diff mbox series

[wrynose,04/12] curl: fix CVE-2026-92387

Message ID 20261104073627.302002-5-dkelaiya@cisco.com
State New
Headers show
Series curl: Security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 4, 2026, 7:36 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

Limit each Curl_pp_readresp() call to ten new socket reads so an
unfinished response cannot monopolize the multi interface.

[1] https://github.com/curl/curl/commit/753735af87f5c30cb6f60a70342f8bc4bc5fd5db
[2] https://curl.se/docs/CVE-2026-92387.html

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../curl/curl/CVE-2026-92387.patch            | 43 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
 2 files changed, 44 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92387.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-92387.patch b/meta/recipes-support/curl/curl/CVE-2026-92387.patch
new file mode 100644
index 00000000000..d997aa478a3
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-92387.patch
@@ -0,0 +1,43 @@ 
+From 753735af87f5c30cb6f60a70342f8bc4bc5fd5db Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sun, 13 Sep 2026 16:12:01 +0200
+Subject: [PATCH] pingpong: add a max loop counter for Curl_pp_readresp
+
+To make sure it cannot get stuck in this function.
+
+Reported-by: Joshua Rogers
+Closes #22932
+
+CVE: CVE-2026-92387
+Upstream-Status: Backport [https://github.com/curl/curl/commit/753735af87f5c30cb6f60a70342f8bc4bc5fd5db]
+
+(cherry picked from commit 753735af87f5c30cb6f60a70342f8bc4bc5fd5db)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/pingpong.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/pingpong.c b/lib/pingpong.c
+index 4ede0a5..b32651a 100644
+--- a/lib/pingpong.c
++++ b/lib/pingpong.c
+@@ -253,6 +253,7 @@ CURLcode Curl_pp_readresp(struct Curl_easy *data,
+   CURLcode result = CURLE_OK;
+   size_t gotbytes;
+   char buffer[900];
++  int maxloops = 10;
+ 
+   *code = 0; /* 0 for errors or not done */
+   *size = 0;
+@@ -270,6 +271,9 @@ CURLcode Curl_pp_readresp(struct Curl_easy *data,
+       pp->nfinal = 0; /* now gone */
+     }
+     if(!pp->overflow) {
++      if(!maxloops--) /* don't get stuck */
++        return CURLE_OK;
++
+       result = pingpong_read(data, sockindex, buffer, sizeof(buffer),
+                              &gotbytes);
+       if(result == CURLE_AGAIN)
+-- 
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 3828c26f507..c4a1167d1ba 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -51,6 +51,7 @@  SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2026-86414.patch \
            file://CVE-2026-86409.patch \
            file://CVE-2026-87862.patch \
+           file://CVE-2026-92387.patch \
            "
 
 SRC_URI:append:class-nativesdk = " \