curl: 8.11.1 -> 8.12.0

https://github.com/curl/curl/releases/tag/curl-8_12_0 https://curl.se/ch/8.12.0.html Fixes three low severity vulnerabilities: - CVE-2025-0725: https://curl.se/docs/CVE-2025-0725.html - CVE-2025-0665: https://curl.se/docs/CVE-2025-0665.html - CVE-2025-0167: https://curl.se/docs/CVE-2025-0167.html Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
2025-02-07 09:12:04 +01:00
parent ad89ad52a2
commit b158812f3b
3 changed files with 2 additions and 165 deletions
@@ -1,33 +0,0 @@
-From ff5091aa9f73802e894b1cbdf24ab84e103200e2 Mon Sep 17 00:00:00 2001
-From: Andy Pan <i@andypan.me>
-Date: Thu, 12 Dec 2024 12:48:56 +0000
-Subject: [PATCH] async-thread: avoid closing eventfd twice
-
-When employing eventfd for socketpair, there is only one file
-descriptor. Closing that fd twice might result in fd corruption.
-Thus, we should avoid closing the eventfd twice, following the
-pattern in lib/multi.c.
-
-Fixes #15725
-Closes #15727
-Reported-by: Christian Heusel
---
- lib/asyn-thread.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/lib/asyn-thread.c b/lib/asyn-thread.c
-index a58e4b790494..32d496b107cb 100644
--- a/lib/asyn-thread.c
-+++ b/lib/asyn-thread.c
-@@ -195,9 +195,11 @@ void destroy_thread_sync_data(struct thread_sync_data *tsd)
-    * close one end of the socket pair (may be done in resolver thread);
-    * the other end (for reading) is always closed in the parent thread.
-    */
-+#ifndef USE_EVENTFD
-   if(tsd->sock_pair[1] != CURL_SOCKET_BAD) {
-     wakeup_close(tsd->sock_pair[1]);
-   }
-+#endif
- #endif
-   memset(tsd, 0, sizeof(*tsd));
- }
@@ -1,123 +0,0 @@
-From 9fce2c55d4b0273ac99b59bd8cb982a6d96b88cf Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Tue, 17 Dec 2024 23:56:42 +0100
-Subject: [PATCH] netrc: fix password-only entries
-
-When a specific hostname matched, and only a password is set before
-another machine is specified in the netrc file, the parser would not be
-happy and stop there and return the password-only state. It instead
-continued and did not return a match.
-
-Add test 2005 to verify this case
-
-Regression from e9b9bba, shipped in 8.11.1.
-
-Reported-by: Ben Zanin
-Fixes #15767
-Closes #15768
---
- lib/netrc.c            |  7 +++++-
- tests/data/Makefile.am |  2 +-
- tests/data/test2005    | 55 ++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 62 insertions(+), 2 deletions(-)
- create mode 100644 tests/data/test2005
-
-diff --git a/lib/netrc.c b/lib/netrc.c
-index cbc86484f6f8..b517c1dfab67 100644
--- a/lib/netrc.c
-+++ b/lib/netrc.c
-@@ -267,7 +267,8 @@ static int parsenetrc(struct store_netrc *store,
-             retcode = NETRC_FAILED; /* allocation failed */
-             goto out;
-           }
-          found |= FOUND_PASSWORD;
-+          if(!specific_login || our_login)
-+            found |= FOUND_PASSWORD;
-           keyword = NONE;
-         }
-         else if(strcasecompare("login", tok))
-@@ -276,6 +277,10 @@ static int parsenetrc(struct store_netrc *store,
-           keyword = PASSWORD;
-         else if(strcasecompare("machine", tok)) {
-           /* a new machine here */
-+          if(found & FOUND_PASSWORD) {
-+            done = TRUE;
-+            break;
-+          }
-           state = HOSTFOUND;
-           keyword = NONE;
-           found = 0;
-diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
-index bd9a0bbaaff1..105108309d52 100644
--- a/tests/data/Makefile.am
-+++ b/tests/data/Makefile.am
-@@ -238,7 +238,7 @@ test1941 test1942 test1943 test1944 test1945 test1946 test1947 test1948 \
- test1955 test1956 test1957 test1958 test1959 test1960 test1964 \
- test1970 test1971 test1972 test1973 test1974 test1975 test1976 \
- \
-test2000 test2001 test2002 test2003 test2004 \
-+test2000 test2001 test2002 test2003 test2004 test2005 \
- \
-                                                                test2023 \
- test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
-diff --git a/tests/data/test2005 b/tests/data/test2005
-new file mode 100644
-index 000000000000..91e256298a40
--- /dev/null
-+++ b/tests/data/test2005
-@@ -0,0 +1,55 @@
-+<testcase>
-+<info>
-+<keywords>
-+HTTP
-+netrc
-+</keywords>
-+</info>
-+#
-+# Server-side
-+<reply>
-+<data>
-+HTTP/1.1 200 OK
-+Date: Fri, 05 Aug 2022 10:09:00 GMT
-+Server: test-server/fake
-+Content-Type: text/plain
-+Content-Length: 6
-+Connection: close
-+
-+-foo-
-+</data>
-+</reply>
-+
-+#
-+# Client-side
-+<client>
-+<server>
-+http
-+</server>
-+<name>
-+netrc match with password only in file, no username. machine follows
-+</name>
-+<command>
-+--netrc-optional --netrc-file %LOGDIR/netrc%TESTNUMBER http://%HOSTIP:%HTTPPORT/
-+</command>
-+<file name="%LOGDIR/netrc%TESTNUMBER" >
-+machine %HOSTIP
-+password 5up3r53cr37
-+
-+machine example.com
-+</file>
-+</client>
-+
-+#
-+# Verify data after the test has been "shot"
-+<verify>
-+<protocol>
-+GET / HTTP/1.1
-+Host: %HOSTIP:%HTTPPORT
-+Authorization: Basic %b64[:5up3r53cr37]b64%
-+User-Agent: curl/%VERSION
-+Accept: */*
-+
-+</protocol>
-+</verify>
-+</testcase>
@@ -53,23 +53,16 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "curl";
-  version = "8.11.1";
+  version = "8.12.0";

  src = fetchurl {
    urls = [
      "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
      "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
    ];
-    hash = "sha256-x8p9tIsJCXQ+rvNCUNoCwZvGHU8dzt1mA/EJQJU2q1Y=";
+    hash = "sha256-mkYox2S+axqZCVZ8E+jncQQWCd9DshWPysTgXqcJfl0=";
  };

-  patches = [
-    # https://github.com/curl/curl/issues/15725
-    ./fix-eventfd-free.patch
-    # https://github.com/curl/curl/issues/15767
-    ./fix-password-only-netrc.patch
-  ];
-
  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
  # necessary for FreeBSD code path in configure
  postPatch = ''