Index: funcs/func_curl.c
===================================================================
--- funcs/func_curl.c	(revision 431298)
+++ funcs/func_curl.c	(revision 431299)
@@ -50,6 +50,7 @@
 #include "asterisk/app.h"
 #include "asterisk/utils.h"
 #include "asterisk/threadstorage.h"
+#include "asterisk/test.h"
 
 /*** DOCUMENTATION
 	<function name="CURL" language="en_US">
@@ -567,6 +568,31 @@
 AST_THREADSTORAGE_CUSTOM(curl_instance, curl_instance_init, curl_instance_cleanup);
 AST_THREADSTORAGE(thread_escapebuf);
 
+/*!
+ * \brief Check for potential HTTP injection risk.
+ *
+ * CVE-2014-8150 brought up the fact that HTTP proxies are subject to injection
+ * attacks. An HTTP URL sent to a proxy contains a carriage-return linefeed combination,
+ * followed by a complete HTTP request. Proxies will handle this as two separate HTTP
+ * requests rather than as a malformed URL.
+ *
+ * libcURL patched this vulnerability in version 7.40.0, but we have no guarantee that
+ * Asterisk systems will be using an up-to-date cURL library. Therefore, we implement
+ * the same fix as libcURL for determining if a URL is vulnerable to an injection attack.
+ *
+ * \param url The URL to check for vulnerability
+ * \retval 0 The URL is not vulnerable
+ * \retval 1 The URL is vulnerable.
+ */
+static int url_is_vulnerable(const char *url)
+{
+	if (strpbrk(url, "\r\n")) {
+		return 1;
+	}
+
+	return 0;
+}
+
 static int acf_curl_helper(struct ast_channel *chan, const char *cmd, char *info, char *buf, struct ast_str **input_str, ssize_t len)
 {
 	struct ast_str *escapebuf = ast_str_thread_get(&thread_escapebuf, 16);
@@ -604,6 +630,11 @@
 
 	AST_STANDARD_APP_ARGS(args, info);
 
+	if (url_is_vulnerable(args.url)) {
+		ast_log(LOG_ERROR, "URL '%s' is vulnerable to HTTP injection attacks. Aborting CURL() call.\n", args.url);
+		return -1;
+	}
+
 	if (chan) {
 		ast_autoservice_start(chan);
 	}
@@ -762,6 +793,54 @@
 	.write = acf_curlopt_write,
 };
 
+AST_TEST_DEFINE(vulnerable_url)
+{
+	const char *bad_urls [] = {
+		"http://example.com\r\nDELETE http://example.com/everything",
+		"http://example.com\rDELETE http://example.com/everything",
+		"http://example.com\nDELETE http://example.com/everything",
+		"\r\nhttp://example.com",
+		"\rhttp://example.com",
+		"\nhttp://example.com",
+		"http://example.com\r\n",
+		"http://example.com\r",
+		"http://example.com\n",
+	};
+	const char *good_urls [] = {
+		"http://example.com",
+		"http://example.com/%5Cr%5Cn",
+	};
+	int i;
+	enum ast_test_result_state res = AST_TEST_PASS;
+
+	switch (cmd) {
+	case TEST_INIT:
+		info->name = "vulnerable_url";
+		info->category = "/funcs/func_curl/";
+		info->summary = "cURL vulnerable URL test";
+		info->description =
+			"Ensure that any combination of '\\r' or '\\n' in a URL invalidates the URL";
+	case TEST_EXECUTE:
+		break;
+	}
+
+	for (i = 0; i < ARRAY_LEN(bad_urls); ++i) {
+		if (!url_is_vulnerable(bad_urls[i])) {
+			ast_test_status_update(test, "String '%s' detected as valid when it should be invalid\n", bad_urls[i]);
+			res = AST_TEST_FAIL;
+		}
+	}
+
+	for (i = 0; i < ARRAY_LEN(good_urls); ++i) {
+		if (url_is_vulnerable(good_urls[i])) {
+			ast_test_status_update(test, "String '%s' detected as invalid when it should be valid\n", good_urls[i]);
+			res = AST_TEST_FAIL;
+		}
+	}
+
+	return res;
+}
+
 static int unload_module(void)
 {
 	int res;
@@ -769,6 +848,8 @@
 	res = ast_custom_function_unregister(&acf_curl);
 	res |= ast_custom_function_unregister(&acf_curlopt);
 
+	AST_TEST_UNREGISTER(vulnerable_url);
+
 	return res;
 }
 
@@ -786,6 +867,8 @@
 	res = ast_custom_function_register(&acf_curl);
 	res |= ast_custom_function_register(&acf_curlopt);
 
+	AST_TEST_REGISTER(vulnerable_url);
+
 	return res;
 }
 
Index: .
===================================================================
--- .	(revision 431298)
+++ .	(revision 431299)

Property changes on: .
___________________________________________________________________
Modified: branch-11-merged
## -1 +1 ##
-/branches/11:1-371121,371143,371146,371200,371227,371258,371272,371295,371324,371355,371382,371395,371399,371425-371426,371438,371482,371492,371507,371516,371518,371520,371546,371571,371592,371619,371664,371692,371720,371750,371753,371784,371790,371845,371862,371891,371893,371921,371950,371963,372000,372028,372050,372091,372118,372135,372137,372175,372199,372214,372241,372266,372289,372311,372327-372328,372340,372342,372365,372373,372392,372419,372446,372473,372519,372523,372531,372556,372583,372609,372611,372622,372626,372630,372657,372696,372711,372754,372768,372777,372795,372806,372864,372886,372888,372917,372930,372937,372984,372995,373029,373047,373079,373107,373119,373133,373211,373220,373229,373235,373246,373318,373368,373403,373413,373454,373469-373470,373502,373552,373580,373582,373632,373635,373650,373688,373690,373707,373738,373770,373775,373804,373818,373850,373880,373911,373914,373954,373991,374019,374059,374085,374106,374133,374150,374196,374211,374248,374301,374337,374386,374428,374477,374485,374538,374587,374611,374622,374632,374642,374657,374676,374708,374729,374756,374771,374792,374804,374833,374842,374850,374877,374914,374932,374995,375016,375027,375051,375079,375113,375148,375191,375219,375288,375301,375327,375363,375390,375437,375471,375486,375506,375532,375559,375575,375660,375729,375756,375763,375795,375798,375802,375847,375864,375895,375925,375966,376014,376048,376060,376089,376130,376144,376168,376217,376234,376264,376310,376339,376343,376415,376441,376471,376540,376550,376561,376588,376629,376659,376690,376727,376760,376790,376836,376866,376870,376917,376921,376952,376983,377021,377039,377071,377075,377106,377137,377167,377195,377213,377228,377244,377259,377262,377319,377340,377355,377401,377433,377462,377505,377511,377577,377593,377625,377657,377706,377710,377742,377773,377808,377849,377883,377910,377924,377948,377985,377991,377993,378010,378038,378073,378090,378094,378121,378165,378219,378287,378321,378376,378409,378411,378428,378457,378459,378487,378515,378555,378559,378582,378592,378622,378687,378690,378734,378747,378780,378917,378934,378984,379020,379146,379179,379209-379210,379228,379230,379232,379277,379311,379343,379393,379460,379475,379478,379513,379548,379609,379643,379677,379719,379790,379808,379826,379892,379949,379964,380028,380043,380193,380211,380255,380298,380331,380348,380350,380384,380452,380465,380480,380521,380575,380612,380671-380673,380698,380735-380736,380816,380854,380856,380869,380892,380894,380942,380974,381067,381159,381217,381282,381306,381365,381467,381553,381566,381594,381613,381655,381669,381702,381848,381880,381893,381917,381943,381976,382022,382066,382068,382096,382108,382111,382174,382230,382234,382296,382298,382322,382385,382390,382410,382573-382574,382617,382739,382827,389661,389677,389896,390047,390228-390229,391063,391084,391111,391148,391241,391334,391379,391507,391560,391700,391794,392810,393395,393628,393929,394173,394303,394345,394641,394890,394897,394900,394941,394981,395033,396197,396199,396248,396287,396310,396377,396580,396583,396620,396657,396746,396944,396948,396995,397067,397107,397133,397157,397205,397254,397257,397309,397365,397378,397528,397712,397744,397758,397948,398000,398011,398019,398061,398103,398168,398214,398236,398281,398285,398302,398380,398417,398457,398510,398558,398577,398618,398649,398721,398749,398753,398758,398820,398836,398881,398885,398986,399034,399099,399159,399222,399267,399353,399373,399403,399457,399513,399564,399708,399795,399834,399962,400014,400075,400093,400140,400279,400315,400394,400421,400470,400623,400681,400697,400723,400741,400768,400908-400909,400971,401016,401076,401120,401167,401179,401182,401326,401433,401446,401498,401538,401579,401620,401661,401705,401744,401783,401787,401791,401830,401833,401884,401896,401935,401960,402042,402111,402151,402225,402288,402345,402407,402425,402450,402605,402646,402686,402709,403015,403288,403450,403635,403863,403917,404087,404136,404219,404275,404318,404344,404351,404457,404579,404604,404675,404773,404785,404858,404888,405081,405091,405161,405215,405234,405281,405431,405434,405582,405693,405745,405792,405927,406038,406080,406171,406217,406245,406341,406361,406400,406418,406515,406567,406644,406722,406802,406861,406918,406934,407074,407103,407210,407273,407338,407456,407512,407623,407727,407765,407857,407874,408084,408137,408193,408201,408312,408330,408388,408448,408537,408590,408643,408647,408729,408786,408838,408877,409745,409761,409778,409834,409886,409917,409990,410044,410106,410225,410311,410381,410490,410556,410606,410609,410717,410749,410829,410965,411022,411089,411190,411244,411310,411314,411373,411408,411458,411463,411531,411585,411716,411808,411944,411961,411974,412115,412226,412305,412329,412348,412468,412586,412656,412712,412746,412748,412822,412923,413008,413123,413139,413225,413251,413305,413397,413451,413486,413551,413587,413595,413710,413765,413788,413791,413876,413895,413992,414050,414068,414153,414215,414270,414346,414402,414565,414628,414677,414694,414859,414881,414998,415066,415171,415206,415229,415390,415464,415522,415599,415728,415825,415835,415837,415854,415999,416067,416151,416252,416337,416440,416501,416581,416668,416733,416870,416930,417141,417249,417310,417320,417419,417481,417505,417588,417798,417957,418262,418323,418366,418465,418505,418649,418713,419162,419284,419375,419441,419685,419943,420054,420147,420435,420655,420715,420897,421060,421164,421228,421233,421328,421443,421602,421718,421777,421800,421909,421977,422113,422274,422294,422372,422377,422440,422625,422790,422903,423067,423150,423207,423210,423253,423277,423360,423400,423658,423721,423801,423916,423983,424117,424151,424177,424182,424550,424569,424578,424690,424852,424878,425029,425069,425153,425287,425292,425297,425360,425407,425457,425548,425644,425667,425819,426141,426209,426255,426327,426366,426527,426595,426600,426666,426692,426805,426831,426860,426931,427019,427024,427087,427328,427354,427381,427464,427554,427607,427613,427641,427682,427709,427844,427874,427952,428077,428113,428117,428244,428332,428363,428417,428570,428653,428787,428863,429027,429031,429270,429673
\ No newline at end of property
+/branches/11:1-371121,371143,371146,371200,371227,371258,371272,371295,371324,371355,371382,371395,371399,371425-371426,371438,371482,371492,371507,371516,371518,371520,371546,371571,371592,371619,371664,371692,371720,371750,371753,371784,371790,371845,371862,371891,371893,371921,371950,371963,372000,372028,372050,372091,372118,372135,372137,372175,372199,372214,372241,372266,372289,372311,372327-372328,372340,372342,372365,372373,372392,372419,372446,372473,372519,372523,372531,372556,372583,372609,372611,372622,372626,372630,372657,372696,372711,372754,372768,372777,372795,372806,372864,372886,372888,372917,372930,372937,372984,372995,373029,373047,373079,373107,373119,373133,373211,373220,373229,373235,373246,373318,373368,373403,373413,373454,373469-373470,373502,373552,373580,373582,373632,373635,373650,373688,373690,373707,373738,373770,373775,373804,373818,373850,373880,373911,373914,373954,373991,374019,374059,374085,374106,374133,374150,374196,374211,374248,374301,374337,374386,374428,374477,374485,374538,374587,374611,374622,374632,374642,374657,374676,374708,374729,374756,374771,374792,374804,374833,374842,374850,374877,374914,374932,374995,375016,375027,375051,375079,375113,375148,375191,375219,375288,375301,375327,375363,375390,375437,375471,375486,375506,375532,375559,375575,375660,375729,375756,375763,375795,375798,375802,375847,375864,375895,375925,375966,376014,376048,376060,376089,376130,376144,376168,376217,376234,376264,376310,376339,376343,376415,376441,376471,376540,376550,376561,376588,376629,376659,376690,376727,376760,376790,376836,376866,376870,376917,376921,376952,376983,377021,377039,377071,377075,377106,377137,377167,377195,377213,377228,377244,377259,377262,377319,377340,377355,377401,377433,377462,377505,377511,377577,377593,377625,377657,377706,377710,377742,377773,377808,377849,377883,377910,377924,377948,377985,377991,377993,378010,378038,378073,378090,378094,378121,378165,378219,378287,378321,378376,378409,378411,378428,378457,378459,378487,378515,378555,378559,378582,378592,378622,378687,378690,378734,378747,378780,378917,378934,378984,379020,379146,379179,379209-379210,379228,379230,379232,379277,379311,379343,379393,379460,379475,379478,379513,379548,379609,379643,379677,379719,379790,379808,379826,379892,379949,379964,380028,380043,380193,380211,380255,380298,380331,380348,380350,380384,380452,380465,380480,380521,380575,380612,380671-380673,380698,380735-380736,380816,380854,380856,380869,380892,380894,380942,380974,381067,381159,381217,381282,381306,381365,381467,381553,381566,381594,381613,381655,381669,381702,381848,381880,381893,381917,381943,381976,382022,382066,382068,382096,382108,382111,382174,382230,382234,382296,382298,382322,382385,382390,382410,382573-382574,382617,382739,382827,389661,389677,389896,390047,390228-390229,391063,391084,391111,391148,391241,391334,391379,391507,391560,391700,391794,392810,393395,393628,393929,394173,394303,394345,394641,394890,394897,394900,394941,394981,395033,396197,396199,396248,396287,396310,396377,396580,396583,396620,396657,396746,396944,396948,396995,397067,397107,397133,397157,397205,397254,397257,397309,397365,397378,397528,397712,397744,397758,397948,398000,398011,398019,398061,398103,398168,398214,398236,398281,398285,398302,398380,398417,398457,398510,398558,398577,398618,398649,398721,398749,398753,398758,398820,398836,398881,398885,398986,399034,399099,399159,399222,399267,399353,399373,399403,399457,399513,399564,399708,399795,399834,399962,400014,400075,400093,400140,400279,400315,400394,400421,400470,400623,400681,400697,400723,400741,400768,400908-400909,400971,401016,401076,401120,401167,401179,401182,401326,401433,401446,401498,401538,401579,401620,401661,401705,401744,401783,401787,401791,401830,401833,401884,401896,401935,401960,402042,402111,402151,402225,402288,402345,402407,402425,402450,402605,402646,402686,402709,403015,403288,403450,403635,403863,403917,404087,404136,404219,404275,404318,404344,404351,404457,404579,404604,404675,404773,404785,404858,404888,405081,405091,405161,405215,405234,405281,405431,405434,405582,405693,405745,405792,405927,406038,406080,406171,406217,406245,406341,406361,406400,406418,406515,406567,406644,406722,406802,406861,406918,406934,407074,407103,407210,407273,407338,407456,407512,407623,407727,407765,407857,407874,408084,408137,408193,408201,408312,408330,408388,408448,408537,408590,408643,408647,408729,408786,408838,408877,409745,409761,409778,409834,409886,409917,409990,410044,410106,410225,410311,410381,410490,410556,410606,410609,410717,410749,410829,410965,411022,411089,411190,411244,411310,411314,411373,411408,411458,411463,411531,411585,411716,411808,411944,411961,411974,412115,412226,412305,412329,412348,412468,412586,412656,412712,412746,412748,412822,412923,413008,413123,413139,413225,413251,413305,413397,413451,413486,413551,413587,413595,413710,413765,413788,413791,413876,413895,413992,414050,414068,414153,414215,414270,414346,414402,414565,414628,414677,414694,414859,414881,414998,415066,415171,415206,415229,415390,415464,415522,415599,415728,415825,415835,415837,415854,415999,416067,416151,416252,416337,416440,416501,416581,416668,416733,416870,416930,417141,417249,417310,417320,417419,417481,417505,417588,417798,417957,418262,418323,418366,418465,418505,418649,418713,419162,419284,419375,419441,419685,419943,420054,420147,420435,420655,420715,420897,421060,421164,421228,421233,421328,421443,421602,421718,421777,421800,421909,421977,422113,422274,422294,422372,422377,422440,422625,422790,422903,423067,423150,423207,423210,423253,423277,423360,423400,423658,423721,423801,423916,423983,424117,424151,424177,424182,424550,424569,424578,424690,424852,424878,425029,425069,425153,425287,425292,425297,425360,425407,425457,425548,425644,425667,425819,426141,426209,426255,426327,426366,426527,426595,426600,426666,426692,426805,426831,426860,426931,427019,427024,427087,427328,427354,427381,427464,427554,427607,427613,427641,427682,427709,427844,427874,427952,428077,428113,428117,428244,428332,428363,428417,428570,428653,428787,428863,429027,429031,429270,429673,431297-431298
\ No newline at end of property
