|
| 1 | +From 6b7bf204cdb5f19798b6237324a3ce797f24359b Mon Sep 17 00:00:00 2001 |
| 2 | +From: Kanishk-Bansal <kbkanishk975@gmail.com> |
| 3 | +Date: Thu, 13 Feb 2025 04:41:42 +0000 |
| 4 | +Subject: [PATCH] Fix CVE-2024-52616 |
| 5 | +Upstream Patch Reference https://github.com/avahi/avahi/pull/659/commits/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7 |
| 6 | + |
| 7 | +--- |
| 8 | + avahi-core/wide-area.c | 36 ++++++++++++++++++++++++++++-------- |
| 9 | + configure.ac | 3 ++- |
| 10 | + 2 files changed, 30 insertions(+), 9 deletions(-) |
| 11 | + |
| 12 | +diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c |
| 13 | +index d5e64e5..4cbba6c 100644 |
| 14 | +--- a/avahi-core/wide-area.c |
| 15 | ++++ b/avahi-core/wide-area.c |
| 16 | +@@ -40,6 +40,13 @@ |
| 17 | + #include "addr-util.h" |
| 18 | + #include "rr-util.h" |
| 19 | + |
| 20 | ++#ifdef HAVE_SYS_RANDOM_H |
| 21 | ++#include <sys/random.h> |
| 22 | ++#endif |
| 23 | ++#ifndef HAVE_GETRANDOM |
| 24 | ++# define getrandom(d, len, flags) (-1) |
| 25 | ++#endif |
| 26 | ++ |
| 27 | + #define CACHE_ENTRIES_MAX 500 |
| 28 | + |
| 29 | + typedef struct AvahiWideAreaCacheEntry AvahiWideAreaCacheEntry; |
| 30 | +@@ -84,8 +91,6 @@ struct AvahiWideAreaLookupEngine { |
| 31 | + int fd_ipv4, fd_ipv6; |
| 32 | + AvahiWatch *watch_ipv4, *watch_ipv6; |
| 33 | + |
| 34 | +- uint16_t next_id; |
| 35 | +- |
| 36 | + /* Cache */ |
| 37 | + AVAHI_LLIST_HEAD(AvahiWideAreaCacheEntry, cache); |
| 38 | + AvahiHashmap *cache_by_key; |
| 39 | +@@ -201,6 +206,26 @@ static void sender_timeout_callback(AvahiTimeEvent *e, void *userdata) { |
| 40 | + avahi_time_event_update(e, avahi_elapse_time(&tv, 1000, 0)); |
| 41 | + } |
| 42 | + |
| 43 | ++static uint16_t get_random_uint16(void) { |
| 44 | ++ uint16_t next_id; |
| 45 | ++ |
| 46 | ++ if (getrandom(&next_id, sizeof(next_id), 0) == -1) |
| 47 | ++ next_id = (uint16_t) rand(); |
| 48 | ++ return next_id; |
| 49 | ++} |
| 50 | ++ |
| 51 | ++static uint16_t avahi_wide_area_next_id(AvahiWideAreaLookupEngine *e) { |
| 52 | ++ uint16_t next_id; |
| 53 | ++ |
| 54 | ++ next_id = get_random_uint16(); |
| 55 | ++ while (find_lookup(e, next_id)) { |
| 56 | ++ /* This ID is already used, get new. */ |
| 57 | ++ next_id = get_random_uint16(); |
| 58 | ++ } |
| 59 | ++ return next_id; |
| 60 | ++} |
| 61 | ++ |
| 62 | ++ |
| 63 | + AvahiWideAreaLookup *avahi_wide_area_lookup_new( |
| 64 | + AvahiWideAreaLookupEngine *e, |
| 65 | + AvahiKey *key, |
| 66 | +@@ -227,11 +252,7 @@ AvahiWideAreaLookup *avahi_wide_area_lookup_new( |
| 67 | + /* If more than 65K wide area quries are issued simultaneously, |
| 68 | + * this will break. This should be limited by some higher level */ |
| 69 | + |
| 70 | +- for (;; e->next_id++) |
| 71 | +- if (!find_lookup(e, e->next_id)) |
| 72 | +- break; /* This ID is not yet used. */ |
| 73 | +- |
| 74 | +- l->id = e->next_id++; |
| 75 | ++ l->id = avahi_wide_area_next_id(e); |
| 76 | + |
| 77 | + /* We keep the packet around in case we need to repeat our query */ |
| 78 | + l->packet = avahi_dns_packet_new(0); |
| 79 | +@@ -603,7 +624,6 @@ AvahiWideAreaLookupEngine *avahi_wide_area_engine_new(AvahiServer *s) { |
| 80 | + e->watch_ipv6 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv6, AVAHI_WATCH_IN, socket_event, e); |
| 81 | + |
| 82 | + e->n_dns_servers = e->current_dns_server = 0; |
| 83 | +- e->next_id = (uint16_t) rand(); |
| 84 | + |
| 85 | + /* Initialize cache */ |
| 86 | + AVAHI_LLIST_HEAD_INIT(AvahiWideAreaCacheEntry, e->cache); |
| 87 | +diff --git a/configure.ac b/configure.ac |
| 88 | +index 58db8c7..ae297a9 100644 |
| 89 | +--- a/configure.ac |
| 90 | ++++ b/configure.ac |
| 91 | +@@ -368,7 +368,8 @@ AC_FUNC_SELECT_ARGTYPES |
| 92 | + # whether libc's malloc does too. (Same for realloc.) |
| 93 | + #AC_FUNC_MALLOC |
| 94 | + #AC_FUNC_REALLOC |
| 95 | +-AC_CHECK_FUNCS([gethostname memchr memmove memset mkdir select socket strchr strcspn strdup strerror strrchr strspn strstr uname setresuid setreuid setresgid setregid strcasecmp gettimeofday putenv strncasecmp strlcpy gethostbyname seteuid setegid setproctitle getprogname]) |
| 96 | ++AC_CHECK_FUNCS([gethostname memchr memmove memset mkdir select socket strchr strcspn strdup strerror strrchr strspn strstr uname setresuid setreuid setresgid setregid strcasecmp gettimeofday putenv strncasecmp strlcpy gethostbyname seteuid setegid setproctitle getprogname getrandom]) |
| 97 | ++AC_CHECK_HEADERS([sys/random.h]) |
| 98 | + |
| 99 | + AC_FUNC_CHOWN |
| 100 | + AC_FUNC_STAT |
| 101 | +-- |
| 102 | +2.45.2 |
| 103 | + |
0 commit comments