Package: libgconf-2-4 Version: 3.2.5-1 Severity: important Tags: upstream fixed-upstream patch Control: forwarded -1 https://bugzilla.gnome.org/show_bug.cgi?id=667167 Control: affects evolution
Dear Debian folks, the upstream GConf master branch contains a fix for a use after free in gconf-dbus [1]. This could crash Evolution/Evolution Data Server. I am going to apply that upstream patch to the Debian package. Thanks, Paul [1] http://git.gnome.org/browse/gconf/commit/?id=84884e9df7ce8c081a1c223c66a799b82545ff1e -- System Information: Debian Release: 7.0 APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 3.2.0-4-686-pae (SMP w/2 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages libgconf-2-4 depends on: ii gconf2-common 3.2.5-1 ii libc6 2.13-38 ii libdbus-1-3 1.6.8-1 ii libdbus-glib-1-2 0.100-1 ii libglib2.0-0 2.33.12+really2.32.4-5 ii multiarch-support 2.13-38 Versions of packages libgconf-2-4 recommends: ii gconf-service 3.2.5-1.1 libgconf-2-4 suggests no packages. -- no debconf information
From 84884e9df7ce8c081a1c223c66a799b82545ff1e Mon Sep 17 00:00:00 2001 From: Milan Crha <mc...@redhat.com> Date: Thu, 18 Oct 2012 16:08:02 -0400 Subject: [PATCH] gconf-dbus: fix use after free gconf_engine_get_fuller is accessing freed memory. The problem is that it's referencing strings that are owned by a D-Bus message, and they go away when the D-Bus message is freed. This commit addresses the problem by duplicating the strings and freeing them later. https://bugzilla.gnome.org/show_bug.cgi?id=667167 --- gconf/gconf-dbus-utils.c | 10 +++++----- gconf/gconf-dbus.c | 9 ++++++--- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/gconf/gconf-dbus-utils.c b/gconf/gconf-dbus-utils.c index 6fd5bfa..92f5980 100644 --- a/gconf/gconf-dbus-utils.c +++ b/gconf/gconf-dbus-utils.c @@ -569,11 +569,11 @@ gconf_dbus_utils_get_entry_values (DBusMessageIter *main_iter, gchar **schema_name_p) { DBusMessageIter struct_iter; - gchar *key; + const gchar *key; GConfValue *value; gboolean is_default; gboolean is_writable; - gchar *schema_name; + const gchar *schema_name; g_return_val_if_fail (dbus_message_iter_get_arg_type (main_iter) == DBUS_TYPE_STRUCT, FALSE); @@ -587,7 +587,7 @@ gconf_dbus_utils_get_entry_values (DBusMessageIter *main_iter, value = utils_get_value (&struct_iter); dbus_message_iter_next (&struct_iter); - schema_name = (gchar *) utils_get_optional_string (&struct_iter); + schema_name = utils_get_optional_string (&struct_iter); dbus_message_iter_next (&struct_iter); dbus_message_iter_get_basic (&struct_iter, &is_default); @@ -596,7 +596,7 @@ gconf_dbus_utils_get_entry_values (DBusMessageIter *main_iter, dbus_message_iter_get_basic (&struct_iter, &is_writable); if (key_p) - *key_p = key; + *key_p = g_strdup (key); if (value_p) *value_p = value; @@ -604,7 +604,7 @@ gconf_dbus_utils_get_entry_values (DBusMessageIter *main_iter, gconf_value_free (value); if (schema_name_p) - *schema_name_p = schema_name; + *schema_name_p = g_strdup (schema_name); if (is_default_p) *is_default_p = is_default; diff --git a/gconf/gconf-dbus.c b/gconf/gconf-dbus.c index f167fc5..5610fcf 100644 --- a/gconf/gconf-dbus.c +++ b/gconf/gconf-dbus.c @@ -1252,12 +1252,13 @@ gconf_engine_get_fuller (GConfEngine *conf, if (schema_name && schema_name[0] != '/') { + g_free (schema_name); schema_name = NULL; } if (schema_name_p) - *schema_name_p = g_strdup (schema_name); - + *schema_name_p = schema_name; + return val; } @@ -2402,7 +2403,7 @@ handle_notify (DBusConnection *connection, GConfEngine *conf2) { GConfEngine *conf; - gchar *key, *schema_name; + gchar *key = NULL, *schema_name = NULL; gboolean is_default, is_writable; DBusMessageIter iter; GConfValue *value; @@ -2466,6 +2467,8 @@ handle_notify (DBusConnection *connection, if (value) gconf_value_free (value); + g_free (key); + g_free (schema_name); if (!match) return DBUS_HANDLER_RESULT_NOT_YET_HANDLED; -- 1.7.10.4
signature.asc
Description: This is a digitally signed message part
