components/network/avahi/patches/25-CVE-2021-3468.patch

   1 From 447affe29991ee99c6b9732fc5f2c1048a611d3b Mon Sep 17 00:00:00 2001
   2 From: Riccardo Schirone <sirmy15@gmail.com>
   3 Date: Fri, 26 Mar 2021 11:50:24 +0100
   4 Subject: [PATCH] Avoid infinite-loop in avahi-daemon by handling HUP event in
   5  client_work
   6
   7 If a client fills the input buffer, client_work() disables the
   8 AVAHI_WATCH_IN event, thus preventing the function from executing the
   9 `read` syscall the next times it is called. However, if the client then
  10 terminates the connection, the socket file descriptor receives a HUP
  11 event, which is not handled, thus the kernel keeps marking the HUP event
  12 as occurring. While iterating over the file descriptors that triggered
  13 an event, the client file descriptor will keep having the HUP event and
  14 the client_work() function is always called with AVAHI_WATCH_HUP but
  15 without nothing being done, thus entering an infinite loop.
  16
  17 See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984938
  18 ---
  19  avahi-daemon/simple-protocol.c | 5 +++++
  20  1 file changed, 5 insertions(+)
  21
  22 diff --git a/avahi-daemon/simple-protocol.c b/avahi-daemon/simple-protocol.c
  23 index 3e0ebb11..6c0274d6 100644
  24 --- a/avahi-daemon/simple-protocol.c
  25 +++ b/avahi-daemon/simple-protocol.c
  26 @@ -424,6 +424,11 @@ static void client_work(AvahiWatch *watch, AVAHI_GCC_UNUSED int fd, AvahiWatchEv
  27          }
  28      }
  29
  30 +    if (events & AVAHI_WATCH_HUP) {
  31 +        client_free(c);
  32 +        return;
  33 +    }
  34 +
  35      c->server->poll_api->watch_update(
  36          watch,
  37          (c->outbuf_length > 0 ? AVAHI_WATCH_OUT : 0) |
  38