forked from pool/kdeconnect-kde
Christophe Giboudeaux
41d68c2fd4
- Add upstream patches to fix security issues in kdeconnect (CVE-2020-26164, boo#1176268): * 0001-Do-not-leak-the-local-user-in-the-device-name.patch * 0002-Fix-use-after-free-in-LanLinkProvider-connectError.patch * 0003-Limit-identity-packets-to-8KiB.patch * 0004-Do-not-let-lanlink-connections-stay-open-for-long-wi.patch * 0005-Don-t-brute-force-reading-the-socket.patch * 0006-Limit-number-of-connected-sockets-from-unpaired-devi.patch * 0007-Do-not-remember-more-than-a-few-identity-packets-at-.patch * 0008-Limit-the-ports-we-try-to-connect-to-to-the-port-ran.patch * 0009-Do-not-replace-connections-for-a-given-deviceId-if-t.patch OBS-URL: https://build.opensuse.org/request/show/839167 OBS-URL: https://build.opensuse.org/package/show/KDE:Applications/kdeconnect-kde?expand=0&rev=17
43 lines
1.8 KiB
Diff
43 lines
1.8 KiB
Diff
From ae58b9dec49c809b85b5404cee17946116f8a706 Mon Sep 17 00:00:00 2001
|
|
From: Albert Vaca Cintora <albertvaka@gmail.com>
|
|
Date: Thu, 24 Sep 2020 17:13:34 +0200
|
|
Subject: [PATCH 6/9] Limit number of connected sockets from unpaired devices
|
|
|
|
Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.
|
|
---
|
|
core/backends/lan/lanlinkprovider.cpp | 11 +++++++++++
|
|
1 file changed, 11 insertions(+)
|
|
|
|
diff --git a/core/backends/lan/lanlinkprovider.cpp b/core/backends/lan/lanlinkprovider.cpp
|
|
index a4942c65..770e7866 100644
|
|
--- a/core/backends/lan/lanlinkprovider.cpp
|
|
+++ b/core/backends/lan/lanlinkprovider.cpp
|
|
@@ -46,6 +46,8 @@
|
|
|
|
#define MIN_VERSION_WITH_SSL_SUPPORT 6
|
|
|
|
+static const int MAX_UNPAIRED_CONNECTIONS = 42;
|
|
+
|
|
LanLinkProvider::LanLinkProvider(
|
|
bool testMode,
|
|
quint16 udpBroadcastPort,
|
|
@@ -555,6 +557,15 @@ void LanLinkProvider::addLink(const QString& deviceId, QSslSocket* socket, Netwo
|
|
deviceLink->reset(socket, connectionOrigin);
|
|
} else {
|
|
deviceLink = new LanDeviceLink(deviceId, this, socket, connectionOrigin);
|
|
+ // Socket disconnection will now be handled by LanDeviceLink
|
|
+ disconnect(socket, &QAbstractSocket::disconnected, socket, &QObject::deleteLater);
|
|
+ bool isDeviceTrusted = KdeConnectConfig::instance().trustedDevices().contains(deviceId);
|
|
+ if (!isDeviceTrusted && m_links.size() > MAX_UNPAIRED_CONNECTIONS) {
|
|
+ qCWarning(KDECONNECT_CORE) << "Too many unpaired devices to remember them all. Ignoring " << deviceId;
|
|
+ socket->disconnectFromHost();
|
|
+ socket->deleteLater();
|
|
+ return;
|
|
+ }
|
|
connect(deviceLink, &QObject::destroyed, this, &LanLinkProvider::deviceLinkDestroyed);
|
|
m_links[deviceId] = deviceLink;
|
|
if (m_pairingHandlers.contains(deviceId)) {
|
|
--
|
|
2.28.0
|
|
|