/libcurl.so.4.7.0)) +$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so.4,lib/.libs/libcurl.so.4.8.0)) endif endif # $(DISABLE_DYNLOADING) diff --git a/external/curl/ExternalProject_curl.mk b/external/curl/ExternalProject_curl.mk index 11beda8c7c5c..5a516651c608 100644 --- a/external/curl/ExternalProject_curl.mk +++ b/external/curl/ExternalProject_curl.mk @@ -43,8 +43,8 @@ $(call gb_ExternalProject_get_state_target,curl,build): $(gb_RUN_CONFIGURE) ./configure \ $(if $(filter iOS MACOSX,$(OS)),\ --with-secure-transport,\ - $(if $(ENABLE_NSS),--with-nss$(if $(SYSTEM_NSS),,="$(call gb_UnpackedTarball_get_dir,nss)/dist/out"),--without-nss)) \ - --without-ssl --without-gnutls --without-polarssl --without-cyassl --without-axtls --without-mbedtls \ + $(if $(ENABLE_NSS),--with-nss$(if $(SYSTEM_NSS),,="$(call gb_UnpackedTarball_get_dir,nss)/dist/out") --with-nss-deprecated,--without-nss)) \ + --without-openssl --without-gnutls --without-polarssl --without-cyassl --without-axtls --without-mbedtls \ --enable-ftp --enable-http --enable-ipv6 \ --without-libidn2 --without-libpsl --without-librtmp \ --without-libssh2 --without-metalink --without-nghttp2 \ @@ -84,10 +84,12 @@ $(call gb_ExternalProject_get_state_target,curl,build): VC=12 \ MACHINE=$(gb_MSBUILD_PLATFORM) \ GEN_PDB=$(if $(call gb_Module__symbols_enabled,curl),yes,no) \ + $(if $(call gb_Module__symbols_enabled,curl),CFLAGS_PDB_VALUE="$(gb_DEBUGINFO_FLAGS)") \ DEBUG=$(if $(MSVC_USE_DEBUG_RUNTIME),yes,no) \ ENABLE_IPV6=yes \ ENABLE_SSPI=yes \ ENABLE_WINSSL=yes \ + WITH_ZLIB=static \ ,winbuild) $(call gb_Trace_EndRange,curl,EXTERNAL) diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk index 2cdfbfc08632..e78adabb8d07 100644 --- a/external/curl/UnpackedTarball_curl.mk +++ b/external/curl/UnpackedTarball_curl.mk @@ -21,9 +21,10 @@ $(eval $(call gb_UnpackedTarball_fix_end_of_line,curl,\ $(eval $(call gb_UnpackedTarball_add_patches,curl,\ external/curl/curl-msvc.patch.1 \ + external/curl/curl-msvc-zlib.patch.1 \ external/curl/curl-msvc-disable-protocols.patch.1 \ - external/curl/curl-7.26.0_win-proxy.patch \ external/curl/zlib.patch.0 \ + external/curl/configurable-z-option.patch.0 \ )) ifeq ($(SYSTEM_NSS),) @@ -38,4 +39,10 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl, \ )) endif +ifneq ($(filter -fsanitize=%,$(CC)),) +$(eval $(call gb_UnpackedTarball_add_patches,curl, \ + external/curl/asan-poison-nsspem.patch.0 \ +)) +endif + # vim: set noet sw=4 ts=4: diff --git a/external/curl/asan-poison-nsspem.patch.0 b/external/curl/asan-poison-nsspem.patch.0 new file mode 100644 index 000000000000..1f490bd6bf86 --- /dev/null +++ b/external/curl/asan-poison-nsspem.patch.0 @@ -0,0 +1,11 @@ +--- lib/vtls/nss.c ++++ lib/vtls/nss.c +@@ -1945,7 +1945,7 @@ + + PK11_SetPasswordFunc(nss_get_password); + +- result = nss_load_module(&pem_module, pem_library, "PEM"); ++ result = CURLE_FAILED_INIT; + PR_Unlock(nss_initlock); + if(result == CURLE_FAILED_INIT) + infof(data, "WARNING: failed to load NSS PEM library %s. Using " diff --git a/external/curl/clang-cl.patch.0 b/external/curl/clang-cl.patch.0 index 2fbb10c2a9aa..5dfb19d5ba59 100644 --- a/external/curl/clang-cl.patch.0 +++ b/external/curl/clang-cl.patch.0 @@ -1,6 +1,6 @@ --- winbuild/MakefileBuild.vc +++ winbuild/MakefileBuild.vc -@@ -60,7 +60,7 @@ +@@ -52,7 +52,7 @@ !ELSE CC_NODEBUG = $(CC) /O2 /DNDEBUG CC_DEBUG = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd diff --git a/external/curl/configurable-z-option.patch.0 b/external/curl/configurable-z-option.patch.0 new file mode 100644 index 000000000000..84516ad21917 --- /dev/null +++ b/external/curl/configurable-z-option.patch.0 @@ -0,0 +1,20 @@ +--- winbuild/MakefileBuild.vc.sav 2021-11-13 11:43:40.756226600 +0000 ++++ winbuild/MakefileBuild.vc 2021-11-13 11:52:08.921692300 +0000 +@@ -47,7 +47,7 @@ + + !IF "$(VC)"=="6" + CC_NODEBUG = $(CC) /O2 /DNDEBUG +-CC_DEBUG = $(CC) /Od /Gm /Zi /D_DEBUG /GZ ++CC_DEBUG = $(CC) /Od /Gm $(DEBUG_FLAGS_VALUE) /D_DEBUG /GZ + CFLAGS = /I. /I../lib /I../include /nologo /W4 /GX /DWIN32 /YX /FD /c /DBUILDING_LIBCURL + !ELSE + CC_NODEBUG = $(CC) /O2 /DNDEBUG +@@ -64,7 +64,7 @@ + # Instead of id: just create an archive, that contains all objects + LNKLIB = lib.exe + +-CFLAGS_PDB = /Zi ++CFLAGS_PDB = $(DEBUG_FLAGS_VALUE) + LFLAGS_PDB = /incremental:no /opt:ref,icf /DEBUG + + CFLAGS_LIBCURL_STATIC = /DCURL_STATICLIB diff --git a/external/curl/curl-7.26.0_win-proxy.patch b/external/curl/curl-7.26.0_win-proxy.patch deleted file mode 100644 index 46cdcc739d80..000000000000 --- a/external/curl/curl-7.26.0_win-proxy.patch +++ /dev/null @@ -1,121 +0,0 @@ ---- curl/winbuild/MakefileBuild.vc.orig 2017-10-23 17:15:22.969492548 +0200 -+++ curl/winbuild/MakefileBuild.vc 2017-10-23 17:16:38.491490679 +0200 -@@ -72,7 +72,7 @@ - - CFLAGS_LIBCURL_STATIC = /DCURL_STATICLIB - --WIN_LIBS = ws2_32.lib wldap32.lib advapi32.lib crypt32.lib -+WIN_LIBS = ws2_32.lib wldap32.lib advapi32.lib crypt32.lib winhttp.lib - - BASE_NAME = libcurl - BASE_NAME_DEBUG = $(BASE_NAME)_debug ---- curl-7.26.0/lib/url.c -+++ misc/build/curl-7.26.0/lib/url.c -@@ -78,6 +78,10 @@ - bool curl_win32_idn_to_ascii(const char *in, char **out); - #endif /* USE_LIBIDN2 */ - -+#ifdef _WIN32 -+#include -+#endif -+ - #include "urldata.h" - #include "netrc.h" - -@@ -4586,6 +4590,21 @@ - } - - #ifndef CURL_DISABLE_HTTP -+#ifdef _WIN32 -+static char *wstrToCstr(LPWSTR wStr) -+{ -+ int bufSize; -+ char *out = NULL; -+ if(wStr != NULL) { -+ bufSize = WideCharToMultiByte( -+ CP_ACP, 0, wStr, -1, NULL, 0, NULL, NULL); -+ out = (char *)malloc(bufSize * sizeof(char)); -+ WideCharToMultiByte(CP_ACP, 0, wStr, -1, out, bufSize, NULL, NULL); -+ } -+ return out; -+} -+#endif -+ - /**************************************************************** - * Detect what (if any) proxy to use. Remember that this selects a host - * name and is not limited to HTTP proxies only. -@@ -4613,6 +4633,66 @@ - * For compatibility, the all-uppercase versions of these variables are - * checked if the lowercase versions don't exist. - */ -+#ifdef _WIN32 -+ char *no_proxy = NULL; -+ WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *ieProxyConfig; -+ ieProxyConfig = (WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *) -+ malloc(sizeof(WINHTTP_CURRENT_USER_IE_PROXY_CONFIG)); -+ if(WinHttpGetIEProxyConfigForCurrentUser(ieProxyConfig)) { -+ if(!ieProxyConfig->fAutoDetect) { -+ char *ieProxy; -+ char *ieNoProxy; -+ char *pos; -+ -+ ieProxy = wstrToCstr(ieProxyConfig->lpszProxy); -+ ieNoProxy = wstrToCstr(ieProxyConfig->lpszProxyBypass); -+ -+ /* Convert the ieNoProxy into a proper no_proxy value */ -+ if(NULL != ieNoProxy) { -+ no_proxy = strdup(ieNoProxy); -+ pos = strpbrk(no_proxy, "; "); -+ while(NULL != pos) { -+ no_proxy[pos-no_proxy] = ','; -+ pos = strpbrk(no_proxy, "; "); -+ } -+ } -+ -+ if(!check_noproxy(conn->host.name, no_proxy)) { -+ /* Look for the http proxy setting */ -+ char *tok; -+ char *saveptr; -+ -+ if(NULL != ieProxy) { -+ tok = strtok_s(ieProxy, ";", &saveptr); -+ if(strchr(tok, '=') == NULL) { -+ proxy = strdup(ieProxy); -+ } -+ else { -+ do { -+ if(strncmp(tok, "http=", 5) == 0) { -+ /* We found HTTP proxy value, then use it */ -+ proxy = strdup(tok + 5); -+ } -+ tok = strtok_s(NULL, ";", &saveptr); -+ } -+ while(NULL != tok); -+ } -+ } -+ } -+ -+ free(ieProxy); -+ free(ieNoProxy); -+ } -+ else { -+ /* TODO Handle the Proxy config Auto Detection case */ -+ } -+ -+ GlobalFree(ieProxyConfig->lpszAutoConfigUrl); -+ GlobalFree(ieProxyConfig->lpszProxy); -+ GlobalFree(ieProxyConfig->lpszProxyBypass); -+ } -+ free(no_proxy); -+#else /* !_WIN32 */ - char proxy_env[128]; - const char *protop = conn->handler->scheme; - char *envp = proxy_env; -@@ -4663,6 +4739,7 @@ - } - if(proxy) - infof(data, "Uses proxy env variable %s == '%s'", envp, proxy); -+#endif /* _WIN32 */ - - return proxy; - } diff --git a/external/curl/curl-msvc-disable-protocols.patch.1 b/external/curl/curl-msvc-disable-protocols.patch.1 index a6d06c69b004..71ff0c01a028 100644 --- a/external/curl/curl-msvc-disable-protocols.patch.1 +++ b/external/curl/curl-msvc-disable-protocols.patch.1 @@ -2,7 +2,7 @@ disable protocols nobody needs in MSVC build --- curl/lib/config-win32.h.orig 2017-08-09 16:43:29.464000000 +0200 +++ curl/lib/config-win32.h 2017-08-09 16:47:38.549200000 +0200 -@@ -733,4 +733,20 @@ +@@ -654,4 +654,20 @@ # define ENABLE_IPV6 1 #endif @@ -25,7 +25,7 @@ disable protocols nobody needs in MSVC build #endif /* HEADER_CURL_CONFIG_WIN32_H */ --- curl/winbuild/MakefileBuild.vc.orig 2017-10-23 23:41:21.393200000 +0200 +++ curl/winbuild/MakefileBuild.vc 2017-10-23 23:34:16.028000000 +0200 -@@ -431,7 +431,7 @@ +@@ -562,7 +562,7 @@ EXE_OBJS = $(CURL_OBJS) $(CURL_DIROBJ)\curl.res diff --git a/external/curl/curl-msvc-zlib.patch.1 b/external/curl/curl-msvc-zlib.patch.1 new file mode 100644 index 000000000000..a9ee0013d50b --- /dev/null +++ b/external/curl/curl-msvc-zlib.patch.1 @@ -0,0 +1,16 @@ +find internal zlib in nmake buildsystem + +--- curl/winbuild/MakefileBuild.vc.orig2 2021-10-27 20:44:48.685237000 +0200 ++++ curl/winbuild/MakefileBuild.vc 2021-10-27 20:47:23.792407400 +0200 +@@ -244,8 +244,9 @@ + ZLIB_LIB_DIR = $(ZLIB_PATH)\lib + ZLIB_LFLAGS = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)" + !ELSE +-ZLIB_INC_DIR = $(DEVEL_INCLUDE) +-ZLIB_LIB_DIR = $(DEVEL_LIB) ++ZLIB_INC_DIR = $(WORKDIR)/UnpackedTarball/zlib ++ZLIB_LIB_DIR = $(WORKDIR)/LinkTarget/StaticLibrary ++ZLIB_LFLAGS = $(ZLIB_LFLAGS) "/LIBPATH:$(ZLIB_LIB_DIR)" + !ENDIF + + # Depending on how zlib is built the libraries have different names, we diff --git a/external/curl/curl-msvc.patch.1 b/external/curl/curl-msvc.patch.1 index a5b79a8e9c49..54ad026ec8c7 100644 --- a/external/curl/curl-msvc.patch.1 +++ b/external/curl/curl-msvc.patch.1 @@ -2,7 +2,7 @@ MSVC: using SOLARINC --- curl/winbuild/MakefileBuild.vc.orig 2017-10-23 16:36:07.713550851 +0200 +++ curl/winbuild/MakefileBuild.vc 2017-10-23 16:38:19.301547594 +0200 -@@ -60,7 +60,7 @@ +@@ -52,7 +52,7 @@ !ELSE CC_NODEBUG = $(CC) /O2 /DNDEBUG CC_DEBUG = $(CC) /Od /D_DEBUG /RTC1 /Z7 /LDd @@ -11,7 +11,7 @@ MSVC: using SOLARINC !ENDIF LFLAGS = /nologo /machine:$(MACHINE) -@@ -300,11 +300,11 @@ +@@ -426,11 +426,11 @@ # CURL_XX macros are for the curl.exe command !IF "$(DEBUG)"=="yes" diff --git a/external/curl/curl-nss.patch.1 b/external/curl/curl-nss.patch.1 index d4dad7eba77e..2128849369e7 100644 --- a/external/curl/curl-nss.patch.1 +++ b/external/curl/curl-nss.patch.1 @@ -1,12 +1,17 @@ diff -ur curl.org/configure curl/configure --- curl.org/configure 2016-03-13 15:14:07.177000076 +0100 +++ curl/configure 2016-03-13 15:16:44.132000076 +0100 -@@ -28216,7 +28216,7 @@ +@@ -28230,7 +28230,12 @@ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Using hard-wired libraries and compilation flags for NSS." >&5 printf "%s\n" "$as_me: WARNING: Using hard-wired libraries and compilation flags for NSS." >&2;} addld="-L$OPT_NSS/lib" - addlib="-lssl3 -lsmime3 -lnss3 -lplds4 -lplc4 -lnspr4" + addlib="-lssl3 -lsmime3 -lnss3 -lplds4 -lplc4 -lnspr4 -lnssutil3" ++ case $host_os in ++ *android*) ++ addlib="${addlib} -llog" ++ ;; ++ esac addcflags="-I$OPT_NSS/include" version="unknown" nssprefix=$OPT_NSS diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0 index e0f579f8675a..b4442ba262d1 100644 --- a/external/curl/zlib.patch.0 +++ b/external/curl/zlib.patch.0 @@ -1,6 +1,6 @@ --- configure +++ configure -@@ -22699,7 +22699,6 @@ +@@ -23035,7 +23035,6 @@ clean_CPPFLAGS=$CPPFLAGS clean_LDFLAGS=$LDFLAGS clean_LIBS=$LIBS @@ -8,7 +8,7 @@ # Check whether --with-zlib was given. if test ${with_zlib+y} -@@ -22709,6 +22708,7 @@ +@@ -23045,6 +23044,7 @@ if test "$OPT_ZLIB" = "no" ; then @@ -16,7 +16,7 @@ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5 printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;} else -@@ -22716,6 +22716,21 @@ +@@ -23052,6 +23052,21 @@ OPT_ZLIB="" fi @@ -38,7 +38,7 @@ if test -z "$OPT_ZLIB" ; then if test -n "$PKG_CONFIG"; then -@@ -23011,6 +23026,7 @@ +@@ -23344,6 +23359,7 @@ printf "%s\n" "$as_me: found both libz and libz.h header" >&6;} curl_zlib_msg="enabled" fi @@ -48,7 +48,7 @@ if test x"$AMFIXLIB" = x1; then --- configure.ac +++ configure.ac -@@ -880,19 +880,30 @@ +@@ -1243,19 +1243,30 @@ clean_CPPFLAGS=$CPPFLAGS clean_LDFLAGS=$LDFLAGS clean_LIBS=$LIBS @@ -80,7 +80,7 @@ if test -z "$OPT_ZLIB" ; then CURL_CHECK_PKGCONFIG(zlib) -@@ -975,6 +986,7 @@ +@@ -1336,6 +1347,7 @@ AC_MSG_NOTICE([found both libz and libz.h header]) curl_zlib_msg="enabled" fi -- cgit v1.2.3