mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-09-27 15:04:55 +00:00
c1a5068322
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2020-13848
Upstream-Status: Accepted [c805c1de11]
CVE: CVE-2020-13848
Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
76 lines
2.5 KiB
Diff
76 lines
2.5 KiB
Diff
From c805c1de1141cb22f74c0d94dd5664bda37398e0 Mon Sep 17 00:00:00 2001
|
|
From: Marcelo Roberto Jimenez <marcelo.jimenez@gmail.com>
|
|
Date: Thu, 4 Jun 2020 12:03:03 -0300
|
|
Subject: [PATCH] Fixes #177: NULL pointer dereference in
|
|
FindServiceControlURLPath
|
|
|
|
Also fixes its dual bug in FindServiceEventURLPath.
|
|
|
|
Reference:
|
|
https://nvd.nist.gov/vuln/detail/CVE-2020-13848
|
|
|
|
Upstream-Status: Accepted [https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0]
|
|
CVE: CVE-2020-13848
|
|
Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
|
|
|
|
---
|
|
ChangeLog | 6 ++++++
|
|
upnp/src/genlib/service_table/service_table.c | 16 ++++++++++------
|
|
2 files changed, 16 insertions(+), 6 deletions(-)
|
|
diff --git a/ChangeLog b/ChangeLog
|
|
index 4a956fc..265d268 100644
|
|
--- a/ChangeLog
|
|
+++ b/ChangeLog
|
|
@@ -2,6 +2,12 @@
|
|
Version 1.8.4
|
|
*******************************************************************************
|
|
|
|
+2020-06-04 Patrik Lantz pjlantz(at)github
|
|
+
|
|
+ Fixes #177
|
|
+
|
|
+ NULL pointer dereference in FindServiceControlURLPath
|
|
+
|
|
2017-11-17 Marcelo Jimenez <mroberto(at)users.sourceforge.net>
|
|
|
|
GitHub #57 - 1.8.3 broke ABI without changing SONAME
|
|
diff --git a/upnp/src/genlib/service_table/service_table.c b/upnp/src/genlib/service_table/service_table.c
|
|
index 98c2c0f..f3ee4e5 100644
|
|
--- a/upnp/src/genlib/service_table/service_table.c
|
|
+++ b/upnp/src/genlib/service_table/service_table.c
|
|
@@ -300,12 +300,11 @@ FindServiceEventURLPath( service_table * table,
|
|
uri_type parsed_url;
|
|
uri_type parsed_url_in;
|
|
|
|
- if( ( table )
|
|
- &&
|
|
- ( parse_uri( eventURLPath,
|
|
- strlen( eventURLPath ),
|
|
- &parsed_url_in ) == HTTP_SUCCESS ) ) {
|
|
-
|
|
+ if (!table || !eventURLPath) {
|
|
+ return NULL;
|
|
+ }
|
|
+ if (parse_uri(eventURLPath, strlen(eventURLPath), &parsed_url_in) ==
|
|
+ HTTP_SUCCESS) {
|
|
finger = table->serviceList;
|
|
while( finger ) {
|
|
if( finger->eventURL )
|
|
@@ -352,11 +351,11 @@ FindServiceControlURLPath( service_table * table,
|
|
uri_type parsed_url;
|
|
uri_type parsed_url_in;
|
|
|
|
- if( ( table )
|
|
- &&
|
|
- ( parse_uri
|
|
- ( controlURLPath, strlen( controlURLPath ),
|
|
- &parsed_url_in ) == HTTP_SUCCESS ) ) {
|
|
+ if (!table || !controlURLPath) {
|
|
+ return NULL;
|
|
+ }
|
|
+ if (parse_uri(controlURLPath, strlen(controlURLPath), &parsed_url_in) ==
|
|
+ HTTP_SUCCESS) {
|
|
finger = table->serviceList;
|
|
while( finger ) {
|
|
if( finger->controlURL )
|