|
| 1 | +From 319fe039124f393a947686119ea3eafdc39d4008 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Hugo Muis <198191869+friendlyhugo@users.noreply.github.com> |
| 3 | +Date: Sun, 2 Mar 2025 18:06:24 +0100 |
| 4 | +Subject: [PATCH] core: fix uncontrolled recursion bug using a simple loop |
| 5 | + detection algorithm |
| 6 | + |
| 7 | +Closes https://github.com/avahi/avahi/issues/501 |
| 8 | + |
| 9 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 10 | +Upstream-reference: https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524.patch |
| 11 | +--- |
| 12 | + avahi-core/browse.c | 40 ++++++++++++++++++++++++++++++++++++++++ |
| 13 | + 1 file changed, 40 insertions(+) |
| 14 | + |
| 15 | +diff --git a/avahi-core/browse.c b/avahi-core/browse.c |
| 16 | +index 57435fc..d7d541b 100644 |
| 17 | +--- a/avahi-core/browse.c |
| 18 | ++++ b/avahi-core/browse.c |
| 19 | +@@ -400,6 +400,40 @@ static int lookup_go(AvahiSRBLookup *l) { |
| 20 | + return n; |
| 21 | + } |
| 22 | + |
| 23 | ++static int lookup_exists_in_path(AvahiSRBLookup* lookup, AvahiSRBLookup* from, AvahiSRBLookup* to) { |
| 24 | ++ AvahiRList* rl; |
| 25 | ++ if (from == to) |
| 26 | ++ return 0; |
| 27 | ++ for (rl = from->cname_lookups; rl; rl = rl->rlist_next) { |
| 28 | ++ int r = lookup_exists_in_path(lookup, rl->data, to); |
| 29 | ++ if (r == 1) { |
| 30 | ++ /* loop detected, propagate result */ |
| 31 | ++ return r; |
| 32 | ++ } else if (r == 0) { |
| 33 | ++ /* is loop detected? */ |
| 34 | ++ return lookup == from; |
| 35 | ++ } else { |
| 36 | ++ /* `to` not found, continue */ |
| 37 | ++ continue; |
| 38 | ++ } |
| 39 | ++ } |
| 40 | ++ /* no path found */ |
| 41 | ++ return -1; |
| 42 | ++} |
| 43 | ++ |
| 44 | ++static int cname_would_create_loop(AvahiSRBLookup* l, AvahiSRBLookup* n) { |
| 45 | ++ int ret; |
| 46 | ++ if (l == n) |
| 47 | ++ /* Loop to self */ |
| 48 | ++ return 1; |
| 49 | ++ |
| 50 | ++ ret = lookup_exists_in_path(n, l->record_browser->root_lookup, l); |
| 51 | ++ |
| 52 | ++ /* Path to n always exists */ |
| 53 | ++ assert(ret != -1); |
| 54 | ++ return ret; |
| 55 | ++} |
| 56 | ++ |
| 57 | + static void lookup_handle_cname(AvahiSRBLookup *l, AvahiIfIndex interface, AvahiProtocol protocol, AvahiLookupFlags flags, AvahiRecord *r) { |
| 58 | + AvahiKey *k; |
| 59 | + AvahiSRBLookup *n; |
| 60 | +@@ -419,6 +453,12 @@ static void lookup_handle_cname(AvahiSRBLookup *l, AvahiIfIndex interface, Avahi |
| 61 | + return; |
| 62 | + } |
| 63 | + |
| 64 | ++ if (cname_would_create_loop(l, n)) { |
| 65 | ++ /* CNAME loops are not allowed */ |
| 66 | ++ lookup_unref(n); |
| 67 | ++ return; |
| 68 | ++ } |
| 69 | ++ |
| 70 | + l->cname_lookups = avahi_rlist_prepend(l->cname_lookups, lookup_ref(n)); |
| 71 | + |
| 72 | + lookup_go(n); |
| 73 | +-- |
| 74 | +2.45.4 |
| 75 | + |
0 commit comments