src/patches/beep/0008-Apply-CVE-2018-0492-from-Debian-package.patch

   1 From 3b67473e16aaf2f83cb8ac18c13c9183a8e3c7b2 Mon Sep 17 00:00:00 2001
   2 From: Hans Ulrich Niedermann <hun@n-dimensional.de>
   3 Date: Tue, 3 Apr 2018 18:37:33 +0200
   4 Subject: [PATCH] Apply CVE-2018-0492.patch from Debian package
   5
   6 ---
   7  beep.c | 53 ++++++++++++++++++++++++-----------------------------
   8  1 file changed, 24 insertions(+), 29 deletions(-)
   9
  10 diff --git a/beep.c b/beep.c
  11 index d46adc8..f6781e8 100644
  12 --- a/beep.c
  13 +++ b/beep.c
  14 @@ -109,6 +109,7 @@ void do_beep(int freq) {
  15       /* BEEP_TYPE_EVDEV */
  16       struct input_event e;
  17
  18 +     memset(&e, 0, sizeof(e));
  19       e.type = EV_SND;
  20       e.code = SND_TONE;
  21       e.value = freq;
  22 @@ -124,10 +125,6 @@ void do_beep(int freq) {
  23  /* If we get interrupted, it would be nice to not leave the speaker beeping in
  24     perpetuity. */
  25  void handle_signal(int signum) {
  26 -
  27 -  if(console_device)
  28 -    free(console_device);
  29 -
  30    switch(signum) {
  31    case SIGINT:
  32    case SIGTERM:
  33 @@ -258,7 +255,7 @@ void parse_command_line(int argc, char **argv, beep_parms_t *result) {
  34        result->verbose = 1;
  35        break;
  36      case 'e' : /* also --device */
  37 -      console_device = strdup(optarg);
  38 +      console_device = optarg;
  39        break;
  40      case 'h' : /* notice that this is also --help */
  41      default :
  42 @@ -277,26 +274,6 @@ void play_beep(beep_parms_t parms) {
  43         "%d delay after) @ %.2f Hz\n",
  44         parms.reps, parms.length, parms.delay, parms.end_delay, parms.freq);
  45
  46 -  /* try to snag the console */
  47 -  if(console_device)
  48 -    console_fd = open(console_device, O_WRONLY);
  49 -  else
  50 -    if((console_fd = open("/dev/tty0", O_WRONLY)) == -1)
  51 -      console_fd = open("/dev/vc/0", O_WRONLY);
  52 -
  53 -  if(console_fd == -1) {
  54 -    fprintf(stderr, "Could not open %s for writing\n",
  55 -      console_device != NULL ? console_device : "/dev/tty0 or /dev/vc/0");
  56 -    printf("\a");  /* Output the only beep we can, in an effort to fall back on usefulness */
  57 -    perror("open");
  58 -    exit(1);
  59 -  }
  60 -
  61 -  if (ioctl(console_fd, EVIOCGSND(0)) != -1)
  62 -    console_type = BEEP_TYPE_EVDEV;
  63 -  else
  64 -    console_type = BEEP_TYPE_CONSOLE;
  65 -
  66    /* Beep */
  67    for (i = 0; i < parms.reps; i++) {                    /* start beep */
  68      do_beep(parms.freq);
  69 @@ -306,8 +283,6 @@ void play_beep(beep_parms_t parms) {
  70      if(parms.end_delay || (i+1 < parms.reps))
  71         usleep(1000*parms.delay);                        /* wait...    */
  72    }                                                     /* repeat.    */
  73 -
  74 -  close(console_fd);
  75  }
  76
  77
  78 @@ -329,6 +304,26 @@ int main(int argc, char **argv) {
  79    signal(SIGTERM, handle_signal);
  80    parse_command_line(argc, argv, parms);
  81
  82 +  /* try to snag the console */
  83 +  if(console_device)
  84 +    console_fd = open(console_device, O_WRONLY);
  85 +  else
  86 +    if((console_fd = open("/dev/tty0", O_WRONLY)) == -1)
  87 +      console_fd = open("/dev/vc/0", O_WRONLY);
  88 +
  89 +  if(console_fd == -1) {
  90 +    fprintf(stderr, "Could not open %s for writing\n",
  91 +      console_device != NULL ? console_device : "/dev/tty0 or /dev/vc/0");
  92 +    printf("\a");  /* Output the only beep we can, in an effort to fall back on usefulness */
  93 +    perror("open");
  94 +    exit(1);
  95 +  }
  96 +
  97 +  if (ioctl(console_fd, EVIOCGSND(0)) != -1)
  98 +    console_type = BEEP_TYPE_EVDEV;
  99 +  else
 100 +    console_type = BEEP_TYPE_CONSOLE;
 101 +
 102    /* this outermost while loop handles the possibility that -n/--new has been
 103       used, i.e. that we have multiple beeps specified. Each iteration will
 104       play, then free() one parms instance. */
 105 @@ -366,8 +361,8 @@ int main(int argc, char **argv) {
 106      parms = next;
 107    }
 108
 109 -  if(console_device)
 110 -    free(console_device);
 111 +  close(console_fd);
 112 +  console_fd = -1;
 113
 114    return EXIT_SUCCESS;
 115  }
 116 --
 117 2.7.5