diff -up sane-backends-1.0.25/frontend/saned.c.CVE-2017-6318 sane-backends-1.0.25/frontend/saned.c
--- sane-backends-1.0.25/frontend/saned.c.CVE-2017-6318 2017-03-22 09:05:09.884788366 +0100
+++ sane-backends-1.0.25/frontend/saned.c 2017-03-22 16:58:20.393869129 +0100
@@ -1986,6 +1986,38 @@ process_request (Wire * w)
return 1;
}
+ /* Addresses CVE-2017-6318 (#315576, Debian BTS #853804) */
+ /* This is done here (rather than in sanei/sanei_wire.c where
+ * it should be done) to minimize scope of impact and amount
+ * of code change.
+ */
+ if (w->direction == WIRE_DECODE
+ && req.value_type == SANE_TYPE_STRING
+ && req.action == SANE_ACTION_GET_VALUE)
+ {
+ if (req.value)
+ {
+ /* FIXME: If req.value contains embedded NUL
+ * characters, this is wrong but we do not have
+ * access to the amount of memory allocated in
+ * sanei/sanei_wire.c at this point.
+ */
+ w->allocated_memory -= (1 + strlen (req.value));
+ free (req.value);
+ }
+ req.value = malloc (req.value_size);
+ if (!req.value)
+ {
+ w->status = ENOMEM;
+ DBG (DBG_ERR,
+ "process_request: (control_option) "
+ "h=%d (%s)\n", req.handle, strerror (w->status));
+ return 1;
+ }
+ memset (req.value, 0, req.value_size);
+ w->allocated_memory += req.value_size;
+ }
+
can_authorize = 1;
memset (&reply, 0, sizeof (reply)); /* avoid leaking bits */