new file mode 100644

@@ -0,0 +1,34 @@

+From 57d299a499155d4b327e341c6024e293b0418243 Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Mon, 13 Aug 2018 10:35:52 +0200

+Subject: [PATCH] Curl_ntlm_core_mk_nt_hash: return error on too long password

+

+... since it would cause an integer overflow if longer than (max size_t

+/ 2).

+

+This is CVE-2018-14618

+

+Bug: https://curl.haxx.se/docs/CVE-2018-14618.html

+Closes #2756

+Reported-by: Zhaoyang Wu

+---

+ lib/curl_ntlm_core.c | 5 ++++-

+ 1 file changed, 4 insertions(+), 1 deletion(-)

+

+diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c

+index e27cab353c..922e85a926 100644

+--- a/lib/curl_ntlm_core.c

+@@ -557,8 +557,11 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struct Curl_easy *data,

+                                    unsigned char *ntbuffer /* 21 bytes */)

+ {

+   size_t len = strlen(password);

+-  unsigned char *pw = len ? malloc(len * 2) : strdup("");

++  unsigned char *pw;

+   CURLcode result;

++  if(len > SIZE_T_MAX/2) /* avoid integer overflow */

++    return CURLE_OUT_OF_MEMORY;

++  pw = len ? malloc(len * 2) : strdup("");

+   if(!pw)

+     return CURLE_OUT_OF_MEMORY;

+ 

new file mode 100644

@@ -0,0 +1,123 @@

+From c1366571b609407cf0d4d9f4a2769d29e1313151 Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Tue, 20 Mar 2018 15:15:14 +0100

+Subject: [PATCH] vauth/cleartext: fix integer overflow check

+

+Make the integer overflow check not rely on the undefined behavior that

+a size_t wraps around on overflow.

+

+Detected by lgtm.com

+Closes #2408

+---

+ lib/curl_ntlm_core.c  | 11 +----------

+ lib/curl_setup.h      |  9 +++++++++

+ lib/vauth/cleartext.c | 14 ++++----------

+ 3 files changed, 14 insertions(+), 20 deletions(-)

+

+diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c

+index e8962769ca..72eda34ad1 100644

+--- a/lib/curl_ntlm_core.c

+@@ -5,7 +5,7 @@

+  *                            | (__| |_| |  _ <| |___

+  *                             \___|\___/|_| \_\_____|

+  *

+- * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.

++ * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

+  *

+  * This software is licensed as described in the file COPYING, which

+  * you should have received as part of this distribution. The terms

+@@ -646,15 +646,6 @@ CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen,

+   return CURLE_OK;

+ }

+ 

+-#ifndef SIZE_T_MAX

+-/* some limits.h headers have this defined, some don't */

+-#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)

+-#define SIZE_T_MAX 18446744073709551615U

+-#else

+-#define SIZE_T_MAX 4294967295U

+-#endif

+-#endif

+-

+ /* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode

+  * (uppercase UserName + Domain) as the data

+  */

+diff --git a/lib/curl_setup.h b/lib/curl_setup.h

+index f128696e9d..e4503c64ca 100644

+--- a/lib/curl_setup.h

+@@ -447,6 +447,15 @@

+ #  endif

+ #endif

+ 

++#ifndef SIZE_T_MAX

++/* some limits.h headers have this defined, some don't */

++#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)

++#define SIZE_T_MAX 18446744073709551615U

++#else

++#define SIZE_T_MAX 4294967295U

++#endif

++#endif

++

+ /*

+  * Arg 2 type for gethostname in case it hasn't been defined in config file.

+  */

+diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c

+index a761ae7846..5d61ce6dc2 100644

+--- a/lib/vauth/cleartext.c

+@@ -5,7 +5,7 @@

+  *                            | (__| |_| |  _ <| |___

+  *                             \___|\___/|_| \_\_____|

+  *

+- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.

++ * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.

+  *

+  * This software is licensed as described in the file COPYING, which

+  * you should have received as part of this distribution. The terms

+@@ -73,16 +73,10 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,

+   ulen = strlen(userp);

+   plen = strlen(passwdp);

+ 

+-  /* Compute binary message length, checking for overflows. */

+-  plainlen = 2 * ulen;

+-  if(plainlen < ulen)

+-    return CURLE_OUT_OF_MEMORY;

+-  plainlen += plen;

+-  if(plainlen < plen)

+-    return CURLE_OUT_OF_MEMORY;

+-  plainlen += 2;

+-  if(plainlen < 2)

++  /* Compute binary message length. Check for overflows. */

++  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))

+     return CURLE_OUT_OF_MEMORY;

++  plainlen = 2 * ulen + plen + 2;

+ 

+   plainauth = malloc(plainlen);

+   if(!plainauth)

+From f3a24d7916b9173c69a3e0ee790102993833d6c5 Mon Sep 17 00:00:00 2001

+From: Daniel Stenberg <daniel@haxx.se>

+Date: Fri, 28 Sep 2018 16:08:16 +0200

+Subject: [PATCH] Curl_auth_create_plain_message: fix too-large-input-check

+

+CVE-2018-16839

+Reported-by: Harry Sintonen

+Bug: https://curl.haxx.se/docs/CVE-2018-16839.html

+---

+ lib/vauth/cleartext.c | 2 +-

+ 1 file changed, 1 insertion(+), 1 deletion(-)

+

+diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c

+index a10edbdc74..be6d6111e2 100644

+--- a/lib/vauth/cleartext.c

+@@ -74,7 +74,7 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,

+   plen = strlen(passwdp);

+ 

+   /* Compute binary message length. Check for overflows. */

+-  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))

++  if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))

+     return CURLE_OUT_OF_MEMORY;

+   plainlen = 2 * ulen + plen + 2;

+ 

@@ -1,7 +1,7 @@

 Summary:        An URL retrieval utility and library

 Name:           curl

 Version:        7.59.0

-Release:        4%{?dist}

+Release:        5%{?dist}

 License:        MIT

 URL:            http://curl.haxx.se

 Group:          System Environment/NetworkingLibraries

@@ -12,14 +12,17 @@ Source0:        http://curl.haxx.se/download/%{name}-%{version}.tar.gz

 Patch0:         curl-CVE-2018-1000300.patch

 Patch1:         curl-CVE-2018-1000301.patch

 Patch2:         curl-CVE-2018-0500.patch

-Patch3:		curl-CVE-2018-16840.patch

-Patch4:		curl-CVE-2018-16842.patch

+Patch3:         curl-CVE-2018-16839.patch

+Patch4:         curl-CVE-2018-16840.patch

+Patch5:         curl-CVE-2018-16842.patch

+Patch6:         curl-CVE-2018-14618.patch

 Requires:       ca-certificates

 BuildRequires:  ca-certificates

 Requires:       openssl

 BuildRequires:  openssl-devel

 Requires:       libssh2

 BuildRequires:  libssh2-devel

+

 %description

 The cURL package contains an utility and a library used for 

 transferring files with URL syntax to any of the following 

@@ -27,6 +30,7 @@ protocols: FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET,

 DICT, LDAP, LDAPS and FILE. Its ability to both download and 

 upload files can be incorporated into other programs to support

 functions like streaming media.

+

 %prep

 %setup -q

 sed -i '/--static-libs)/{N;s#echo .*#echo #;}' curl-config.in

@@ -35,6 +39,9 @@ sed -i '/--static-libs)/{N;s#echo .*#echo #;}' curl-config.in

 %patch2 -p1

 %patch3 -p1

 %patch4 -p1

+%patch5 -p1

+%patch6 -p1

+

 %build

 ./configure \

     CFLAGS="%{optflags}" \

@@ -49,6 +56,7 @@ sed -i '/--static-libs)/{N;s#echo .*#echo #;}' curl-config.in

     --with-libssh2 \

     --with-ca-bundle=/etc/pki/tls/certs/ca-bundle.crt

 make %{?_smp_mflags}

+

 %install

 [ %{buildroot} != "/"] && rm -rf %{buildroot}/*

 make DESTDIR=%{buildroot} install

@@ -57,10 +65,14 @@ find %{buildroot}/%{_libdir} -name '*.la' -delete

 %{_fixperms} %{buildroot}/*

 %check

 make -k check |& tee %{_specdir}/%{name}-check-log || %{nocheck}

+

 %post   -p /sbin/ldconfig

+

 %postun -p /sbin/ldconfig

+

 %clean

 rm -rf %{buildroot}/*

+

 %files

 %defattr(-,root,root)

 %{_bindir}/*

@@ -72,7 +84,10 @@ rm -rf %{buildroot}/*

 %{_datarootdir}/aclocal/libcurl.m4

 %{_docdir}/%{name}-%{version}

+

 %changelog

+*   Wed Jan 30 2019 Dweep Advani <dadvani@vmware.com> 7.59.0-5

+-   Fixed CVE-2018-14618 and CVE-2018-16839

 *   Thu Jan 03 2019 Siju Maliakkal <smaliakkal@vmware.com> 7.59.0-4

 -   Apply patches for CVE-2018-16840, CVE-2018-16842

 *   Tue Sep 18 2018 Keerthana K <keerthanak@vmware.com> 7.59.0-3