[PATCH] socks: return error if hostname too long for remote resolve
authorJay Satiro <raysatiro@yahoo.com>
Sat, 30 Sep 2023 07:40:02 +0000 (03:40 -0400)
committerSamuel Henrique <samueloph@debian.org>
Thu, 5 Oct 2023 21:26:40 +0000 (22:26 +0100)
commit9489b6ceac6e714f8e885fdd733fb8cdedaf2ca7
treebd0939ba06dbf599e06d394ee6ae6a5c4bd94061
parent2bf4b83ef25748096c92728696d13a5486d68db0
[PATCH] socks: return error if hostname too long for remote resolve

Prior to this change the state machine attempted to change the remote
resolve to a local resolve if the hostname was too long. Unfortunately
that did not always work as intended, leading to a security issue. And
when it did it's a privacy violation for users of socks5h that may
expect their DNS requests will not leak.

Bug: https://curl.se/docs/CVE-2023-38545.html

Backported by: Samuel Henrique <samueloph@debian.org>

Gbp-Pq: Name CVE-2023-38545.patch
lib/socks.c
tests/data/Makefile.inc
tests/data/test728 [new file with mode: 0644]