From: Kamil Dudka <kdudka@redhat.com>
Date: Thu, 28 May 2015 18:04:35 +0000 (+0200)
Subject: http: do not leak basic auth credentials on re-used connections
X-Git-Tag: curl-7_43_0~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=24a8359b256f8a3d7892f21f156a4bf0a42710d5;p=thirdparty%2Fcurl.git

http: do not leak basic auth credentials on re-used connections

CVE-2015-3236

This partially reverts commit curl-7_39_0-237-g87c4abb

Reported-by: Tomas Tomecek, Kamil Dudka
Bug: http://curl.haxx.se/docs/adv_20150617A.html
---

diff --git a/lib/http.c b/lib/http.c
index 7a5137e86c..e06c798e9b 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -2312,20 +2312,12 @@ CURLcode Curl_http(struct connectdata *conn, bool *done)
                      te
       );
 
-  /*
-   * Free userpwd for Negotiate/NTLM. Cannot reuse as it is associated with
-   * the connection and shouldn't be repeated over it either.
-   */
-  switch (data->state.authhost.picked) {
-  case CURLAUTH_NEGOTIATE:
-  case CURLAUTH_NTLM:
-  case CURLAUTH_NTLM_WB:
-    Curl_safefree(conn->allocptr.userpwd);
-    break;
-  }
+  /* clear userpwd to avoid re-using credentials from re-used connections */
+  Curl_safefree(conn->allocptr.userpwd);
 
   /*
-   * Same for proxyuserpwd
+   * Free proxyuserpwd for Negotiate/NTLM. Cannot reuse as it is associated
+   * with the connection and shouldn't be repeated over it either.
    */
   switch (data->state.authproxy.picked) {
   case CURLAUTH_NEGOTIATE: