[OE-core] [PATCH] wget: fix CVE-2018-0494

[Jibin Xu]

Reference:https://nvd.nist.gov/vuln/detail/CVE-2018-0494
patch from https://github.com/mirror/wget.git
commit 8d793bf2ecca84a5ece167c750a83d6eadb4a16a

Signed-off-by: Jibin Xu <jibin.xu at windriver.com>
---
 .../wget/wget/wget-CVE-2018-0494.patch             | 68 ++++++++++++++++++++++
 meta/recipes-extended/wget/wget_1.19.4.bb          |  1 +
 2 files changed, 69 insertions(+)
 create mode 100644 meta/recipes-extended/wget/wget/wget-CVE-2018-0494.patch

diff --git a/meta/recipes-extended/wget/wget/wget-CVE-2018-0494.patch b/meta/recipes-extended/wget/wget/wget-CVE-2018-0494.patch
new file mode 100644
index 0000000000..5eda9636e3
--- /dev/null
+++ b/meta/recipes-extended/wget/wget/wget-CVE-2018-0494.patch
@@ -0,0 +1,68 @@
+From 1fc9c95ec144499e69dc8ec76dbe07799d7d82cd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen at gmx.de>
+Date: Fri, 27 Apr 2018 10:41:56 +0200
+Subject: [PATCH] Fix cookie injection (CVE-2018-0494)
+
+* src/http.c (resp_new): Replace \r\n by space in continuation lines
+
+Fixes #53763
+ "Malicious website can write arbitrary cookie entries to cookie jar"
+
+HTTP header parsing left the \r\n from continuation line intact.
+The Set-Cookie code didn't check and could be tricked to write
+\r\n into the cookie jar, allowing a server to generate cookies at will.
+
+Upstream-Status: Backport
+CVE: CVE-2018-0494
+
+Signed-off-by: Jibin Xu <jibin.xu at windriver.com>
+---
+ src/http.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/src/http.c b/src/http.c
+index c8960f1..77bdbbe 100644
+--- a/src/http.c
++++ b/src/http.c
+@@ -613,9 +613,9 @@ struct response {
+    resp_header_*.  */
+ 
+ static struct response *
+-resp_new (const char *head)
++resp_new (char *head)
+ {
+-  const char *hdr;
++  char *hdr;
+   int count, size;
+ 
+   struct response *resp = xnew0 (struct response);
+@@ -644,15 +644,23 @@ resp_new (const char *head)
+         break;
+ 
+       /* Find the end of HDR, including continuations. */
+-      do
++      for (;;)
+         {
+-          const char *end = strchr (hdr, '\n');
++          char *end = strchr (hdr, '\n');
++
+           if (end)
+             hdr = end + 1;
+           else
+             hdr += strlen (hdr);
++
++          if (*hdr != ' ' && *hdr != '\t')
++            break;
++
++          // continuation, transform \r and \n into spaces
++          *end = ' ';
++          if (end > head && end[-1] == '\r')
++            end[-1] = ' ';
+         }
+-      while (*hdr == ' ' || *hdr == '\t');
+     }
+   DO_REALLOC (resp->headers, size, count + 1, const char *);
+   resp->headers[count] = NULL;
+-- 
+2.7.4
+
diff --git a/meta/recipes-extended/wget/wget_1.19.4.bb b/meta/recipes-extended/wget/wget_1.19.4.bb
index fb7cce5a20..6ffcf8aa3b 100644
--- a/meta/recipes-extended/wget/wget_1.19.4.bb
+++ b/meta/recipes-extended/wget/wget_1.19.4.bb
@@ -1,6 +1,7 @@
 SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
            file://0001-Unset-need_charset_alias-when-building-for-musl.patch \
            file://0002-improve-reproducibility.patch \
+           file://wget-CVE-2018-0494.patch \
           "
 
 SRC_URI[md5sum] = "a2a2c1dc4ac5003fc25a8e60b4a9464e"
-- 
2.13.0