|
 |
543e63a |
diff -up sane-backends-1.0.25/frontend/saned.c.CVE-2017-6318 sane-backends-1.0.25/frontend/saned.c
|
|
|
543e63a |
--- sane-backends-1.0.25/frontend/saned.c.CVE-2017-6318 2017-03-22 09:05:09.884788366 +0100
|
|
|
543e63a |
+++ sane-backends-1.0.25/frontend/saned.c 2017-03-22 16:58:20.393869129 +0100
|
|
|
543e63a |
@@ -1986,6 +1986,38 @@ process_request (Wire * w)
|
|
|
543e63a |
return 1;
|
|
|
543e63a |
}
|
|
|
543e63a |
|
|
|
543e63a |
+ /* Addresses CVE-2017-6318 (#315576, Debian BTS #853804) */
|
|
|
543e63a |
+ /* This is done here (rather than in sanei/sanei_wire.c where
|
|
|
543e63a |
+ * it should be done) to minimize scope of impact and amount
|
|
|
543e63a |
+ * of code change.
|
|
|
543e63a |
+ */
|
|
|
543e63a |
+ if (w->direction == WIRE_DECODE
|
|
|
543e63a |
+ && req.value_type == SANE_TYPE_STRING
|
|
|
543e63a |
+ && req.action == SANE_ACTION_GET_VALUE)
|
|
|
543e63a |
+ {
|
|
|
543e63a |
+ if (req.value)
|
|
|
543e63a |
+ {
|
|
|
543e63a |
+ /* FIXME: If req.value contains embedded NUL
|
|
|
543e63a |
+ * characters, this is wrong but we do not have
|
|
|
543e63a |
+ * access to the amount of memory allocated in
|
|
|
543e63a |
+ * sanei/sanei_wire.c at this point.
|
|
|
543e63a |
+ */
|
|
|
543e63a |
+ w->allocated_memory -= (1 + strlen (req.value));
|
|
|
543e63a |
+ free (req.value);
|
|
|
543e63a |
+ }
|
|
|
543e63a |
+ req.value = malloc (req.value_size);
|
|
|
543e63a |
+ if (!req.value)
|
|
|
543e63a |
+ {
|
|
|
543e63a |
+ w->status = ENOMEM;
|
|
|
543e63a |
+ DBG (DBG_ERR,
|
|
|
543e63a |
+ "process_request: (control_option) "
|
|
|
543e63a |
+ "h=%d (%s)\n", req.handle, strerror (w->status));
|
|
|
543e63a |
+ return 1;
|
|
|
543e63a |
+ }
|
|
|
543e63a |
+ memset (req.value, 0, req.value_size);
|
|
|
543e63a |
+ w->allocated_memory += req.value_size;
|
|
|
543e63a |
+ }
|
|
|
543e63a |
+
|
|
|
543e63a |
can_authorize = 1;
|
|
|
543e63a |
|
|
|
543e63a |
memset (&reply, 0, sizeof (reply)); /* avoid leaking bits */
|