90181701d3
Resolves: CVE-2023-34241
65 lines
2.0 KiB
Diff
65 lines
2.0 KiB
Diff
From ffd290b4ab247f82722927ba9b21358daa16dbf1 Mon Sep 17 00:00:00 2001
|
|
From: Rose <83477269+AtariDreams@users.noreply.github.com>
|
|
Date: Thu, 1 Jun 2023 11:33:39 -0400
|
|
Subject: [PATCH] Log result of httpGetHostname BEFORE closing the connection
|
|
|
|
httpClose frees the memory of con->http. This is problematic because httpGetHostname then tries to access the memory it points to.
|
|
|
|
We have to log the hostname first.
|
|
---
|
|
scheduler/client.c | 16 +++++++---------
|
|
1 file changed, 7 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/scheduler/client.c b/scheduler/client.c
|
|
index 91e441188..327473a4d 100644
|
|
--- a/scheduler/client.c
|
|
+++ b/scheduler/client.c
|
|
@@ -193,13 +193,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */
|
|
/*
|
|
* Can't have an unresolved IP address with double-lookups enabled...
|
|
*/
|
|
-
|
|
- httpClose(con->http);
|
|
-
|
|
cupsdLogClient(con, CUPSD_LOG_WARN,
|
|
- "Name lookup failed - connection from %s closed!",
|
|
+ "Name lookup failed - closing connection from %s!",
|
|
httpGetHostname(con->http, NULL, 0));
|
|
|
|
+ httpClose(con->http);
|
|
free(con);
|
|
return;
|
|
}
|
|
@@ -235,11 +233,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */
|
|
* with double-lookups enabled...
|
|
*/
|
|
|
|
- httpClose(con->http);
|
|
-
|
|
cupsdLogClient(con, CUPSD_LOG_WARN,
|
|
- "IP lookup failed - connection from %s closed!",
|
|
+ "IP lookup failed - closing connection from %s!",
|
|
httpGetHostname(con->http, NULL, 0));
|
|
+
|
|
+ httpClose(con->http);
|
|
free(con);
|
|
return;
|
|
}
|
|
@@ -256,11 +254,11 @@ cupsdAcceptClient(cupsd_listener_t *lis)/* I - Listener socket */
|
|
|
|
if (!hosts_access(&wrap_req))
|
|
{
|
|
- httpClose(con->http);
|
|
-
|
|
cupsdLogClient(con, CUPSD_LOG_WARN,
|
|
"Connection from %s refused by /etc/hosts.allow and "
|
|
"/etc/hosts.deny rules.", httpGetHostname(con->http, NULL, 0));
|
|
+
|
|
+ httpClose(con->http);
|
|
free(con);
|
|
return;
|
|
}
|
|
--
|
|
2.41.0
|
|
|