Jan Engelhardt
f0c86398b7
Coturn is a STUN/TURN server which works nicely e.g. nextcloud. I'd like to offer that project in factory and Leap. Please review. If you like the package I'll request the coturn user/group for factory. OBS-URL: https://build.opensuse.org/request/show/793075 OBS-URL: https://build.opensuse.org/package/show/network:telephony/coturn?expand=0&rev=1
86 lines
2.9 KiB
Diff
86 lines
2.9 KiB
Diff
From e09bcd9f7af5b32c81b37f51835b384b5a7d03a8 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?M=C3=A9sz=C3=A1ros=20Mih=C3=A1ly?= <misi@majd.eu>
|
|
Date: Tue, 18 Feb 2020 12:31:38 +0100
|
|
Subject: [PATCH] Fix: CVE-2020-6062 / TALOS-2020-0985
|
|
|
|
---
|
|
src/apps/relay/http_server.c | 63 ++++++++++++++++++++----------------
|
|
1 file changed, 36 insertions(+), 27 deletions(-)
|
|
|
|
diff --git a/src/apps/relay/http_server.c b/src/apps/relay/http_server.c
|
|
index 1126b49c..ff8e3992 100644
|
|
--- a/src/apps/relay/http_server.c
|
|
+++ b/src/apps/relay/http_server.c
|
|
@@ -104,35 +104,44 @@ const char* get_http_date_header()
|
|
static struct headers_list * post_parse(char *data, size_t data_len)
|
|
{
|
|
while((*data=='\r')||(*data=='\n')) { ++data; --data_len; }
|
|
- char *post_data = (char*)calloc(data_len + 1, sizeof(char));
|
|
- memcpy(post_data, data, data_len);
|
|
- char *fmarker = NULL;
|
|
- char *fsplit = strtok_r(post_data, "&", &fmarker);
|
|
- struct headers_list *list = (struct headers_list*)malloc(sizeof(struct headers_list));
|
|
- ns_bzero(list,sizeof(struct headers_list));
|
|
- while (fsplit != NULL) {
|
|
- char *vmarker = NULL;
|
|
- char *key = strtok_r(fsplit, "=", &vmarker);
|
|
- char *value = strtok_r(NULL, "=", &vmarker);
|
|
- char empty[1];
|
|
- empty[0]=0;
|
|
- value = value ? value : empty;
|
|
- value = evhttp_decode_uri(value);
|
|
- char *p = value;
|
|
- while (*p) {
|
|
- if (*p == '+')
|
|
- *p = ' ';
|
|
- p++;
|
|
+ if (data_len) {
|
|
+ char *post_data = (char*)calloc(data_len + 1, sizeof(char));
|
|
+ if (post_data != NULL) {
|
|
+ memcpy(post_data, data, data_len);
|
|
+ char *fmarker = NULL;
|
|
+ char *fsplit = strtok_r(post_data, "&", &fmarker);
|
|
+ struct headers_list *list = (struct headers_list*)malloc(sizeof(struct headers_list));
|
|
+ bzero(list,sizeof(struct headers_list));
|
|
+ while (fsplit != NULL) {
|
|
+ char *vmarker = NULL;
|
|
+ char *key = strtok_r(fsplit, "=", &vmarker);
|
|
+ if (key == NULL)
|
|
+ break;
|
|
+ else {
|
|
+ char *value = strtok_r(NULL, "=", &vmarker);
|
|
+ char empty[1];
|
|
+ empty[0]=0;
|
|
+ value = value ? value : empty;
|
|
+ value = evhttp_decode_uri(value);
|
|
+ char *p = value;
|
|
+ while (*p) {
|
|
+ if (*p == '+')
|
|
+ *p = ' ';
|
|
+ p++;
|
|
+ }
|
|
+ list->keys = (char**)realloc(list->keys,sizeof(char*)*(list->n+1));
|
|
+ list->keys[list->n] = strdup(key);
|
|
+ list->values = (char**)realloc(list->values,sizeof(char*)*(list->n+1));
|
|
+ list->values[list->n] = value;
|
|
+ ++(list->n);
|
|
+ fsplit = strtok_r(NULL, "&", &fmarker);
|
|
+ }
|
|
+ }
|
|
+ free(post_data);
|
|
+ return list;
|
|
}
|
|
- list->keys = (char**)realloc(list->keys,sizeof(char*)*(list->n+1));
|
|
- list->keys[list->n] = strdup(key);
|
|
- list->values = (char**)realloc(list->values,sizeof(char*)*(list->n+1));
|
|
- list->values[list->n] = value;
|
|
- ++(list->n);
|
|
- fsplit = strtok_r(NULL, "&", &fmarker);
|
|
}
|
|
- free(post_data);
|
|
- return list;
|
|
+ return NULL;
|
|
}
|
|
|
|
static struct http_request* parse_http_request_1(struct http_request* ret, char* request, int parse_post)
|