libs/avahi/patches/303-CVE-2023-38472.patch

   1 From d886dc5b1d3d2b76aaa38289245acfdfa979ca6c Mon Sep 17 00:00:00 2001
   2 From: Michal Sekletar <msekleta@redhat.com>
   3 Date: Thu, 19 Oct 2023 17:36:44 +0200
   4 Subject: [PATCH] core: make sure there is rdata to process before parsing it
   5
   6 Fixes #452
   7
   8 CVE-2023-38472
   9 ---
  10  avahi-client/client-test.c      | 3 +++
  11  avahi-daemon/dbus-entry-group.c | 2 +-
  12  2 files changed, 4 insertions(+), 1 deletion(-)
  13
  14 --- a/avahi-client/client-test.c
  15 +++ b/avahi-client/client-test.c
  16 @@ -258,6 +258,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVA
  17      printf("%s\n", avahi_strerror(avahi_entry_group_add_service (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "Lathiat's Site", "_http._tcp", NULL, NULL, 80, "foo=bar", NULL)));
  18      printf("add_record: %d\n", avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "\5booya", 6));
  19
  20 +    error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0);
  21 +    assert(error != AVAHI_OK);
  22 +
  23      avahi_entry_group_commit (group);
  24
  25      domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u");
  26 --- a/avahi-daemon/dbus-entry-group.c
  27 +++ b/avahi-daemon/dbus-entry-group.c
  28 @@ -340,7 +340,7 @@ DBusHandlerResult avahi_dbus_msg_entry_g
  29          if (!(r = avahi_record_new_full (name, clazz, type, ttl)))
  30              return avahi_dbus_respond_error(c, m, AVAHI_ERR_NO_MEMORY, NULL);
  31
  32 -        if (avahi_rdata_parse (r, rdata, size) < 0) {
  33 +        if (!rdata || avahi_rdata_parse (r, rdata, size) < 0) {
  34              avahi_record_unref (r);
  35              return avahi_dbus_respond_error(c, m, AVAHI_ERR_INVALID_RDATA, NULL);
  36          }