Package: evolution-data-server Version: 3.56.2-9 Followup-For: Bug #1133124 X-Debbugs-Cc: [email protected]
Dear Maintainer, With the update to version 3.56.2-9, in which the issue still exists, the debdiff provided previously would be incorrect due to the versions. However, the patch itself still solves the issue if reapplied to the source: Description: Fix NULL dereference when broker returns no PRT SSO cookie When microsoft-identity-broker >= 3.0.1 returns an error response or omits the cookieName/cookieContent fields, json_object_get_string_member() returns NULL, causing soup_cookie_new() to return NULL. The subsequent unguarded call to soup_cookie_set_secure() then crashes with SIGSEGV in evolution-source- registry on startup. Add a NULL check after soup_cookie_new() and propagate a descriptive G_IO_ERROR_INVALID_DATA error to the caller instead. Origin: other Bug-Debian: https://bugs.debian.org/1133124 Bug: https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/635 Forwarded: https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/635 Author: Jonas <[email protected]> Last-Update: 2026-09-24 --- a/src/libedataserver/e-ms-oapxbc.c +++ b/src/libedataserver/e-ms-oapxbc.c @@ -372,6 +372,12 @@ /* [ms-oapxbc] is only supported on Microsoft Entra ID */ "login.microsoftonline.com", "/", -1); + if (!soup_cookie) { + g_set_error (error, G_IO_ERROR, G_IO_ERROR_INVALID_DATA, + _("Failed to create PRT SSO cookie: broker response missing cookieName or cookieContent")); + g_clear_object (&parser); + return NULL; + } soup_cookie_set_secure (soup_cookie, TRUE); soup_cookie_set_http_only (soup_cookie, TRUE); Thanks, Jonas. -- System Information: Debian Release: forky/sid APT prefers stable-security APT policy: (500, 'stable-security'), (500, 'unstable'), (500, 'stable'), (1, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 7.1.13+deb14-amd64 (SMP w/16 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages evolution-data-server depends on: ii evolution-data-server-common 3.56.2-9~jonas-identitybroker ii gnome-keyring 51.1-1 ii init-system-helpers 1.69+nmu3 ii libc6 2.43-6 ii libcamel-1.2-64t64 3.56.2-9~jonas-identitybroker ii libcanberra-gtk3-0 0.30-20+b1 ii libcanberra0 0.30-20+b1 ii libdb5.3t64 5.3.28+dfsg2-11+b1 ii libebackend-1.2-11t64 3.56.2-9~jonas-identitybroker ii libebook-1.2-21t64 3.56.2-9~jonas-identitybroker ii libebook-contacts-1.2-4t64 3.56.2-9~jonas-identitybroker ii libecal-2.0-3 3.56.2-9~jonas-identitybroker ii libedata-book-1.2-27t64 3.56.2-9~jonas-identitybroker ii libedata-cal-2.0-2t64 3.56.2-9~jonas-identitybroker ii libedataserver-1.2-27t64 3.56.2-9~jonas-identitybroker ii libedataserverui-1.2-4t64 3.56.2-9~jonas-identitybroker ii libglib2.0-0t64 2.90.0-1 ii libgoa-1.0-0b 3.58.1-2 ii libgtk-3-0t64 3.24.52-1 ii libgweather-4-0t64 4.4.4-5 ii libical3t64 3.0.20-3 ii libjson-glib-1.0-0 1.10.8+ds-2+b1 ii libldap2 2.6.14+dfsg-2 ii libpango-1.0-0 1.58.0-1 ii libsecret-1-0 0.21.7-2+b1 ii libsoup-3.0-0 3.6.6-1 ii libxml2-16 2.15.4+dfsg-1 ii perl 5.42.3-1 evolution-data-server recommends no packages. Versions of packages evolution-data-server suggests: ii evolution 3.56.2-10+b1 -- no debconf information
