From fbdd241e64bbd651a7d0bbcac6a9f63403795ed3 Mon Sep 17 00:00:00 2001 From: Michael Stahl Date: Wed, 21 Jul 2021 11:57:51 +0200 Subject: curl: upgrade to release 7.78.0 * Fixes CVE-2020-8284 CVE-2021-22924 * Also fixes these which don't look relevant to LO: CVE-2020-8231 CVE-2020-8285 CVE-2020-8286 CVE-2021-22876 CVE-2021-22890 CVE-2021-22897 CVE-2021-22898 CVE-2021-22901 CVE-2021-22922 CVE-2021-22923 CVE-2021-22925 CVE-2021-22926 * disable some new protocols and dependencies * remove curl-ios.patch.1 as the code no longer exists upstream Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119313 Tested-by: Jenkins Reviewed-by: Michael Stahl (cherry picked from commit 946f457c885bd10ff1a7281c351f3981f035f5a7) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119262 Reviewed-by: Thorsten Behrens (cherry picked from commit 020eb3b363a5c9444c97075a2e15b63ccbe7bf2d) Change-Id: I12d5f87f4d503a5f9859226a05cfe2a07e46d993 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119423 Tested-by: Thorsten Behrens Reviewed-by: Thorsten Behrens --- RepositoryExternal.mk | 2 +- download.lst | 4 ++-- external/curl/ExternalPackage_curl.mk | 4 ++-- external/curl/ExternalProject_curl.mk | 7 ++++--- external/curl/curl-7.26.0_win-proxy.patch | 2 +- external/curl/curl-msvc-disable-protocols.patch.1 | 7 ++++--- external/curl/zlib.patch.0 | 4 ++-- 7 files changed, 16 insertions(+), 14 deletions(-) diff --git a/RepositoryExternal.mk b/RepositoryExternal.mk index 6a3b785c3695..717b70efa0dc 100644 --- a/RepositoryExternal.mk +++ b/RepositoryExternal.mk @@ -2754,7 +2754,7 @@ $(call gb_LinkTarget_set_include,$(1),\ ifeq ($(COM),MSC) $(call gb_LinkTarget_add_libs,$(1),\ - $(call gb_UnpackedTarball_get_dir,curl)/builds/libcurl-vc12-$(if $(filter X86_64,$(CPUNAME)),x64,x86)-$(if $(MSVC_USE_DEBUG_RUNTIME),debug,release)-dll-ipv6-sspi-winssl/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \ + $(call gb_UnpackedTarball_get_dir,curl)/builds/libcurl-vc12-$(if $(filter X86_64,$(CPUNAME)),x64,x86)-$(if $(MSVC_USE_DEBUG_RUNTIME),debug,release)-dll-ipv6-sspi-schannel/lib/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).lib \ ) else $(call gb_LinkTarget_add_libs,$(1),\ diff --git a/download.lst b/download.lst index c76f1a2deaba..32a244d3ffdc 100644 --- a/download.lst +++ b/download.lst @@ -29,8 +29,8 @@ export CPPUNIT_SHA256SUM := 3d569869d27b48860210c758c4f313082103a5e58219a7669b52 export CPPUNIT_TARBALL := cppunit-1.14.0.tar.gz export CT2N_SHA256SUM := 71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3 export CT2N_TARBALL := 1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt -export CURL_SHA256SUM := cdf18794393d8bead915312708a9e5d819c6e9919de14b20d5c8e7987abd9772 -export CURL_TARBALL := curl-7.71.0.tar.xz +export CURL_SHA256SUM := be42766d5664a739c3974ee3dfbbcbe978a4ccb1fe628bb1d9b59ac79e445fb5 +export CURL_TARBALL := curl-7.78.0.tar.xz export EBOOK_SHA256SUM := 7e8d8ff34f27831aca3bc6f9cc532c2f90d2057c778963b884ff3d1e34dfe1f9 export EBOOK_TARBALL := libe-book-0.1.3.tar.xz export EPOXY_SHA256SUM := 002958c5528321edd53440235d3c44e71b5b1e09b9177e8daf677450b6c4433d diff --git a/external/curl/ExternalPackage_curl.mk b/external/curl/ExternalPackage_curl.mk index 8da569e3e0cf..1fb360c85ca9 100644 --- a/external/curl/ExternalPackage_curl.mk +++ b/external/curl/ExternalPackage_curl.mk @@ -14,13 +14,13 @@ $(eval $(call gb_ExternalPackage_use_external_project,curl,curl)) ifneq ($(DISABLE_DYNLOADING),TRUE) ifeq ($(COM),MSC) -$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(if $(filter X86_64,$(CPUNAME)),x64,x86)-$(if $(MSVC_USE_DEBUG_RUNTIME),debug,release)-dll-ipv6-sspi-winssl/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll)) +$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll,builds/libcurl-vc12-$(if $(filter X86_64,$(CPUNAME)),x64,x86)-$(if $(MSVC_USE_DEBUG_RUNTIME),debug,release)-dll-ipv6-sspi-schannel/bin/libcurl$(if $(MSVC_USE_DEBUG_RUNTIME),_debug).dll)) else ifeq ($(OS),MACOSX) $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.4.dylib,lib/.libs/libcurl.4.dylib)) else ifeq ($(OS),AIX) $(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so,lib/.libs/libcurl.so.4)) else -$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so.4,lib/.libs/libcurl.so.4.6.0)) +$(eval $(call gb_ExternalPackage_add_file,curl,$(LIBO_LIB_FOLDER)/libcurl.so.4,lib/.libs/libcurl.so.4.7.0)) endif endif # $(DISABLE_DYNLOADING) diff --git a/external/curl/ExternalProject_curl.mk b/external/curl/ExternalProject_curl.mk index 5cbedac82d1a..06cc96c2e8de 100644 --- a/external/curl/ExternalProject_curl.mk +++ b/external/curl/ExternalProject_curl.mk @@ -35,13 +35,13 @@ ifeq ($(SYSTEM_NSS),) curl_CPPFLAGS += -I$(call gb_UnpackedTarball_get_dir,nss)/dist/public/nss endif -# use --with-darwinssl on macOS >10.5 and iOS to get a native UI for SSL certs for CMIS usage +# use --with-secure-transport on macOS >10.5 and iOS to get a native UI for SSL certs for CMIS usage # use --with-nss only on platforms other than macOS and iOS $(call gb_ExternalProject_get_state_target,curl,build): $(call gb_ExternalProject_run,build,\ ./configure \ $(if $(filter iOS MACOSX,$(OS)),\ - --with-darwinssl,\ + --with-secure-transport,\ $(if $(ENABLE_NSS),--with-nss$(if $(SYSTEM_NSS),,="$(call gb_UnpackedTarball_get_dir,nss)/dist/out"),--without-nss)) \ --without-ssl --without-gnutls --without-polarssl --without-cyassl --without-axtls --without-mbedtls \ --enable-ftp --enable-http --enable-ipv6 \ @@ -49,7 +49,8 @@ $(call gb_ExternalProject_get_state_target,curl,build): --without-libssh2 --without-metalink --without-nghttp2 \ --without-libssh --without-brotli \ --without-ngtcp2 --without-quiche \ - --disable-ares \ + --without-zstd --without-hyper --without-gsasl --without-gssapi \ + --disable-mqtt --disable-ares \ --disable-dict --disable-file --disable-gopher --disable-imap \ --disable-ldap --disable-ldaps --disable-manual --disable-pop3 \ --disable-rtsp --disable-smb --disable-smtp --disable-telnet \ diff --git a/external/curl/curl-7.26.0_win-proxy.patch b/external/curl/curl-7.26.0_win-proxy.patch index 852881570e36..46cdcc739d80 100644 --- a/external/curl/curl-7.26.0_win-proxy.patch +++ b/external/curl/curl-7.26.0_win-proxy.patch @@ -114,7 +114,7 @@ @@ -4663,6 +4739,7 @@ } if(proxy) - infof(conn->data, "Uses proxy env variable %s == '%s'\n", envp, proxy); + infof(data, "Uses proxy env variable %s == '%s'", envp, proxy); +#endif /* _WIN32 */ return proxy; diff --git a/external/curl/curl-msvc-disable-protocols.patch.1 b/external/curl/curl-msvc-disable-protocols.patch.1 index c8747a5fcc1d..a6d06c69b004 100644 --- a/external/curl/curl-msvc-disable-protocols.patch.1 +++ b/external/curl/curl-msvc-disable-protocols.patch.1 @@ -2,18 +2,19 @@ disable protocols nobody needs in MSVC build --- curl/lib/config-win32.h.orig 2017-08-09 16:43:29.464000000 +0200 +++ curl/lib/config-win32.h 2017-08-09 16:47:38.549200000 +0200 -@@ -733,4 +733,19 @@ +@@ -733,4 +733,20 @@ # define ENABLE_IPV6 1 #endif +#define CURL_DISABLE_DICT 1 +#define CURL_DISABLE_FILE 1 -+//#undef CURL_DISABLE_FTP ++#undef CURL_DISABLE_FTP +#define CURL_DISABLE_GOPHER 1 -+//#undef CURL_DISABLE_HTTP ++#undef CURL_DISABLE_HTTP +#define CURL_DISABLE_IMAP 1 +#define CURL_DISABLE_LDAP 1 +#define CURL_DISABLE_LDAPS 1 ++#define CURL_DISABLE_MQTT 1 +#define CURL_DISABLE_POP3 1 +#define CURL_DISABLE_RTSP 1 +#define CURL_DISABLE_SMB 1 diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0 index 189e820d1afa..f4a0ad4b152f 100644 --- a/external/curl/zlib.patch.0 +++ b/external/curl/zlib.patch.0 @@ -54,8 +54,8 @@ clean_LIBS=$LIBS -ZLIB_LIBS="" AC_ARG_WITH(zlib, - AC_HELP_STRING([--with-zlib=PATH],[search for zlib in PATH]) - AC_HELP_STRING([--without-zlib],[disable use of zlib]), + AS_HELP_STRING([--with-zlib=PATH],[search for zlib in PATH]) + AS_HELP_STRING([--without-zlib],[disable use of zlib]), [OPT_ZLIB="$withval"]) if test "$OPT_ZLIB" = "no" ; then -- cgit