avahi: backport CVE fixes from upstream
Signed-off-by: Rosen Penev <rosenp@gmail.com>
This commit is contained in:
parent
7f7cc4bbb0
commit
1974a441d5
|
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
|
||||||
|
|
||||||
PKG_NAME:=avahi
|
PKG_NAME:=avahi
|
||||||
PKG_VERSION:=0.8
|
PKG_VERSION:=0.8
|
||||||
PKG_RELEASE:=8
|
PKG_RELEASE:=9
|
||||||
|
|
||||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
|
||||||
PKG_SOURCE_URL:=https://github.com/lathiat/avahi/releases/download/v$(PKG_VERSION) \
|
PKG_SOURCE_URL:=https://github.com/lathiat/avahi/releases/download/v$(PKG_VERSION) \
|
||||||
|
|
|
@ -0,0 +1,41 @@
|
||||||
|
From a337a1ba7d15853fb56deef1f464529af6e3a1cf Mon Sep 17 00:00:00 2001
|
||||||
|
From: Evgeny Vereshchagin <evvers@ya.ru>
|
||||||
|
Date: Mon, 23 Oct 2023 20:29:31 +0000
|
||||||
|
Subject: [PATCH] core: reject overly long TXT resource records
|
||||||
|
|
||||||
|
Closes https://github.com/lathiat/avahi/issues/455
|
||||||
|
|
||||||
|
CVE-2023-38469
|
||||||
|
---
|
||||||
|
avahi-core/rr.c | 9 ++++++++-
|
||||||
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
--- a/avahi-core/rr.c
|
||||||
|
+++ b/avahi-core/rr.c
|
||||||
|
@@ -32,6 +32,7 @@
|
||||||
|
#include <avahi-common/malloc.h>
|
||||||
|
#include <avahi-common/defs.h>
|
||||||
|
|
||||||
|
+#include "dns.h"
|
||||||
|
#include "rr.h"
|
||||||
|
#include "log.h"
|
||||||
|
#include "util.h"
|
||||||
|
@@ -688,11 +689,17 @@ int avahi_record_is_valid(AvahiRecord *r
|
||||||
|
case AVAHI_DNS_TYPE_TXT: {
|
||||||
|
|
||||||
|
AvahiStringList *strlst;
|
||||||
|
+ size_t used = 0;
|
||||||
|
|
||||||
|
- for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next)
|
||||||
|
+ for (strlst = r->data.txt.string_list; strlst; strlst = strlst->next) {
|
||||||
|
if (strlst->size > 255 || strlst->size <= 0)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
+ used += 1+strlst->size;
|
||||||
|
+ if (used > AVAHI_DNS_RDATA_MAX)
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
}
|
|
@ -0,0 +1,48 @@
|
||||||
|
From b6cf29f98adce7355e8c51a6af1e338a5f94e16e Mon Sep 17 00:00:00 2001
|
||||||
|
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||||||
|
Date: Tue, 11 Apr 2023 15:29:59 +0200
|
||||||
|
Subject: [PATCH] Ensure each label is at least one byte long
|
||||||
|
|
||||||
|
The only allowed exception is single dot, where it should return empty
|
||||||
|
string.
|
||||||
|
|
||||||
|
Fixes #454.
|
||||||
|
---
|
||||||
|
avahi-common/domain-test.c | 14 ++++++++++++++
|
||||||
|
avahi-common/domain.c | 2 +-
|
||||||
|
2 files changed, 15 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
--- a/avahi-common/domain-test.c
|
||||||
|
+++ b/avahi-common/domain-test.c
|
||||||
|
@@ -45,6 +45,20 @@ int main(AVAHI_GCC_UNUSED int argc, AVAH
|
||||||
|
printf("%s\n", s = avahi_normalize_name_strdup("fo\\\\o\\..f oo."));
|
||||||
|
avahi_free(s);
|
||||||
|
|
||||||
|
+ printf("%s\n", s = avahi_normalize_name_strdup("."));
|
||||||
|
+ avahi_free(s);
|
||||||
|
+
|
||||||
|
+ s = avahi_normalize_name_strdup(",.=.}.=.?-.}.=.?.?.}.}.?.?.?.z.?.?.}.}."
|
||||||
|
+ "}.?.?.?.r.=.=.}.=.?.}}.}.?.?.?.zM.=.=.?.?.}.}.?.?.}.}.}"
|
||||||
|
+ ".?.?.?.r.=.=.}.=.?.}}.}.?.?.?.zM.=.=.?.?.}.}.?.?.?.zM.?`"
|
||||||
|
+ "?.}.}.}.?.?.?.r.=.?.}.=.?.?.}.?.?.?.}.=.?.?.}??.}.}.?.?."
|
||||||
|
+ "?.z.?.?.}.}.}.?.?.?.r.=.=.}.=.?.}}.}.?.?.?.zM.?`?.}.}.}."
|
||||||
|
+ "??.?.zM.?`?.}.}.}.?.?.?.r.=.?.}.=.?.?.}.?.?.?.}.=.?.?.}?"
|
||||||
|
+ "?.}.}.?.?.?.z.?.?.}.}.}.?.?.?.r.=.=.}.=.?.}}.}.?.?.?.zM."
|
||||||
|
+ "?`?.}.}.}.?.?.?.r.=.=.?.?`.?.?}.}.}.?.?.?.r.=.?.}.=.?.?."
|
||||||
|
+ "}.?.?.?.}.=.?.?.}");
|
||||||
|
+ assert(s == NULL);
|
||||||
|
+
|
||||||
|
printf("%i\n", avahi_domain_equal("\\065aa bbb\\.\\046cc.cc\\\\.dee.fff.", "Aaa BBB\\.\\.cc.cc\\\\.dee.fff"));
|
||||||
|
printf("%i\n", avahi_domain_equal("A", "a"));
|
||||||
|
|
||||||
|
--- a/avahi-common/domain.c
|
||||||
|
+++ b/avahi-common/domain.c
|
||||||
|
@@ -201,7 +201,7 @@ char *avahi_normalize_name(const char *s
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!empty) {
|
||||||
|
- if (size < 1)
|
||||||
|
+ if (size < 2)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
*(r++) = '.';
|
|
@ -0,0 +1,66 @@
|
||||||
|
From d486bca7e7912c6a4b547a3c607db0d0d3124bbf Mon Sep 17 00:00:00 2001
|
||||||
|
From: Michal Sekletar <msekleta@redhat.com>
|
||||||
|
Date: Mon, 23 Oct 2023 13:38:35 +0200
|
||||||
|
Subject: [PATCH] core: extract host name using avahi_unescape_label()
|
||||||
|
|
||||||
|
Previously we could create invalid escape sequence when we split the
|
||||||
|
string on dot. For example, from valid host name "foo\\.bar" we have
|
||||||
|
created invalid name "foo\\" and tried to set that as the host name
|
||||||
|
which crashed the daemon.
|
||||||
|
|
||||||
|
Fixes #453
|
||||||
|
|
||||||
|
CVE-2023-38471
|
||||||
|
---
|
||||||
|
avahi-core/server.c | 27 +++++++++++++++++++++------
|
||||||
|
1 file changed, 21 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
--- a/avahi-core/server.c
|
||||||
|
+++ b/avahi-core/server.c
|
||||||
|
@@ -1295,7 +1295,11 @@ static void update_fqdn(AvahiServer *s)
|
||||||
|
}
|
||||||
|
|
||||||
|
int avahi_server_set_host_name(AvahiServer *s, const char *host_name) {
|
||||||
|
- char *hn = NULL;
|
||||||
|
+ char label_escaped[AVAHI_LABEL_MAX*4+1];
|
||||||
|
+ char label[AVAHI_LABEL_MAX];
|
||||||
|
+ char *hn = NULL, *h;
|
||||||
|
+ size_t len;
|
||||||
|
+
|
||||||
|
assert(s);
|
||||||
|
|
||||||
|
AVAHI_CHECK_VALIDITY(s, !host_name || avahi_is_valid_host_name(host_name), AVAHI_ERR_INVALID_HOST_NAME);
|
||||||
|
@@ -1305,17 +1309,28 @@ int avahi_server_set_host_name(AvahiServ
|
||||||
|
else
|
||||||
|
hn = avahi_normalize_name_strdup(host_name);
|
||||||
|
|
||||||
|
- hn[strcspn(hn, ".")] = 0;
|
||||||
|
+ h = hn;
|
||||||
|
+ if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) {
|
||||||
|
+ avahi_free(h);
|
||||||
|
+ return AVAHI_ERR_INVALID_HOST_NAME;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ avahi_free(h);
|
||||||
|
|
||||||
|
- if (avahi_domain_equal(s->host_name, hn) && s->state != AVAHI_SERVER_COLLISION) {
|
||||||
|
- avahi_free(hn);
|
||||||
|
+ h = label_escaped;
|
||||||
|
+ len = sizeof(label_escaped);
|
||||||
|
+ if (!avahi_escape_label(label, strlen(label), &h, &len))
|
||||||
|
+ return AVAHI_ERR_INVALID_HOST_NAME;
|
||||||
|
+
|
||||||
|
+ if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION)
|
||||||
|
return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE);
|
||||||
|
- }
|
||||||
|
|
||||||
|
withdraw_host_rrs(s);
|
||||||
|
|
||||||
|
avahi_free(s->host_name);
|
||||||
|
- s->host_name = hn;
|
||||||
|
+ s->host_name = avahi_strdup(label_escaped);
|
||||||
|
+ if (!s->host_name)
|
||||||
|
+ return AVAHI_ERR_NO_MEMORY;
|
||||||
|
|
||||||
|
update_fqdn(s);
|
||||||
|
|
|
@ -0,0 +1,36 @@
|
||||||
|
From d886dc5b1d3d2b76aaa38289245acfdfa979ca6c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Michal Sekletar <msekleta@redhat.com>
|
||||||
|
Date: Thu, 19 Oct 2023 17:36:44 +0200
|
||||||
|
Subject: [PATCH] core: make sure there is rdata to process before parsing it
|
||||||
|
|
||||||
|
Fixes #452
|
||||||
|
|
||||||
|
CVE-2023-38472
|
||||||
|
---
|
||||||
|
avahi-client/client-test.c | 3 +++
|
||||||
|
avahi-daemon/dbus-entry-group.c | 2 +-
|
||||||
|
2 files changed, 4 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
--- a/avahi-client/client-test.c
|
||||||
|
+++ b/avahi-client/client-test.c
|
||||||
|
@@ -258,6 +258,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVA
|
||||||
|
printf("%s\n", avahi_strerror(avahi_entry_group_add_service (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "Lathiat's Site", "_http._tcp", NULL, NULL, 80, "foo=bar", NULL)));
|
||||||
|
printf("add_record: %d\n", avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "\5booya", 6));
|
||||||
|
|
||||||
|
+ error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0);
|
||||||
|
+ assert(error != AVAHI_OK);
|
||||||
|
+
|
||||||
|
avahi_entry_group_commit (group);
|
||||||
|
|
||||||
|
domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u");
|
||||||
|
--- a/avahi-daemon/dbus-entry-group.c
|
||||||
|
+++ b/avahi-daemon/dbus-entry-group.c
|
||||||
|
@@ -340,7 +340,7 @@ DBusHandlerResult avahi_dbus_msg_entry_g
|
||||||
|
if (!(r = avahi_record_new_full (name, clazz, type, ttl)))
|
||||||
|
return avahi_dbus_respond_error(c, m, AVAHI_ERR_NO_MEMORY, NULL);
|
||||||
|
|
||||||
|
- if (avahi_rdata_parse (r, rdata, size) < 0) {
|
||||||
|
+ if (!rdata || avahi_rdata_parse (r, rdata, size) < 0) {
|
||||||
|
avahi_record_unref (r);
|
||||||
|
return avahi_dbus_respond_error(c, m, AVAHI_ERR_INVALID_RDATA, NULL);
|
||||||
|
}
|
|
@ -0,0 +1,100 @@
|
||||||
|
From 5edc17b7913cac824daa09fca9976c9c19e88822 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Michal Sekletar <msekleta@redhat.com>
|
||||||
|
Date: Wed, 11 Oct 2023 17:45:44 +0200
|
||||||
|
Subject: [PATCH] common: derive alternative host name from its unescaped
|
||||||
|
version
|
||||||
|
|
||||||
|
Normalization of input makes sure we don't have to deal with special
|
||||||
|
cases like unescaped dot at the end of label.
|
||||||
|
|
||||||
|
Fixes #451 #487
|
||||||
|
CVE-2023-38473
|
||||||
|
---
|
||||||
|
avahi-common/alternative-test.c | 3 +++
|
||||||
|
avahi-common/alternative.c | 27 +++++++++++++++++++--------
|
||||||
|
2 files changed, 22 insertions(+), 8 deletions(-)
|
||||||
|
|
||||||
|
--- a/avahi-common/alternative-test.c
|
||||||
|
+++ b/avahi-common/alternative-test.c
|
||||||
|
@@ -31,6 +31,9 @@ int main(AVAHI_GCC_UNUSED int argc, AVAH
|
||||||
|
const char* const test_strings[] = {
|
||||||
|
"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
|
||||||
|
"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXüüüüüüü",
|
||||||
|
+ ").",
|
||||||
|
+ "\\.",
|
||||||
|
+ "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\\\",
|
||||||
|
"gurke",
|
||||||
|
"-",
|
||||||
|
" #",
|
||||||
|
--- a/avahi-common/alternative.c
|
||||||
|
+++ b/avahi-common/alternative.c
|
||||||
|
@@ -49,15 +49,20 @@ static void drop_incomplete_utf8(char *c
|
||||||
|
}
|
||||||
|
|
||||||
|
char *avahi_alternative_host_name(const char *s) {
|
||||||
|
+ char label[AVAHI_LABEL_MAX], alternative[AVAHI_LABEL_MAX*4+1];
|
||||||
|
+ char *alt, *r, *ret;
|
||||||
|
const char *e;
|
||||||
|
- char *r;
|
||||||
|
+ size_t len;
|
||||||
|
|
||||||
|
assert(s);
|
||||||
|
|
||||||
|
if (!avahi_is_valid_host_name(s))
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
- if ((e = strrchr(s, '-'))) {
|
||||||
|
+ if (!avahi_unescape_label(&s, label, sizeof(label)))
|
||||||
|
+ return NULL;
|
||||||
|
+
|
||||||
|
+ if ((e = strrchr(label, '-'))) {
|
||||||
|
const char *p;
|
||||||
|
|
||||||
|
e++;
|
||||||
|
@@ -74,19 +79,18 @@ char *avahi_alternative_host_name(const
|
||||||
|
|
||||||
|
if (e) {
|
||||||
|
char *c, *m;
|
||||||
|
- size_t l;
|
||||||
|
int n;
|
||||||
|
|
||||||
|
n = atoi(e)+1;
|
||||||
|
if (!(m = avahi_strdup_printf("%i", n)))
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
- l = e-s-1;
|
||||||
|
+ len = e-label-1;
|
||||||
|
|
||||||
|
- if (l >= AVAHI_LABEL_MAX-1-strlen(m)-1)
|
||||||
|
- l = AVAHI_LABEL_MAX-1-strlen(m)-1;
|
||||||
|
+ if (len >= AVAHI_LABEL_MAX-1-strlen(m)-1)
|
||||||
|
+ len = AVAHI_LABEL_MAX-1-strlen(m)-1;
|
||||||
|
|
||||||
|
- if (!(c = avahi_strndup(s, l))) {
|
||||||
|
+ if (!(c = avahi_strndup(label, len))) {
|
||||||
|
avahi_free(m);
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
@@ -100,7 +104,7 @@ char *avahi_alternative_host_name(const
|
||||||
|
} else {
|
||||||
|
char *c;
|
||||||
|
|
||||||
|
- if (!(c = avahi_strndup(s, AVAHI_LABEL_MAX-1-2)))
|
||||||
|
+ if (!(c = avahi_strndup(label, AVAHI_LABEL_MAX-1-2)))
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
drop_incomplete_utf8(c);
|
||||||
|
@@ -109,6 +113,13 @@ char *avahi_alternative_host_name(const
|
||||||
|
avahi_free(c);
|
||||||
|
}
|
||||||
|
|
||||||
|
+ alt = alternative;
|
||||||
|
+ len = sizeof(alternative);
|
||||||
|
+ ret = avahi_escape_label(r, strlen(r), &alt, &len);
|
||||||
|
+
|
||||||
|
+ avahi_free(r);
|
||||||
|
+ r = avahi_strdup(ret);
|
||||||
|
+
|
||||||
|
assert(avahi_is_valid_host_name(r));
|
||||||
|
|
||||||
|
return r;
|
Loading…
Reference in New Issue