diff mbox series

[scarthgap] curl: fix CVE-2025-10148 backport for websockets on 8.7.1

Message ID 20260813163747.3020711-1-ecordonnier@snap.com
State New
Headers show
Series [scarthgap] curl: fix CVE-2025-10148 backport for websockets on 8.7.1 | expand

Commit Message

Etienne Cordonnier Aug. 13, 2026, 4:37 p.m. UTC 
From: Etienne Cordonnier <ecordonnier@snap.com>

The original backport applied upstream's CURLcode return path into
ssize_t ws_enc_write_head(), which uses an undeclared result and is
invalid for curl 8.7.1's API. Builds with --enable-websockets fail.

Adapt Curl_rand() error handling to set *err and return -1.

AI-Generated: Claude Sonnet 4.6
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
---
 .../curl/curl/CVE-2025-10148.patch            | 24 +++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2025-10148.patch b/meta/recipes-support/curl/curl/CVE-2025-10148.patch
index d37497febe..654f4151e9 100644
--- a/meta/recipes-support/curl/curl/CVE-2025-10148.patch
+++ b/meta/recipes-support/curl/curl/CVE-2025-10148.patch
@@ -9,23 +9,28 @@  Closes #18496
 CVE: CVE-2025-10148
 Upstream-Status: Backport [https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa]
 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
 ---
- lib/ws.c | 21 +++++++++++++--------
- 1 file changed, 13 insertions(+), 8 deletions(-)
+ lib/ws.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
 
 diff --git a/lib/ws.c b/lib/ws.c
 index 5bc5ecc..02e0ef0 100644
 --- a/lib/ws.c
 +++ b/lib/ws.c
-@@ -614,6 +614,18 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data,
+@@ -614,6 +614,22 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data,
    enc->payload_remain = enc->payload_len = payload_len;
    ws_enc_info(enc, data, "sending");
  
-+    /* 4 bytes random */
-+
-+  result = Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask));
-+  if(result)
-+    return result;
++  /* 4 bytes random */
++  {
++    CURLcode result = Curl_rand(data, (unsigned char *)&enc->mask,
++                                sizeof(enc->mask));
++    if(result) {
++      *err = result;
++      return -1;
++    }
++  }
 +
 +#ifdef DEBUGBUILD
 +  if(getenv("CURL_WS_FORCE_ZERO_MASK"))
@@ -36,7 +41,7 @@  index 5bc5ecc..02e0ef0 100644
    /* add 4 bytes mask */
    memcpy(&head[hlen], &enc->mask, 4);
    hlen += 4;
-@@ -802,14 +814,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
+@@ -802,14 +818,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
       subprotocol not requested by the client), the client MUST Fail
       the WebSocket Connection. */
  
@@ -54,4 +59,3 @@  index 5bc5ecc..02e0ef0 100644
    result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode,
 -- 
 2.50.1
-