41d68c2fd4
- Add upstream patches to fix security issues in kdeconnect (CVE-2020-26164, boo#1176268): * 0001-Do-not-leak-the-local-user-in-the-device-name.patch * 0002-Fix-use-after-free-in-LanLinkProvider-connectError.patch * 0003-Limit-identity-packets-to-8KiB.patch * 0004-Do-not-let-lanlink-connections-stay-open-for-long-wi.patch * 0005-Don-t-brute-force-reading-the-socket.patch * 0006-Limit-number-of-connected-sockets-from-unpaired-devi.patch * 0007-Do-not-remember-more-than-a-few-identity-packets-at-.patch * 0008-Limit-the-ports-we-try-to-connect-to-to-the-port-ran.patch * 0009-Do-not-replace-connections-for-a-given-deviceId-if-t.patch OBS-URL: https://build.opensuse.org/request/show/839167 OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/kdeconnect-kde?expand=0&rev=17
29 lines
1.1 KiB
Diff
29 lines
1.1 KiB
Diff
From d35b88c1b25fe13715f9170f18674d476ca9acdc Mon Sep 17 00:00:00 2001
|
|
From: Matthias Gerstner <mgerstner@suse.de>
|
|
Date: Thu, 24 Sep 2020 17:03:06 +0200
|
|
Subject: [PATCH 2/9] Fix use after free in LanLinkProvider::connectError()
|
|
|
|
If QSslSocket::connectToHost() hasn't finished running.
|
|
|
|
Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.
|
|
---
|
|
core/backends/lan/lanlinkprovider.cpp | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/core/backends/lan/lanlinkprovider.cpp b/core/backends/lan/lanlinkprovider.cpp
|
|
index fc005cee..235c221f 100644
|
|
--- a/core/backends/lan/lanlinkprovider.cpp
|
|
+++ b/core/backends/lan/lanlinkprovider.cpp
|
|
@@ -252,7 +252,7 @@ void LanLinkProvider::connectError(QAbstractSocket::SocketError socketError)
|
|
//The socket we created didn't work, and we didn't manage
|
|
//to create a LanDeviceLink from it, deleting everything.
|
|
delete m_receivedIdentityPackets.take(socket).np;
|
|
- delete socket;
|
|
+ socket->deleteLater();
|
|
}
|
|
|
|
//We received a UDP packet and answered by connecting to them by TCP. This gets called on a successful connection.
|
|
--
|
|
2.28.0
|
|
|