From 8a8f5840082eb65d140ccfe7b128c92390cce1c3 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Wed, 13 Feb 2013 09:25:34 +0100 Subject: block/curl: only restrict protocols with libcurl>=7.19.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, ...) interface was introduced in libcurl 7.19.4. Therefore we cannot protect against CVE-2013-0249 when linking against an older libcurl. This fixes the build failure introduced by fb6d1bbd246c7a57ef53d3847ef225cd1349d602. Reported-by: Andreas Färber Signed-off-by: Stefan Hajnoczi Tested-by: Andreas Färber Message-id: 1360743934-8337-1-git-send-email-stefanha@redhat.com Signed-off-by: Anthony Liguori --- block/curl.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'block/curl.c') diff --git a/block/curl.c b/block/curl.c index f6226b3..98947da 100644 --- a/block/curl.c +++ b/block/curl.c @@ -309,9 +309,13 @@ static CURLState *curl_init_state(BDRVCURLState *s) /* Restrict supported protocols to avoid security issues in the more * obscure protocols. For example, do not allow POP3/SMTP/IMAP see * CVE-2013-0249. + * + * Restricting protocols is only supported from 7.19.4 upwards. */ +#if LIBCURL_VERSION_NUM >= 0x071304 curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS); curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS); +#endif #ifdef DEBUG_VERBOSE curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1); -- cgit v1.1