diff options
author | Robin H. Johnson <robbat2@gentoo.org> | 2015-08-08 13:49:04 -0700 |
---|---|---|
committer | Robin H. Johnson <robbat2@gentoo.org> | 2015-08-08 17:38:18 -0700 |
commit | 56bd759df1d0c750a065b8c845e93d5dfa6b549d (patch) | |
tree | 3f91093cdb475e565ae857f1c5a7fd339e2d781e /net-irc/bip/files/bip-CVE-2012-0806.patch | |
download | gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.gz gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.xz |
proj/gentoo: Initial commit
This commit represents a new era for Gentoo:
Storing the gentoo-x86 tree in Git, as converted from CVS.
This commit is the start of the NEW history.
Any historical data is intended to be grafted onto this point.
Creation process:
1. Take final CVS checkout snapshot
2. Remove ALL ChangeLog* files
3. Transform all Manifests to thin
4. Remove empty Manifests
5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$
5.1. Do not touch files with -kb/-ko keyword flags.
Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests
X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project
X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration
X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn
X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts
X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration
X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging
X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed
Diffstat (limited to 'net-irc/bip/files/bip-CVE-2012-0806.patch')
-rw-r--r-- | net-irc/bip/files/bip-CVE-2012-0806.patch | 121 |
1 files changed, 121 insertions, 0 deletions
diff --git a/net-irc/bip/files/bip-CVE-2012-0806.patch b/net-irc/bip/files/bip-CVE-2012-0806.patch new file mode 100644 index 00000000000..6ea26aead2b --- /dev/null +++ b/net-irc/bip/files/bip-CVE-2012-0806.patch @@ -0,0 +1,121 @@ +commit 222a33cb84a2e52ad55a88900b7895bf9dd0262c +Author: Pierre-Louis Bonicoli <pierre-louis.bonicoli@gmx.fr> +Date: Sat Jan 7 11:41:02 2012 +0100 + + Buffer Overflow: check against the implicit size of select() arrays + + Reported by Julien Tinnes (Fix #269) + exit is called when the listening socket can not be created + +diff --git a/src/bip.c b/src/bip.c +index d46ee2b..b4ac706 100644 +--- a/src/bip.c ++++ b/src/bip.c +@@ -1311,7 +1311,7 @@ int main(int argc, char **argv) + close(fd); + + bip.listener = listen_new(conf_ip, conf_port, conf_css); +- if (!bip.listener) ++ if (!bip.listener || bip.listener->connected == CONN_ERROR) + fatal("Could not create listening socket"); + + for (;;) { +diff --git a/src/connection.c b/src/connection.c +index 07ab431..5c4c24a 100644 +--- a/src/connection.c ++++ b/src/connection.c +@@ -124,6 +124,18 @@ static void connect_trynext(connection_t *cn) + continue; + } + ++ if (cn->handle >= FD_SETSIZE) { ++ mylog(LOG_WARN, "too many fd used, close socket %d", ++ cn->handle); ++ ++ if (close(cn->handle) == -1) ++ mylog(LOG_WARN, "Error on socket close: %s", ++ strerror(errno)); ++ ++ cn->handle = -1; ++ break; ++ } ++ + socket_set_nonblock(cn->handle); + + if (cn->connecting_data->src) { +@@ -789,13 +801,8 @@ list_t *wait_event(list_t *cn_list, int *msec, int *nc) + /* + * This shouldn't happen ! just in case... + */ +- if (cn->handle < 0) { +- mylog(LOG_WARN, "wait_event invalid socket %d", +- cn->handle); +- if (cn_is_connected(cn)) +- cn->connected = CONN_ERROR; +- continue; +- } ++ if (cn->handle < 0 || cn->handle >= FD_SETSIZE) ++ fatal("wait_event invalid socket %d", cn->handle); + + /* exceptions are OOB and disconnections */ + FD_SET(cn->handle, &fds_except); +@@ -966,6 +973,18 @@ static void create_listening_socket(char *hostname, char *port, + continue; + } + ++ if (cn->handle >= FD_SETSIZE) { ++ mylog(LOG_WARN, "too many fd used, close listening socket %d", ++ cn->handle); ++ ++ if (close(cn->handle) == -1) ++ mylog(LOG_WARN, "Error on socket close: %s", ++ strerror(errno)); ++ ++ cn->handle = -1; ++ break; ++ } ++ + if (setsockopt(cn->handle, SOL_SOCKET, SO_REUSEADDR, + (char *)&multi_client, + sizeof(multi_client)) < 0) { +@@ -1113,10 +1132,21 @@ connection_t *accept_new(connection_t *cn) + + mylog(LOG_DEBUG, "Trying to accept new client on %d", cn->handle); + err = accept(cn->handle, &sa, &sa_len); ++ + if (err < 0) { +- mylog(LOG_ERROR, "accept failed: %s", strerror(errno)); ++ fatal("accept failed: %s", strerror(errno)); ++ } ++ ++ if (err >= FD_SETSIZE) { ++ mylog(LOG_WARN, "too many client connected, close %d", err); ++ ++ if (close(err) == -1) ++ mylog(LOG_WARN, "Error on socket close: %s", ++ strerror(errno)); ++ + return NULL; + } ++ + socket_set_nonblock(err); + + conn = connection_init(cn->anti_flood, cn->ssl, cn->timeout, 0); +diff --git a/src/irc.c b/src/irc.c +index ebc1b34..147a315 100644 +--- a/src/irc.c ++++ b/src/irc.c +@@ -2439,9 +2439,10 @@ void bip_on_event(bip_t *bip, connection_t *conn) + + if (conn == bip->listener) { + struct link_client *n = irc_accept_new(conn); +- assert(n); +- list_add_last(&bip->conn_list, CONN(n)); +- list_add_last(&bip->connecting_client_list, n); ++ if (n) { ++ list_add_last(&bip->conn_list, CONN(n)); ++ list_add_last(&bip->connecting_client_list, n); ++ } + return; + } + |