| Patrick Williams | ac13d5f | 2023-11-24 18:59:46 -0600 | [diff] [blame] | 1 | From 8cf606779dc356768afc6b70e53f2808a9655143 Mon Sep 17 00:00:00 2001 |
| 2 | From: Michal Sekletar <msekleta@redhat.com> |
| 3 | Date: Thu, 19 Oct 2023 17:36:44 +0200 |
| 4 | Subject: [PATCH] avahi: core: make sure there is rdata to process before |
| 5 | parsing it |
| 6 | |
| 7 | Fixes #452 |
| 8 | |
| 9 | Upstream-Status: Backport [https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40] |
| 10 | CVE: CVE-2023-38472 |
| 11 | |
| 12 | Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> |
| 13 | --- |
| 14 | avahi-client/client-test.c | 3 +++ |
| 15 | avahi-daemon/dbus-entry-group.c | 2 +- |
| 16 | 2 files changed, 4 insertions(+), 1 deletion(-) |
| 17 | |
| 18 | diff --git a/avahi-client/client-test.c b/avahi-client/client-test.c |
| 19 | index 7d04a6a..57750a4 100644 |
| 20 | --- a/avahi-client/client-test.c |
| 21 | +++ b/avahi-client/client-test.c |
| 22 | @@ -258,6 +258,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) { |
| 23 | printf("%s\n", avahi_strerror(avahi_entry_group_add_service (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "Lathiat's Site", "_http._tcp", NULL, NULL, 80, "foo=bar", NULL))); |
| 24 | printf("add_record: %d\n", avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "\5booya", 6)); |
| 25 | |
| 26 | + error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0); |
| 27 | + assert(error != AVAHI_OK); |
| 28 | + |
| 29 | avahi_entry_group_commit (group); |
| 30 | |
| 31 | domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u"); |
| 32 | diff --git a/avahi-daemon/dbus-entry-group.c b/avahi-daemon/dbus-entry-group.c |
| 33 | index 4e879a5..aa23d4b 100644 |
| 34 | --- a/avahi-daemon/dbus-entry-group.c |
| 35 | +++ b/avahi-daemon/dbus-entry-group.c |
| 36 | @@ -340,7 +340,7 @@ DBusHandlerResult avahi_dbus_msg_entry_group_impl(DBusConnection *c, DBusMessage |
| 37 | if (!(r = avahi_record_new_full (name, clazz, type, ttl))) |
| 38 | return avahi_dbus_respond_error(c, m, AVAHI_ERR_NO_MEMORY, NULL); |
| 39 | |
| 40 | - if (avahi_rdata_parse (r, rdata, size) < 0) { |
| 41 | + if (!rdata || avahi_rdata_parse (r, rdata, size) < 0) { |
| 42 | avahi_record_unref (r); |
| 43 | return avahi_dbus_respond_error(c, m, AVAHI_ERR_INVALID_RDATA, NULL); |
| 44 | } |
| 45 | -- |
| 46 | 2.40.0 |