new file mode 100644

@@ -0,0 +1,39 @@

+From 583b42cb3b809b1bf597af160468ccba728c2248 Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Fri, 23 Mar 2018 23:30:04 +0100

+Subject: [PATCH] pingpong: fix response cache memcpy overflow

+

+Response data for a handle with a large buffer might be cached and then

+used with the "closure" handle when it has a smaller buffer and then the

+larger cache will be copied and overflow the new smaller heap based

+buffer.

+

+Reported-by: Dario Weisser

+CVE: CVE-2018-1000300

+Bug: https://curl.haxx.se/docs/adv_2018-82c2.html

+---

+ lib/pingpong.c | 5 ++++-

+ 1 file changed, 4 insertions(+), 1 deletion(-)

+

+diff --git a/lib/pingpong.c b/lib/pingpong.c

+index 438856a99..ad370ee82 100644

+--- a/lib/pingpong.c

+@@ -302,11 +302,14 @@ CURLcode Curl_pp_readresp(curl_socket_t sockfd,

+        *

+        * pp->cache_size is cast to ssize_t here.  This should be safe, because

+        * it would have been populated with something of size int to begin

+        * with, even though its datatype may be larger than an int.

+        */

+-      DEBUGASSERT((ptr + pp->cache_size) <= (buf + data->set.buffer_size + 1));

++      if((ptr + pp->cache_size) > (buf + data->set.buffer_size + 1)) {

++        failf(data, "cached response data too big to handle");

++        return CURLE_RECV_ERROR;

++      }

+       memcpy(ptr, pp->cache, pp->cache_size);

+       gotbytes = (ssize_t)pp->cache_size;

+       free(pp->cache);    /* free the cache */

+       pp->cache = NULL;   /* clear the pointer */

+       pp->cache_size = 0; /* zero the size just in case */

+-- 

+2.17.0

new file mode 100644

@@ -0,0 +1,51 @@

+From 8c7b3737d29ed5c0575bf592063de8a51450812d Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Sat, 24 Mar 2018 23:47:41 +0100

+Subject: [PATCH] http: restore buffer pointer when bad response-line is parsed

+

+... leaving the k->str could lead to buffer over-reads later on.

+

+CVE: CVE-2018-1000301

+Assisted-by: Max Dymond

+

+Detected by OSS-Fuzz.

+Bug: https://curl.haxx.se/docs/adv_2018-b138.html

+Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7105

+---

+ lib/http.c | 6 +++++-

+ 1 file changed, 5 insertions(+), 1 deletion(-)

+

+diff --git a/lib/http.c b/lib/http.c

+index 1a313b4fb..e080ae513 100644

+--- a/lib/http.c

+@@ -3012,10 +3012,12 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,

+                                        ssize_t *nread,

+                                        bool *stop_reading)

+ {

+   CURLcode result;

+   struct SingleRequest *k = &data->req;

++  ssize_t onread = *nread;

++  char *ostr = k->str;

+ 

+   /* header line within buffer loop */

+   do {

+     size_t rest_length;

+     size_t full_length;

+@@ -3076,11 +3078,13 @@ CURLcode Curl_http_readwrite_headers(struct Curl_easy *data,

+           /* since there's more, this is a partial bad header */

+           k->badheader = HEADER_PARTHEADER;

+         else {

+           /* this was all we read so it's all a bad header */

+           k->badheader = HEADER_ALLBAD;

+-          *nread = (ssize_t)rest_length;

++          *nread = onread;

++          k->str = ostr;

++          return CURLE_OK;

+         }

+         break;

+       }

+     }

+ 

+-- 

+2.17.0

@@ -1,7 +1,7 @@

 Summary:        An URL retrieval utility and library

 Name:           curl

 Version:        7.59.0

-Release:        1%{?dist}

+Release:        2%{?dist}

 License:        MIT

 URL:            http://curl.haxx.se

 Group:          System Environment/NetworkingLibraries

@@ -9,6 +9,8 @@ Vendor:         VMware, Inc.

 Distribution:   Photon

 Source0:        http://curl.haxx.se/download/%{name}-%{version}.tar.gz

 %define sha1    curl=1a9bd7e201e645207b23a4b4dc38a32cc494a638

+Patch0:         curl-CVE-2018-1000300.patch

+Patch1:         curl-CVE-2018-1000301.patch

 Requires:       ca-certificates

 BuildRequires:  ca-certificates

 Requires:       openssl

@@ -25,6 +27,8 @@ functions like streaming media.

 %prep

 %setup -q

 sed -i '/--static-libs)/{N;s#echo .*#echo #;}' curl-config.in

+%patch0 -p1

+%patch1 -p1

 %build

 ./configure \

     CFLAGS="%{optflags}" \

@@ -63,6 +67,8 @@ rm -rf %{buildroot}/*

 %{_datarootdir}/aclocal/libcurl.m4

 %{_docdir}/%{name}-%{version}

 %changelog

+*   Thu Jul 05 2018 Keerthana K <keerthanak@vmware.com> 7.59.0-2

+-   Fix for CVE-2018-1000300, CVE-2018-1000301.

 *   Wed Apr 04 2018 Dheeraj Shetty <dheerajs@vmware.com> 7.59.0-1

 -   Update to version 7.59.0

 *   Mon Feb 12 2018 Xiaolin Li <xiaolinl@vmware.com> 7.58.0-1