Control: tags 1014534 + patch
Control: tags 1014534 + pending
Dear maintainer,
I've prepared an NMU for dlt-daemon (versioned as 2.18.6-2.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I should
cancel it.
cu
Adrian
diff -Nru dlt-daemon-2.18.6/debian/changelog dlt-daemon-2.18.6/debian/changelog
--- dlt-daemon-2.18.6/debian/changelog 2021-04-06 19:35:22.000000000 +0300
+++ dlt-daemon-2.18.6/debian/changelog 2022-08-18 19:39:48.000000000 +0300
@@ -1,3 +1,11 @@
+dlt-daemon (2.18.6-2.1) unstable; urgency=high
+
+ * Non-maintainer upload.
+ * CVE-2022-31291: Double free in dlt_config_file_set_section().
+ (Closes: #1014534)
+
+ -- Adrian Bunk <b...@debian.org> Thu, 18 Aug 2022 19:39:48 +0300
+
dlt-daemon (2.18.6-2) unstable; urgency=medium
* Enable and run unit tests during build step:
diff -Nru dlt-daemon-2.18.6/debian/patches/0001-Fix-a-double-free-bug.patch dlt-daemon-2.18.6/debian/patches/0001-Fix-a-double-free-bug.patch
--- dlt-daemon-2.18.6/debian/patches/0001-Fix-a-double-free-bug.patch 1970-01-01 02:00:00.000000000 +0200
+++ dlt-daemon-2.18.6/debian/patches/0001-Fix-a-double-free-bug.patch 2022-08-18 19:36:47.000000000 +0300
@@ -0,0 +1,29 @@
+From 6a3bd901d825c7206797e36ea98e10a218f5aad2 Mon Sep 17 00:00:00 2001
+From: Safe-BCY <512234...@qq.com>
+Date: Thu, 5 May 2022 06:47:17 +0800
+Subject: Fix a double-free bug.
+
+In the dlt_config_file_set_section function of dlt_config_file_parser.c:
+ s-name is not set to null after free.
+ It will be freed again in the dlt_config_file_release function.
+
+Signed-off-by: Zhongyang.Bao <zhongyang....@zeekrlife.com>
+---
+ src/shared/dlt_config_file_parser.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/shared/dlt_config_file_parser.c b/src/shared/dlt_config_file_parser.c
+index 009a093..fc2d516 100644
+--- a/src/shared/dlt_config_file_parser.c
++++ b/src/shared/dlt_config_file_parser.c
+@@ -148,6 +148,7 @@ static int dlt_config_file_set_section(DltConfigFile *file, char *name)
+
+ if (s->keys == NULL) {
+ free(s->name);
++ s->name = NULL;
+ dlt_log(LOG_ERR, "Cannot allocate memory for internal data structure\n");
+ return -1;
+ }
+--
+2.20.1
+
diff -Nru dlt-daemon-2.18.6/debian/patches/series dlt-daemon-2.18.6/debian/patches/series
--- dlt-daemon-2.18.6/debian/patches/series 2021-04-06 19:32:39.000000000 +0300
+++ dlt-daemon-2.18.6/debian/patches/series 2022-08-18 19:39:48.000000000 +0300
@@ -1 +1,2 @@
find-gtest.patch
+0001-Fix-a-double-free-bug.patch
