coturn/coturn-4.5.1.1-cve-2020-6062.patch
Jan Engelhardt f0c86398b7 Accepting request 793075 from home:weberho:tools
Coturn is a STUN/TURN server which works nicely e.g. nextcloud. I'd like to offer that project in factory and Leap.
Please review. If you like the package I'll request the coturn user/group for factory.

OBS-URL: https://build.opensuse.org/request/show/793075
OBS-URL: https://build.opensuse.org/package/show/network:telephony/coturn?expand=0&rev=1
2020-04-11 13:08:03 +00:00

86 lines
2.9 KiB
Diff

From e09bcd9f7af5b32c81b37f51835b384b5a7d03a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A9sz=C3=A1ros=20Mih=C3=A1ly?= <misi@majd.eu>
Date: Tue, 18 Feb 2020 12:31:38 +0100
Subject: [PATCH] Fix: CVE-2020-6062 / TALOS-2020-0985
---
src/apps/relay/http_server.c | 63 ++++++++++++++++++++----------------
1 file changed, 36 insertions(+), 27 deletions(-)
diff --git a/src/apps/relay/http_server.c b/src/apps/relay/http_server.c
index 1126b49c..ff8e3992 100644
--- a/src/apps/relay/http_server.c
+++ b/src/apps/relay/http_server.c
@@ -104,35 +104,44 @@ const char* get_http_date_header()
static struct headers_list * post_parse(char *data, size_t data_len)
{
while((*data=='\r')||(*data=='\n')) { ++data; --data_len; }
- char *post_data = (char*)calloc(data_len + 1, sizeof(char));
- memcpy(post_data, data, data_len);
- char *fmarker = NULL;
- char *fsplit = strtok_r(post_data, "&", &fmarker);
- struct headers_list *list = (struct headers_list*)malloc(sizeof(struct headers_list));
- ns_bzero(list,sizeof(struct headers_list));
- while (fsplit != NULL) {
- char *vmarker = NULL;
- char *key = strtok_r(fsplit, "=", &vmarker);
- char *value = strtok_r(NULL, "=", &vmarker);
- char empty[1];
- empty[0]=0;
- value = value ? value : empty;
- value = evhttp_decode_uri(value);
- char *p = value;
- while (*p) {
- if (*p == '+')
- *p = ' ';
- p++;
+ if (data_len) {
+ char *post_data = (char*)calloc(data_len + 1, sizeof(char));
+ if (post_data != NULL) {
+ memcpy(post_data, data, data_len);
+ char *fmarker = NULL;
+ char *fsplit = strtok_r(post_data, "&", &fmarker);
+ struct headers_list *list = (struct headers_list*)malloc(sizeof(struct headers_list));
+ bzero(list,sizeof(struct headers_list));
+ while (fsplit != NULL) {
+ char *vmarker = NULL;
+ char *key = strtok_r(fsplit, "=", &vmarker);
+ if (key == NULL)
+ break;
+ else {
+ char *value = strtok_r(NULL, "=", &vmarker);
+ char empty[1];
+ empty[0]=0;
+ value = value ? value : empty;
+ value = evhttp_decode_uri(value);
+ char *p = value;
+ while (*p) {
+ if (*p == '+')
+ *p = ' ';
+ p++;
+ }
+ list->keys = (char**)realloc(list->keys,sizeof(char*)*(list->n+1));
+ list->keys[list->n] = strdup(key);
+ list->values = (char**)realloc(list->values,sizeof(char*)*(list->n+1));
+ list->values[list->n] = value;
+ ++(list->n);
+ fsplit = strtok_r(NULL, "&", &fmarker);
+ }
+ }
+ free(post_data);
+ return list;
}
- list->keys = (char**)realloc(list->keys,sizeof(char*)*(list->n+1));
- list->keys[list->n] = strdup(key);
- list->values = (char**)realloc(list->values,sizeof(char*)*(list->n+1));
- list->values[list->n] = value;
- ++(list->n);
- fsplit = strtok_r(NULL, "&", &fmarker);
}
- free(post_data);
- return list;
+ return NULL;
}
static struct http_request* parse_http_request_1(struct http_request* ret, char* request, int parse_post)