From 0dca25c6fab7d3c55b0a2728cb48eafef6e31aee Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Sun, 4 Feb 2018 15:10:09 +0100 Subject: [PATCH] fix double-free handling VPN data in nm-applet (rh #1541565) Also: fix certificate chooser for no available modules (bgo #785674) --- 0002-fix-vpn-get-data-crash-rh1541565.patch | 137 ++++++++++++++++++ ...ert-chooser-for-no-modules-bgo785674.patch | 38 +++++ network-manager-applet.spec | 12 +- 3 files changed, 185 insertions(+), 2 deletions(-) create mode 100644 0002-fix-vpn-get-data-crash-rh1541565.patch create mode 100644 0003-fix-cert-chooser-for-no-modules-bgo785674.patch diff --git a/0002-fix-vpn-get-data-crash-rh1541565.patch b/0002-fix-vpn-get-data-crash-rh1541565.patch new file mode 100644 index 0000000..8f217af --- /dev/null +++ b/0002-fix-vpn-get-data-crash-rh1541565.patch @@ -0,0 +1,137 @@ +From 46f99b295e59f44dfde50ec90e7c09627d32431e Mon Sep 17 00:00:00 2001 +From: "Jan Alexander Steffens (heftig)" +Date: Wed, 20 Dec 2017 13:23:12 +0100 +Subject: [PATCH 1/2] shared/compat: fix memory handling of + nm_setting_vpn_get_*_keys + +The compat implementations return a (transfer none) strv instead of a +(transfer container) one. This has caused double frees in nm-applet: +https://bugs.archlinux.org/task/56772 + +Don't copy the keys and don't free the container later. + +[thaller@redhat.com: patch adjusted to avoid compiler warning] + +Patch imported from NetworkManager commit 8ac8c01162235c2c198bfaf25fb7d1a57a595ce5. + +Fixes: e93ca7fc129ec0f29f5313a3aa12839914df8fa2 +(cherry picked from commit 0c90e08f77b71d2bda699cf032fceec0122bbf82) +--- + shared/nm-utils/nm-compat.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/shared/nm-utils/nm-compat.c b/shared/nm-utils/nm-compat.c +index 22ab675d..47035e62 100644 +--- a/shared/nm-utils/nm-compat.c ++++ b/shared/nm-utils/nm-compat.c +@@ -30,7 +30,7 @@ _get_keys_cb (const char *key, const char *val, gpointer user_data) + { + GPtrArray *a = user_data; + +- g_ptr_array_add (a, g_strdup (key)); ++ g_ptr_array_add (a, (gpointer) key); + } + + static const char ** +@@ -55,14 +55,6 @@ _get_keys (NMSettingVpn *setting, + g_ptr_array_sort (a, nm_strcmp_p); + g_ptr_array_add (a, NULL); + keys = (const char **) g_ptr_array_free (g_steal_pointer (&a), FALSE); +- +- /* we need to cache the keys *somewhere*. */ +- g_object_set_qdata_full (G_OBJECT (setting), +- is_secrets +- ? NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_secret_keys") +- : NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_data_keys"), +- keys, +- (GDestroyNotify) g_strfreev); + } + + NM_SET_OUT (out_length, len); +-- +2.14.3 + + +From 0d13a8b4064c83146714ecee86b69042aca35f9e Mon Sep 17 00:00:00 2001 +From: "Jan Alexander Steffens (heftig)" +Date: Thu, 21 Dec 2017 20:36:48 +0100 +Subject: [PATCH 2/2] shared/compat: fix memory handling of + nm_setting_vpn_get_*_keys() + +The previous fix was bad because the keys do not come from NMSettingVpn's hash +table but are copies that are freed by nm_setting_vpn_foreach_* before +it returns. + +[thaller@redhat.com: import shared code from NetworkManager, merging +three patches together.] + +Fixes: e93ca7fc129ec0f29f5313a3aa12839914df8fa2 +Fixes: 0c90e08f77b71d2bda699cf032fceec0122bbf82 + +https://mail.gnome.org/archives/networkmanager-list/2017-December/msg00069.html +https://mail.gnome.org/archives/networkmanager-list/2017-December/msg00070.html +(cherry picked from commit a52ccb2fe170558fc0aab4dd1d15ba8808b10951) +--- + shared/nm-utils/nm-compat.c | 29 ++++++++++++++++++++++------- + 1 file changed, 22 insertions(+), 7 deletions(-) + +diff --git a/shared/nm-utils/nm-compat.c b/shared/nm-utils/nm-compat.c +index 47035e62..90328c06 100644 +--- a/shared/nm-utils/nm-compat.c ++++ b/shared/nm-utils/nm-compat.c +@@ -30,7 +30,7 @@ _get_keys_cb (const char *key, const char *val, gpointer user_data) + { + GPtrArray *a = user_data; + +- g_ptr_array_add (a, (gpointer) key); ++ g_ptr_array_add (a, g_strdup (key)); + } + + static const char ** +@@ -40,22 +40,37 @@ _get_keys (NMSettingVpn *setting, + { + guint len; + const char **keys = NULL; +- gs_unref_ptrarray GPtrArray *a = NULL; ++ GPtrArray *a; + + nm_assert (NM_IS_SETTING_VPN (setting)); + +- a = g_ptr_array_new (); ++ if (is_secrets) ++ len = nm_setting_vpn_get_num_secrets (setting); ++ else ++ len = nm_setting_vpn_get_num_data_items (setting); ++ ++ a = g_ptr_array_sized_new (len + 1); ++ + if (is_secrets) + nm_setting_vpn_foreach_secret (setting, _get_keys_cb, a); + else + nm_setting_vpn_foreach_data_item (setting, _get_keys_cb, a); +- len = a->len; + +- if (a->len) { ++ len = a->len; ++ if (len) { + g_ptr_array_sort (a, nm_strcmp_p); + g_ptr_array_add (a, NULL); +- keys = (const char **) g_ptr_array_free (g_steal_pointer (&a), FALSE); +- } ++ keys = g_memdup (a->pdata, a->len * sizeof (gpointer)); ++ ++ /* we need to cache the keys *somewhere*. */ ++ g_object_set_qdata_full (G_OBJECT (setting), ++ is_secrets ++ ? NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_secret_keys") ++ : NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_data_keys"), ++ g_ptr_array_free (a, FALSE), ++ (GDestroyNotify) g_strfreev); ++ } else ++ g_ptr_array_free (a, TRUE); + + NM_SET_OUT (out_length, len); + return keys; +-- +2.14.3 + diff --git a/0003-fix-cert-chooser-for-no-modules-bgo785674.patch b/0003-fix-cert-chooser-for-no-modules-bgo785674.patch new file mode 100644 index 0000000..9aad239 --- /dev/null +++ b/0003-fix-cert-chooser-for-no-modules-bgo785674.patch @@ -0,0 +1,38 @@ +From 4d2523b482ab78134dafc02c9b99bd15f1a9174a Mon Sep 17 00:00:00 2001 +From: Ben Wiederhake +Date: Sun, 14 Jan 2018 23:28:15 +0100 +Subject: [PATCH 1/1] libnma/cert-chooser: handle case of no avalable modules + +Cause: Apparently it's perfectly okay if the list of modules is empty +(e.g., NULL). However, the code assume that this indicates an error, +tries to print the NULL error, and crashes. + +[lkundrak@v3.sk: cosmetic changes] + +https://bugzilla.gnome.org/show_bug.cgi?id=785674 +(cherry picked from commit a37483c1a364ef3cc1cfa29e7ad51ca108d75674) +--- + src/libnma/nma-cert-chooser-button.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/libnma/nma-cert-chooser-button.c b/src/libnma/nma-cert-chooser-button.c +index c7089390..00651765 100644 +--- a/src/libnma/nma-cert-chooser-button.c ++++ b/src/libnma/nma-cert-chooser-button.c +@@ -93,10 +93,10 @@ modules_initialized (GObject *object, GAsyncResult *res, gpointer user_data) + gchar *label; + + modules = gck_modules_initialize_registered_finish (res, &error); +- if (!modules) { ++ if (error) { + /* The Front Fell Off. */ +- g_critical ("Error getting registered modules: %s", error->message); +- g_error_free (error); ++ g_warning ("Error getting registered modules: %s", error->message); ++ g_clear_error (&error); + } + + model = GTK_LIST_STORE (gtk_combo_box_get_model (GTK_COMBO_BOX (self))); +-- +2.14.3 + diff --git a/network-manager-applet.spec b/network-manager-applet.spec index 69a5316..547c90d 100644 --- a/network-manager-applet.spec +++ b/network-manager-applet.spec @@ -5,7 +5,7 @@ %global rpm_version 1.8.10 %global real_version 1.8.10 -%global release_version 1 +%global release_version 2 %global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[1-9][0-9]*\\)\\.[1-9][0-9]*$/\\1/p') @@ -18,7 +18,7 @@ Name: network-manager-applet Summary: A network control and status applet for NetworkManager Version: %{rpm_version} -Release: %{release_version}%{?dist}.2 +Release: %{release_version}%{?dist} Group: Applications/System License: GPLv2+ URL: http://www.gnome.org/projects/NetworkManager/ @@ -26,6 +26,8 @@ Obsoletes: NetworkManager-gnome < %{obsoletes_ver} Source: https://download.gnome.org/sources/network-manager-applet/%{real_version_major}/%{name}-%{real_version}.tar.xz Patch1: 0001-nm-applet-no-notifications.patch +Patch2: 0002-fix-vpn-get-data-crash-rh1541565.patch +Patch3: 0003-fix-cert-chooser-for-no-modules-bgo785674.patch Requires: NetworkManager >= %{nm_version} Requires: libnotify >= 0.4.3 @@ -126,6 +128,8 @@ This package deprecates libnm-gtk. %prep %setup -q -n "%{name}-%{real_version}" %patch1 -p1 +%patch2 -p1 +%patch3 -p1 %build %meson \ @@ -216,6 +220,10 @@ desktop-file-validate $RPM_BUILD_ROOT%{_datadir}/applications/nm-connection-edit %changelog +* Sun Feb 4 2018 Thomas Haller - 1.8.10-2 +- fix double-free handling VPN data in nm-applet (rh #1541565) +- fix certificate chooser for no available modules (bgo #785674) + * Sat Feb 03 2018 Igor Gnatenko - 1.8.10-1.2 - Switch to %%ldconfig_scriptlets