]> git.ipfire.org Git - thirdparty/shairport-sync.git/commit
tinysvcmdns: fix CVE-2017-12087 620/head
authorChris Boot <bootc@bootc.net>
Thu, 23 Nov 2017 14:27:27 +0000 (14:27 +0000)
committerChris Boot <bootc@bootc.net>
Thu, 23 Nov 2017 14:36:04 +0000 (14:36 +0000)
commit5dc4c9ca149ebef8f75d0c658bf38161d781db2b
tree4d10d875f18e252f5d3aa5645274a5e4d091840e
parent0ea60e7587737b59111b8bdc441a80073653ff02
tinysvcmdns: fix CVE-2017-12087

This patch incorporates upstream's fixes for a remotely exploitable
buffer overflow bug in the bundled tinysvcmdns library. The following
upstream commits are included:

https://bitbucket.org/geekman/tinysvcmdns/commits/48c73fbb36b7a5584b00538d89c89dd8b15ab2a7
https://bitbucket.org/geekman/tinysvcmdns/commits/29ea1b9fca94dc42d16109e050d2967231b1e341

The changes have been incorporated preserving local changes such as the
check for malloc() returning NULL.

Reported against shairport-sync in Ubuntu Launchpad:
https://bugs.launchpad.net/ubuntu/+source/shairport-sync/+bug/1729668

This commit closes GitHub issue #619.
tinysvcmdns.c