bagder: curl-www/CVE-2009-0037 curl-7.18.2-CVE-2009-0037.patch, 1.2, 1.3

Update of /cvsroot/curl/curl-www/CVE-2009-0037
In directory labb:/tmp/cvs-serv18685

Modified Files:
	curl-7.18.2-CVE-2009-0037.patch 
Log Message:
Brought in Michal Marek's fix for curl_easy_reset() from the 7.18.1 patch
into this.


Index: curl-7.18.2-CVE-2009-0037.patch
===================================================================
RCS file: /cvsroot/curl/curl-www/CVE-2009-0037/curl-7.18.2-CVE-2009-0037.patch,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -d -r1.2 -r1.3
--- curl-7.18.2-CVE-2009-0037.patch	3 Mar 2009 10:05:59 -0000	1.2
+++ curl-7.18.2-CVE-2009-0037.patch	7 Mar 2009 23:33:27 -0000	1.3
@@ -1,7 +1,7 @@
 Only in curl-7.18.2-protpatched: debug
 diff -X curl/diff-exclude -ru curl-7.18.2/docs/libcurl/curl_easy_setopt.3 curl-7.18.2-protpatched/docs/libcurl/curl_easy_setopt.3
 --- curl-7.18.2/docs/libcurl/curl_easy_setopt.3	2008-05-24 13:19:51.000000000 +0200
-+++ curl-7.18.2-protpatched/docs/libcurl/curl_easy_setopt.3	2009-02-24 10:26:15.000000000 +0100
++++ curl-7.18.2-protpatched/docs/libcurl/curl_easy_setopt.3	2009-03-08 00:26:20.000000000 +0100
 @@ -438,6 +438,26 @@
  
  \fICURLOPT_URL\fP is the only option that \fBmust\fP be set before
@@ -42,7 +42,7 @@
  (user+password) when following locations, even when hostname changed. This
 diff -X curl/diff-exclude -ru curl-7.18.2/include/curl/curl.h curl-7.18.2-protpatched/include/curl/curl.h
 --- curl-7.18.2/include/curl/curl.h	2008-06-04 17:36:10.000000000 +0200
-+++ curl-7.18.2-protpatched/include/curl/curl.h	2009-02-24 10:26:17.000000000 +0100
++++ curl-7.18.2-protpatched/include/curl/curl.h	2009-03-08 00:26:20.000000000 +0100
 @@ -592,6 +592,21 @@
    CURLFTPMETHOD_LAST       /* not an option, never use */
  } curl_ftpmethod;
@@ -78,18 +78,35 @@
 +  /* set the bitmask for the protocols that libcurl is allowed to follow to,
 +     as a subset of the CURLOPT_PROTOCOLS ones. That means the protocol needs
 +     to be set in both bitmasks to be allowed to get redirected to. Defaults
-+     to all protocols except FILE and SCP. */
++     to CURLPROTO_ALL & ~CURLPROTO_FILE. */
 +  CINIT(REDIR_PROTOCOLS, LONG, 182),
 +
    CURLOPT_LASTENTRY /* the last unused */
  } CURLoption;
  
+diff -X curl/diff-exclude -ru curl-7.18.2/lib/easy.c curl-7.18.2-protpatched/lib/easy.c
+--- curl-7.18.2/lib/easy.c	2008-05-12 23:43:29.000000000 +0200
++++ curl-7.18.2-protpatched/lib/easy.c	2009-03-08 00:26:20.000000000 +0100
+@@ -767,6 +767,13 @@
+                                                       type */
+   data->set.new_file_perms = 0644;    /* Default permissions */
+   data->set.new_directory_perms = 0755; /* Default permissions */
++
++  /* for the *protocols fields we don't use the CURLPROTO_ALL convenience
++     define since we internally only use the lower 16 bits for the passed
++     in bitmask to not conflict with the private bits */
++  data->set.allowed_protocols = PROT_EXTMASK;
++  data->set.redir_protocols =
++    PROT_EXTMASK & ~(CURLPROTO_FILE|CURLPROTO_SCP); /* not FILE or SCP */
+ }
+ 
+ /*
 diff -X curl/diff-exclude -ru curl-7.18.2/lib/url.c curl-7.18.2-protpatched/lib/url.c
 --- curl-7.18.2/lib/url.c	2008-04-30 23:20:09.000000000 +0200
-+++ curl-7.18.2-protpatched/lib/url.c	2009-02-24 10:30:02.000000000 +0100
-@@ -743,6 +743,13 @@
- 
-     Curl_easy_initHandleData(data);
++++ curl-7.18.2-protpatched/lib/url.c	2009-03-08 00:26:20.000000000 +0100
+@@ -738,6 +738,13 @@
+     data->set.new_file_perms = 0644;    /* Default permissions */
+     data->set.new_directory_perms = 0755; /* Default permissions */
  
 +    /* for the *protocols fields we don't use the CURLPROTO_ALL convenience
 +       define since we internally only use the lower 16 bits for the passed
@@ -98,9 +115,9 @@
 +    data->set.redir_protocols =
 +      PROT_EXTMASK & ~(CURLPROTO_FILE|CURLPROTO_SCP); /* not FILE or SCP */
 +
-     /*
-      * libcurl 7.10 introduced SSL verification *by default*! This needs to be
-      * switched off unless wanted.
+     /* most recent connection is not yet defined */
+     data->state.lastconnect = -1;
+ 
 @@ -2083,6 +2090,22 @@
      }
      break;
@@ -117,22 +134,14 @@
 +    /* set the bitmask for the protocols that libcurl is allowed to follow to,
 +       as a subset of the CURLOPT_PROTOCOLS ones. That means the protocol needs
 +       to be set in both bitmasks to be allowed to get redirected to. Defaults
-+       to all protocols except FILE and SCP. */
++       to CURLPROTO_ALL & ~CURLPROTO_FILE. */
 +    data->set.redir_protocols = va_arg(param, long) & PROT_EXTMASK;
 +    break;
 +
    default:
      /* unknown tag and its companion, just ignore: */
      result = CURLE_FAILED_INIT; /* correct this */
-@@ -2338,7 +2361,6 @@
-   }
- }
- 
--
- /*
-  * Given one filled in connection struct (named needle), this function should
-  * detect if there already is one that has all the significant details
-@@ -3136,7 +3158,19 @@
+@@ -3136,7 +3159,19 @@
  
    for (pp = protocols; (p = *pp) != NULL; pp++)
      if(strequal(p->scheme, conn->protostr)) {
@@ -155,7 +164,7 @@
        if(p->setup_connection) {
 diff -X curl/diff-exclude -ru curl-7.18.2/lib/urldata.h curl-7.18.2-protpatched/lib/urldata.h
 --- curl-7.18.2/lib/urldata.h	2008-04-30 23:20:09.000000000 +0200
-+++ curl-7.18.2-protpatched/lib/urldata.h	2009-02-24 10:27:00.000000000 +0100
++++ curl-7.18.2-protpatched/lib/urldata.h	2009-03-08 00:26:20.000000000 +0100
 @@ -865,19 +865,26 @@
    long connectindex; /* what index in the connection cache connects index this
                          particular struct has */