package/libfcgi/0006-fix-CVE-2012-6687.patch

   1 libfcgi:add security patch for CVE-2012-6687
   2 CVE-2012-6687 - remote attackers cause a denial of service (crash) via a large number
   3 of connections (http://www.cvedetails.com/cve/CVE-2012-6687/).
   4 Fix:use poll in os_unix.c instead of select to avoid problem with > 1024 connections.
   5 This patch libfcgi_2.4.0-8.3.debian.tar.xz is pulled from the below link:
   6 (https://launchpad.net/ubuntu/+source/libfcgi/2.4.0-8.3)
   7 The next release of libfcgi is 2.4.1 which may have this fix is yet to be released
   8 officially.
   9
  10 Signed-off-by: Anton Kortunov <toshic.toshic@gmail.com>
  11 Signed-off-by: Niranjan Reddy <niranjan.reddy@rockwellcollins.com>
  12
  13 Index: b/libfcgi/os_unix.c
  14 ===================================================================
  15 --- a/libfcgi/os_unix.c
  16 +++ b/libfcgi/os_unix.c
  17 @@ -42,6 +42,7 @@
  18  #include <sys/time.h>
  19  #include <sys/un.h>
  20  #include <signal.h>
  21 +#include <poll.h>
  22
  23  #ifdef HAVE_NETDB_H
  24  #include <netdb.h>
  25 @@ -103,6 +104,9 @@
  26  static int shutdownPending = FALSE;
  27  static int shutdownNow = FALSE;
  28
  29 +static int libfcgiOsClosePollTimeout = 2000;
  30 +static int libfcgiIsAfUnixKeeperPollTimeout = 2000;
  31 +
  32  void OS_ShutdownPending()
  33  {
  34      shutdownPending = TRUE;
  35 @@ -168,6 +172,16 @@
  36      if(libInitialized)
  37          return 0;
  38
  39 +    char *libfcgiOsClosePollTimeoutStr = getenv( "LIBFCGI_OS_CLOSE_POLL_TIMEOUT" );
  40 +    if(libfcgiOsClosePollTimeoutStr) {
  41 +        libfcgiOsClosePollTimeout = atoi(libfcgiOsClosePollTimeoutStr);
  42 +    }
  43 +
  44 +    char *libfcgiIsAfUnixKeeperPollTimeoutStr = getenv( "LIBFCGI_IS_AF_UNIX_KEEPER_POLL_TIMEOUT" );
  45 +    if(libfcgiIsAfUnixKeeperPollTimeoutStr) {
  46 +        libfcgiIsAfUnixKeeperPollTimeout = atoi(libfcgiIsAfUnixKeeperPollTimeoutStr);
  47 +    }
  48 +
  49      asyncIoTable = (AioInfo *)malloc(asyncIoTableSize * sizeof(AioInfo));
  50      if(asyncIoTable == NULL) {
  51          errno = ENOMEM;
  52 @@ -755,19 +769,16 @@
  53
  54      if (shutdown(fd, 1) == 0)
  55      {
  56 -        struct timeval tv;
  57 -        fd_set rfds;
  58 +        struct pollfd pfd;
  59          int rv;
  60          char trash[1024];
  61
  62 -        FD_ZERO(&rfds);
  63 +        pfd.fd = fd;
  64 +        pfd.events = POLLIN;
  65
  66          do
  67          {
  68 -            FD_SET(fd, &rfds);
  69 -            tv.tv_sec = 2;
  70 -            tv.tv_usec = 0;
  71 -            rv = select(fd + 1, &rfds, NULL, NULL, &tv);
  72 +            rv = poll(&pfd, 1, libfcgiOsClosePollTimeout);
  73          }
  74          while (rv > 0 && read(fd, trash, sizeof(trash)) > 0);
  75      }
  76 @@ -1116,13 +1127,11 @@
  77   */
  78  static int is_af_unix_keeper(const int fd)
  79  {
  80 -    struct timeval tval = { READABLE_UNIX_FD_DROP_DEAD_TIMEVAL };
  81 -    fd_set read_fds;
  82 -
  83 -    FD_ZERO(&read_fds);
  84 -    FD_SET(fd, &read_fds);
  85 +    struct pollfd pfd;
  86 +    pfd.fd = fd;
  87 +    pfd.events = POLLIN;
  88
  89 -    return select(fd + 1, &read_fds, NULL, NULL, &tval) >= 0 && FD_ISSET(fd, &read_fds);
  90 +    return poll(&pfd, 1, libfcgiIsAfUnixKeeperPollTimeout) >= 0 && (pfd.revents & POLLIN);
  91  }
  92
  93  /*
  94
  95 Index: b/examples/Makefile.am
  96 ===================================================================
  97 --- a/examples/Makefile.am
  98 +++ b/examples/Makefile.am
  99 @@ -34,5 +34,5 @@ threaded_CFLAGS    = @PTHREAD_CFLAGS@
 100  threaded_LDFLAGS   = @PTHREAD_CFLAGS@ @PTHREAD_LIBS@
 101
 102  echo_cpp_SOURCES = $(INCLUDE_FILES) $(INCLUDEDIR)/fcgio.h echo-cpp.cpp
 103 -echo_cpp_LDADD   = $(LIBDIR)/libfcgi++.la
 104 +echo_cpp_LDADD   = $(LIBDIR)/libfcgi++.la $(LIBDIR)/libfcgi.la