rpms/avahi
5
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2021-3502

Browse Source 
Resolves: #1949949
This commit is contained in:
Michal Sekletar 2023-08-23 18:15:04 +02:00
parent 486b4f7426
commit bb92ca0435
2 changed files with 156 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

151
0001-Fix-NULL-pointer-crashes-from-175.patch Normal file
View File

@ -0,0 +1,151 @@
From 9d31939e55280a733d930b15ac9e4dda4497680c Mon Sep 17 00:00:00 2001
From: Tommi Rantala <tommi.t.rantala@nokia.com>
Date: Mon, 8 Feb 2021 11:04:43 +0200
Subject: [PATCH] Fix NULL pointer crashes from #175
avahi-daemon is crashing when running "ping .local".
The crash is due to failing assertion from NULL pointer.
Add missing NULL pointer checks to fix it.
Introduced in #175 - merge commit 8f75a045709a780c8cf92a6a21e9d35b593bdecd
---
avahi-core/browse-dns-server.c | 5 ++++-
avahi-core/browse-domain.c | 5 ++++-
avahi-core/browse-service-type.c | 3 +++
avahi-core/browse-service.c | 3 +++
avahi-core/browse.c | 3 +++
avahi-core/resolve-address.c | 5 ++++-
avahi-core/resolve-host-name.c | 5 ++++-
avahi-core/resolve-service.c | 5 ++++-
8 files changed, 29 insertions(+), 5 deletions(-)
diff --git a/avahi-core/browse-dns-server.c b/avahi-core/browse-dns-server.c
index 049752e..c2d914f 100644
--- a/avahi-core/browse-dns-server.c
+++ b/avahi-core/browse-dns-server.c
@@ -343,7 +343,10 @@ AvahiSDNSServerBrowser *avahi_s_dns_server_browser_new(
AvahiSDNSServerBrowser* b;
b = avahi_s_dns_server_browser_prepare(server, interface, protocol, domain, type, aprotocol, flags, callback, userdata);
+ if (!b)
+ return NULL;
+
avahi_s_dns_server_browser_start(b);
return b;
-}
\ No newline at end of file
+}
diff --git a/avahi-core/browse-domain.c b/avahi-core/browse-domain.c
index f145d56..06fa70c 100644
--- a/avahi-core/browse-domain.c
+++ b/avahi-core/browse-domain.c
@@ -253,7 +253,10 @@ AvahiSDomainBrowser *avahi_s_domain_browser_new(
AvahiSDomainBrowser *b;
b = avahi_s_domain_browser_prepare(server, interface, protocol, domain, type, flags, callback, userdata);
+ if (!b)
+ return NULL;
+
avahi_s_domain_browser_start(b);
return b;
-}
\ No newline at end of file
+}
diff --git a/avahi-core/browse-service-type.c b/avahi-core/browse-service-type.c
index fdd22dc..b1fc7af 100644
--- a/avahi-core/browse-service-type.c
+++ b/avahi-core/browse-service-type.c
@@ -171,6 +171,9 @@ AvahiSServiceTypeBrowser *avahi_s_service_type_browser_new(
AvahiSServiceTypeBrowser *b;
b = avahi_s_service_type_browser_prepare(server, interface, protocol, domain, flags, callback, userdata);
+ if (!b)
+ return NULL;
+
avahi_s_service_type_browser_start(b);
return b;
diff --git a/avahi-core/browse-service.c b/avahi-core/browse-service.c
index 5531360..63e0275 100644
--- a/avahi-core/browse-service.c
+++ b/avahi-core/browse-service.c
@@ -184,6 +184,9 @@ AvahiSServiceBrowser *avahi_s_service_browser_new(
AvahiSServiceBrowser *b;
b = avahi_s_service_browser_prepare(server, interface, protocol, service_type, domain, flags, callback, userdata);
+ if (!b)
+ return NULL;
+
avahi_s_service_browser_start(b);
return b;
diff --git a/avahi-core/browse.c b/avahi-core/browse.c
index 2941e57..e8a915e 100644
--- a/avahi-core/browse.c
+++ b/avahi-core/browse.c
@@ -634,6 +634,9 @@ AvahiSRecordBrowser *avahi_s_record_browser_new(
AvahiSRecordBrowser *b;
b = avahi_s_record_browser_prepare(server, interface, protocol, key, flags, callback, userdata);
+ if (!b)
+ return NULL;
+
avahi_s_record_browser_start_query(b);
return b;
diff --git a/avahi-core/resolve-address.c b/avahi-core/resolve-address.c
index ac0b29b..e61dd24 100644
--- a/avahi-core/resolve-address.c
+++ b/avahi-core/resolve-address.c
@@ -286,7 +286,10 @@ AvahiSAddressResolver *avahi_s_address_resolver_new(
AvahiSAddressResolver *b;
b = avahi_s_address_resolver_prepare(server, interface, protocol, address, flags, callback, userdata);
+ if (!b)
+ return NULL;
+
avahi_s_address_resolver_start(b);
return b;
-}
\ No newline at end of file
+}
diff --git a/avahi-core/resolve-host-name.c b/avahi-core/resolve-host-name.c
index 808b0e7..4e8e597 100644
--- a/avahi-core/resolve-host-name.c
+++ b/avahi-core/resolve-host-name.c
@@ -318,7 +318,10 @@ AvahiSHostNameResolver *avahi_s_host_name_resolver_new(
AvahiSHostNameResolver *b;
b = avahi_s_host_name_resolver_prepare(server, interface, protocol, host_name, aprotocol, flags, callback, userdata);
+ if (!b)
+ return NULL;
+
avahi_s_host_name_resolver_start(b);
return b;
-}
\ No newline at end of file
+}
diff --git a/avahi-core/resolve-service.c b/avahi-core/resolve-service.c
index 66bf3ca..4377176 100644
--- a/avahi-core/resolve-service.c
+++ b/avahi-core/resolve-service.c
@@ -519,7 +519,10 @@ AvahiSServiceResolver *avahi_s_service_resolver_new(
AvahiSServiceResolver *b;
b = avahi_s_service_resolver_prepare(server, interface, protocol, name, type, domain, aprotocol, flags, callback, userdata);
+ if (!b)
+ return NULL;
+
avahi_s_service_resolver_start(b);
return b;
-}
\ No newline at end of file
+}
--
2.41.0

6
avahi.spec
View File

@ -48,7 +48,7 @@
Name: avahi
Version: 0.8
Release: 13%{?dist}
Release: 14%{?dist}
Summary: Local network service discovery
License: LGPLv2+
URL: http://avahi.org
@ -133,6 +133,7 @@ Patch9: 0009-fix-requires-in-pc-file.patch
Patch10: 0010-fix-bytestring-decoding-for-proper-display.patch
Patch11: 0011-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch
Patch12: 0001-Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-.patch
Patch13: 0001-Fix-NULL-pointer-crashes-from-175.patch
## downstream patches
Patch100: avahi-0.6.30-mono-libdir.patch
@ -828,6 +829,9 @@ exit 0
%changelog
* Wed Aug 23 2023 Michal Sekletar <msekleta@redhat.com> - 0.8-14
- Fix CVE-2021-3502 (#1949949)
* Thu Aug 17 2023 Michal Sekletar <msekleta@redhat.com> - 0.8-13
- Fix CVE-2021-3468 (#1944092)