Package: release.debian.org
Control: affects -1 + src:libgpod
X-Debbugs-Cc: [email protected]
User: [email protected]
Usertags: pu
Tags: trixie
X-Debbugs-Cc: [email protected]
Severity: normal
[ Reason ]
Please consider libgpod 0.8.3-22+deb13u1 for trixie.
The iphone-set-info helper passes an uninitialized service descriptor pointer
to lockdownd_start_service(). The library reads the incoming pointer and, if
non-NULL, resets descriptor fields before sending its request. A garbage
pointer can therefore cause an invalid write and crash the helper.
This is Debian #1150915, fixed in unstable 0.8.3-24. The actual trixie
0.8.3-22 source still has the uninitialized declaration. This is not a new
trixie regression: it is present at least since Debian 0.8.3-1. Ubuntu fixed
the same initialization for LP #1221031 in 2013, but lost the extra change
when dropping its API-migration patch on upgrading to 0.8.3.
[ Impact ]
Affected users can encounter an iphone-set-info crash when the helper reaches
the AFC startup path while initializing device information. Its reliability
can depend on stack contents. The update removes this invalid-pointer path.
A different bug #1120105, which describes a system-wide freeze triggered by
iphone-set-info crash, was likely due to this bug; although I cannot verify
the fix due to the lack of available iPhone devices.
[ Tests ]
Manually verified from library emulation and through static code analysis.
[ Risks ]
Minimal risk. The patch only additionally initializes a pointer to NULL.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
A patch to initialize a pointer to NULL on definition. See the attached
full debdiff.
[ Other info ]
This patch is likely the fix to RC bug https://bugs.debian.org/1120105 .
Please let me know if you have any questions.
Best Regards,
Boyuan Yang
diff -Nru libgpod-0.8.3/debian/changelog libgpod-0.8.3/debian/changelog
--- libgpod-0.8.3/debian/changelog 2024-08-15 10:13:14.000000000 -0400
+++ libgpod-0.8.3/debian/changelog 2026-10-14 13:56:29.000000000 -0400
@@ -1,3 +1,11 @@
+libgpod (0.8.3-22+deb13u1) trixie; urgency=medium
+
+ * QA upload. Backport initialization of the AFC service descriptor
+ before lockdownd_start_service() to prevent writes through an
+ uninitialized pointer in iphone-set-info. (Closes: #1150915)
+
+ -- Boyuan Yang <[email protected]> Wed, 14 Oct 2026 13:56:29 -0400
+
libgpod (0.8.3-22) unstable; urgency=medium
* QA upload
diff -Nru
libgpod-0.8.3/debian/patches/0008-Initialize-AFC-service-descriptor.patch
libgpod-0.8.3/debian/patches/0008-Initialize-AFC-service-descriptor.patch
--- libgpod-0.8.3/debian/patches/0008-Initialize-AFC-service-descriptor.patch
1969-12-31 19:00:00.000000000 -0500
+++ libgpod-0.8.3/debian/patches/0008-Initialize-AFC-service-descriptor.patch
2026-10-14 13:56:29.000000000 -0400
@@ -0,0 +1,30 @@
+From: Boyuan Yang <[email protected]>
+Date: Wed, 14 Oct 2026 11:58:14 -0400
+Subject: [PATCH] tools: Initialize the AFC service descriptor before startup
+
+lockdownd_start_service() reads the incoming descriptor pointer and resets
+its fields if it is non-NULL. Passing an uninitialized pointer can therefore
+write through an arbitrary address before a request is sent to the device.
+Initialize service to NULL so the library allocates a fresh descriptor.
+
+The same initialization was added to Ubuntu's downstream API-migration
+patch by Sebastien Bacher for LP: #1221031 in libgpod 0.8.2-7ubuntu4.
+This patch isolates that fix for the current 0.8.3 source.
+
+Forwarded: no
+Bug-Debian: https://bugs.debian.org/1150915
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1221031
+Last-Update: 2026-10-14
+
+diff --git a/tools/ipod-lockdown.c b/tools/ipod-lockdown.c
+--- a/tools/ipod-lockdown.c
++++ b/tools/ipod-lockdown.c
+@@ -157,7 +157,7 @@
+ idevice_error_t ret = IDEVICE_E_UNKNOWN_ERROR;
+ afc_error_t afc_ret;
+ #ifdef HAVE_LIBIMOBILEDEVICE_1_1_5
+- lockdownd_service_descriptor_t service;
++ lockdownd_service_descriptor_t service = NULL;
+ #else
+ uint16_t afcport = 0;
+ #endif
diff -Nru libgpod-0.8.3/debian/patches/series
libgpod-0.8.3/debian/patches/series
--- libgpod-0.8.3/debian/patches/series 2024-08-15 10:13:14.000000000 -0400
+++ libgpod-0.8.3/debian/patches/series 2026-10-14 13:56:29.000000000 -0400
@@ -6,3 +6,4 @@
0006-fix-new-libplist.patch
0007-Patch-for-newer-libplist-pkgconfig-file.patch
gcc14.patch
+0008-Initialize-AFC-service-descriptor.patch
