Bbuterfix CVEs
8fb94206创建于 2022年7月18日历史提交
commit ed67eec0397706accd9ea6b1994531ae9b7ff8fe
Author: Daniel Stenberg <daniel@haxx.se>
Date:   Mon Apr 25 11:48:00 2022 +0200

    [Backport] conncache: include the zone id in the "bundle" hashkey
    
    Offering: RTOS
    CVE: CVE-2022-27775
    Reference: upstream_commit_id=058f98dc3fe595f21dc26a5b9b1699e519ba5705
    
    DTS/AR: DTS2022042805098
    type: LTS
    reason: fix CVE-2022-27775 for curl.
    weblink:https://github.com/curl/curl/commit/058f98dc3fe595f21dc26a5b9b1699e519ba5705
    
    Make connections to two separate IPv6 zone ids create separate
    connections.
    
    Reported-by: Harry Sintonen
    Bug: https://curl.se/docs/CVE-2022-27775.html
    Closes #8747
    
    Signed-off-by: lvshengyuan <lvshengyuan1@h-partners.com>

diff --git a/lib/conncache.c b/lib/conncache.c
index f5ba8ff70..67d3943b8 100644
--- a/lib/conncache.c
+++ b/lib/conncache.c
@@ -160,8 +160,12 @@ static void hashkey(struct connectdata *conn, char *buf,
     /* report back which name we used */
     *hostp = hostname;
 
-  /* put the number first so that the hostname gets cut off if too long */
-  msnprintf(buf, len, "%ld%s", port, hostname);
+  /* put the numbers first so that the hostname gets cut off if too long */
+#ifdef ENABLE_IPV6
+  msnprintf(buf, len, "%u/%ld/%s", conn->scope_id, port, hostname);
+#else
+  msnprintf(buf, len, "%ld/%s", port, hostname);
+#endif
   Curl_strntolower(buf, buf, len);
 }