summaryrefslogtreecommitdiff
path: root/net-irc/bip/files/bip-CVE-2012-0806.patch
diff options
context:
space:
mode:
authorRobin H. Johnson <robbat2@gentoo.org>2015-08-08 13:49:04 -0700
committerRobin H. Johnson <robbat2@gentoo.org>2015-08-08 17:38:18 -0700
commit56bd759df1d0c750a065b8c845e93d5dfa6b549d (patch)
tree3f91093cdb475e565ae857f1c5a7fd339e2d781e /net-irc/bip/files/bip-CVE-2012-0806.patch
downloadgentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.gz
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.xz
proj/gentoo: Initial commit
This commit represents a new era for Gentoo: Storing the gentoo-x86 tree in Git, as converted from CVS. This commit is the start of the NEW history. Any historical data is intended to be grafted onto this point. Creation process: 1. Take final CVS checkout snapshot 2. Remove ALL ChangeLog* files 3. Transform all Manifests to thin 4. Remove empty Manifests 5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$ 5.1. Do not touch files with -kb/-ko keyword flags. Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed
Diffstat (limited to 'net-irc/bip/files/bip-CVE-2012-0806.patch')
-rw-r--r--net-irc/bip/files/bip-CVE-2012-0806.patch121
1 files changed, 121 insertions, 0 deletions
diff --git a/net-irc/bip/files/bip-CVE-2012-0806.patch b/net-irc/bip/files/bip-CVE-2012-0806.patch
new file mode 100644
index 00000000000..6ea26aead2b
--- /dev/null
+++ b/net-irc/bip/files/bip-CVE-2012-0806.patch
@@ -0,0 +1,121 @@
+commit 222a33cb84a2e52ad55a88900b7895bf9dd0262c
+Author: Pierre-Louis Bonicoli <pierre-louis.bonicoli@gmx.fr>
+Date: Sat Jan 7 11:41:02 2012 +0100
+
+ Buffer Overflow: check against the implicit size of select() arrays
+
+ Reported by Julien Tinnes (Fix #269)
+ exit is called when the listening socket can not be created
+
+diff --git a/src/bip.c b/src/bip.c
+index d46ee2b..b4ac706 100644
+--- a/src/bip.c
++++ b/src/bip.c
+@@ -1311,7 +1311,7 @@ int main(int argc, char **argv)
+ close(fd);
+
+ bip.listener = listen_new(conf_ip, conf_port, conf_css);
+- if (!bip.listener)
++ if (!bip.listener || bip.listener->connected == CONN_ERROR)
+ fatal("Could not create listening socket");
+
+ for (;;) {
+diff --git a/src/connection.c b/src/connection.c
+index 07ab431..5c4c24a 100644
+--- a/src/connection.c
++++ b/src/connection.c
+@@ -124,6 +124,18 @@ static void connect_trynext(connection_t *cn)
+ continue;
+ }
+
++ if (cn->handle >= FD_SETSIZE) {
++ mylog(LOG_WARN, "too many fd used, close socket %d",
++ cn->handle);
++
++ if (close(cn->handle) == -1)
++ mylog(LOG_WARN, "Error on socket close: %s",
++ strerror(errno));
++
++ cn->handle = -1;
++ break;
++ }
++
+ socket_set_nonblock(cn->handle);
+
+ if (cn->connecting_data->src) {
+@@ -789,13 +801,8 @@ list_t *wait_event(list_t *cn_list, int *msec, int *nc)
+ /*
+ * This shouldn't happen ! just in case...
+ */
+- if (cn->handle < 0) {
+- mylog(LOG_WARN, "wait_event invalid socket %d",
+- cn->handle);
+- if (cn_is_connected(cn))
+- cn->connected = CONN_ERROR;
+- continue;
+- }
++ if (cn->handle < 0 || cn->handle >= FD_SETSIZE)
++ fatal("wait_event invalid socket %d", cn->handle);
+
+ /* exceptions are OOB and disconnections */
+ FD_SET(cn->handle, &fds_except);
+@@ -966,6 +973,18 @@ static void create_listening_socket(char *hostname, char *port,
+ continue;
+ }
+
++ if (cn->handle >= FD_SETSIZE) {
++ mylog(LOG_WARN, "too many fd used, close listening socket %d",
++ cn->handle);
++
++ if (close(cn->handle) == -1)
++ mylog(LOG_WARN, "Error on socket close: %s",
++ strerror(errno));
++
++ cn->handle = -1;
++ break;
++ }
++
+ if (setsockopt(cn->handle, SOL_SOCKET, SO_REUSEADDR,
+ (char *)&multi_client,
+ sizeof(multi_client)) < 0) {
+@@ -1113,10 +1132,21 @@ connection_t *accept_new(connection_t *cn)
+
+ mylog(LOG_DEBUG, "Trying to accept new client on %d", cn->handle);
+ err = accept(cn->handle, &sa, &sa_len);
++
+ if (err < 0) {
+- mylog(LOG_ERROR, "accept failed: %s", strerror(errno));
++ fatal("accept failed: %s", strerror(errno));
++ }
++
++ if (err >= FD_SETSIZE) {
++ mylog(LOG_WARN, "too many client connected, close %d", err);
++
++ if (close(err) == -1)
++ mylog(LOG_WARN, "Error on socket close: %s",
++ strerror(errno));
++
+ return NULL;
+ }
++
+ socket_set_nonblock(err);
+
+ conn = connection_init(cn->anti_flood, cn->ssl, cn->timeout, 0);
+diff --git a/src/irc.c b/src/irc.c
+index ebc1b34..147a315 100644
+--- a/src/irc.c
++++ b/src/irc.c
+@@ -2439,9 +2439,10 @@ void bip_on_event(bip_t *bip, connection_t *conn)
+
+ if (conn == bip->listener) {
+ struct link_client *n = irc_accept_new(conn);
+- assert(n);
+- list_add_last(&bip->conn_list, CONN(n));
+- list_add_last(&bip->connecting_client_list, n);
++ if (n) {
++ list_add_last(&bip->conn_list, CONN(n));
++ list_add_last(&bip->connecting_client_list, n);
++ }
+ return;
+ }
+