Fix segfault when listen() returns an error

Resolves: rhbz#1666380

0001-Move-closing-standard-FDs-after-listen.patch

@@ -0,0 +1,46 @@
+From 40fea4552377504ce69935149e64e39a595f4600 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
+Date: Sat, 3 Aug 2019 17:50:14 +0200
+Subject: [PATCH 1/2] Move closing standard FDs after listen()
+
+The vsf_sysutil_close() calls need to be moved a bit further so that
+die() works properly in case listen() fails.
+
+I see no reason the calls should be placed before listen()
+specifically, as they are now. My guess is that the author who added
+the calls thought that listen() is a blocking call, which is not the
+case. The only thing we need to satisfy is that close() is called
+before accept, because that is a blocking call. That's all that is
+needed to fix the bug that was fixed by adding the close() calls.
+
+Resolves: rhbz#1666380
+---
+ standalone.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/standalone.c b/standalone.c
+index 3f35e9e..b358ca1 100644
+--- a/standalone.c
++++ b/standalone.c
+@@ -152,15 +152,15 @@ vsf_standalone_main(void)
+       vsf_sysutil_kill(vsf_sysutil_getppid(), kVSFSysUtilSigUSR1);
+     }
+   }
+-  vsf_sysutil_close(0);
+-  vsf_sysutil_close(1);
+-  vsf_sysutil_close(2);
+   retval = vsf_sysutil_listen(listen_sock, VSFTP_LISTEN_BACKLOG);
+   if (vsf_sysutil_retval_is_error(retval))
+   {
+     die("could not listen");
+   }
+   vsf_sysutil_sockaddr_alloc(&p_accept_addr);
++  vsf_sysutil_close(0);
++  vsf_sysutil_close(1);
++  vsf_sysutil_close(2);
+   while (1)
+   {
+     struct vsf_client_launch child_info;
+-- 
+2.20.1
+

0002-Prevent-recursion-in-bug.patch

@@ -0,0 +1,107 @@
+From e679a3ce0f2cf1558da31e0bccd9e2398b89c7e9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
+Date: Tue, 30 Jul 2019 16:07:01 +0200
+Subject: [PATCH 2/2] Prevent recursion in bug()
+
+Resolves: rhbz#1666380
+---
+ sysutil.c | 35 +++++++++++++++++++++++++++++++----
+ sysutil.h |  1 +
+ utility.c | 12 +++++++-----
+ 3 files changed, 39 insertions(+), 9 deletions(-)
+
+diff --git a/sysutil.c b/sysutil.c
+index fd07d99..e2df671 100644
+--- a/sysutil.c
++++ b/sysutil.c
+@@ -774,21 +774,48 @@ vsf_sysutil_deactivate_linger_failok(int fd)
+   (void) setsockopt(fd, SOL_SOCKET, SO_LINGER, &the_linger, sizeof(the_linger));
+ }
+ 
+-void
+-vsf_sysutil_activate_noblock(int fd)
++static int
++vsf_sysutil_activate_noblock_internal(int fd, int return_err)
+ {
+   int retval;
+   int curr_flags = fcntl(fd, F_GETFL);
+   if (vsf_sysutil_retval_is_error(curr_flags))
+   {
+-    die("fcntl");
++    if (return_err)
++    {
++      return -1;
++    }
++    else
++    {
++      die("fcntl");
++    }
+   }
+   curr_flags |= O_NONBLOCK;
+   retval = fcntl(fd, F_SETFL, curr_flags);
+   if (retval != 0)
+   {
+-    die("fcntl");
++    if (return_err)
++    {
++      return -1;
++    }
++    else
++    {
++      die("fcntl");
++    }
+   }
++  return 0;
++}
++
++void
++vsf_sysutil_activate_noblock(int fd)
++{
++  (void) vsf_sysutil_activate_noblock_internal(fd, 0);
++}
++
++int
++vsf_sysutil_activate_noblock_no_die(int fd)
++{
++  return vsf_sysutil_activate_noblock_internal(fd, 1);
+ }
+ 
+ void
+diff --git a/sysutil.h b/sysutil.h
+index 2df14ed..0772423 100644
+--- a/sysutil.h
++++ b/sysutil.h
+@@ -281,6 +281,7 @@ void vsf_sysutil_activate_oobinline(int fd);
+ void vsf_sysutil_activate_linger(int fd);
+ void vsf_sysutil_deactivate_linger_failok(int fd);
+ void vsf_sysutil_activate_noblock(int fd);
++int vsf_sysutil_activate_noblock_no_die(int fd);
+ void vsf_sysutil_deactivate_noblock(int fd);
+ /* This does SHUT_RDWR */
+ void vsf_sysutil_shutdown_failok(int fd);
+diff --git a/utility.c b/utility.c
+index 75e5bdd..5619a04 100644
+--- a/utility.c
++++ b/utility.c
+@@ -47,11 +47,13 @@ bug(const char* p_text)
+   {
+     vsf_log_die(p_text);
+   }
+-  vsf_sysutil_activate_noblock(VSFTP_COMMAND_FD);
+-  (void) vsf_sysutil_write_loop(VSFTP_COMMAND_FD, "500 OOPS: ", 10);
+-  (void) vsf_sysutil_write_loop(VSFTP_COMMAND_FD, p_text,
+-                                vsf_sysutil_strlen(p_text));
+-  (void) vsf_sysutil_write_loop(VSFTP_COMMAND_FD, "\r\n", 2);
++  if (vsf_sysutil_activate_noblock_no_die(VSFTP_COMMAND_FD) == 0)
++  {
++    (void) vsf_sysutil_write_loop(VSFTP_COMMAND_FD, "500 OOPS: ", 10);
++    (void) vsf_sysutil_write_loop(VSFTP_COMMAND_FD, p_text,
++				  vsf_sysutil_strlen(p_text));
++    (void) vsf_sysutil_write_loop(VSFTP_COMMAND_FD, "\r\n", 2);
++  }
+   if (tunable_log_die)
+   {
+     /* Workaround for https://github.com/systemd/systemd/issues/2913 */
+-- 
+2.20.1
+

vsftpd.spec

@@ -2,7 +2,7 @@
 
 Name:    vsftpd
 Version: 3.0.3
-Release: 30%{?dist}
+Release: 31%{?dist}
 Summary: Very Secure Ftp Daemon
 
 # OpenSSL link exception
@@ -87,6 +87,8 @@ Patch56: 0056-Log-die-calls-to-syslog.patch
 Patch57: 0057-Improve-error-message-when-max-number-of-bind-attemp.patch
 Patch58: 0058-Make-the-max-number-of-bind-retries-tunable.patch
 Patch59: 0059-Fix-SEGFAULT-when-running-in-a-container-as-PID-1.patch
+Patch61: 0001-Move-closing-standard-FDs-after-listen.patch
+Patch62: 0002-Prevent-recursion-in-bug.patch
 
 %description
 vsftpd is a Very Secure FTP daemon. It was written completely from
@@ -155,6 +157,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub
 %{_var}/ftp
 
 %changelog
+* Sat Aug 03 2019 Ondřej Lysoněk <olysonek@redhat.com> - 3.0.3-31
+- Fix segfault when listen() returns an error
+- Resolves: rhbz#1666380
+
 * Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.3-30
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild