gnu/packages/patches/transmission-CVE-2018-10756.patch

   1 Fix CVE-2018-10756:
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10756
   4
   5 Patch copied from Fedora:
   6
   7 https://src.fedoraproject.org/rpms/transmission/blob/master/f/2123adf8e5e1c2b48791f9d22fc8c747e974180e.patch
   8
   9 --- a/libtransmission/variant.c 2018-05-01 12:21:08.000000000 -0500
  10 +++ b/libtransmission/variant.c 2020-05-18 10:21:27.554214128 -0500
  11 @@ -820,7 +820,7 @@
  12  struct SaveNode
  13  {
  14    const tr_variant * v;
  15 -  tr_variant sorted;
  16 +  tr_variant* sorted;
  17    size_t childIndex;
  18    bool isVisited;
  19  };
  20 @@ -849,26 +849,33 @@
  21
  22        qsort (tmp, n, sizeof (struct KeyIndex), compareKeyIndex);
  23
  24 -      tr_variantInitDict (&node->sorted, n);
  25 +      node->sorted = tr_new(tr_variant, 1);
  26 +      tr_variantInitDict (node->sorted, n);
  27        for (i=0; i<n; ++i)
  28 -        node->sorted.val.l.vals[i] = *tmp[i].val;
  29 +        node->sorted->val.l.vals[i] = *tmp[i].val;
  30        node->sorted.val.l.count = n;
  31
  32        tr_free (tmp);
  33
  34 -      node->v = &node->sorted;
  35 +      v = node->sorted;
  36      }
  37    else
  38      {
  39 -      node->v = v;
  40 +      node->sorted = NULL;
  41      }
  42 +
  43 +    node->v = v;
  44  }
  45
  46  static void
  47  nodeDestruct (struct SaveNode * node)
  48  {
  49 -  if (node->v == &node->sorted)
  50 -    tr_free (node->sorted.val.l.vals);
  51 +    //TR_ASSERT(node != NULL);
  52 +    if (node->sorted != NULL)
  53 +    {
  54 +        tr_free(node->sorted->val.l.vals);
  55 +        tr_free(node->sorted);
  56 +    }
  57  }
  58
  59  /**
  60 --- a/libtransmission/variant.c 2020-05-18 10:21:49.000000000 -0500
  61 +++ b/libtransmission/variant.c 2020-05-18 10:24:34.673648865 -0500
  62 @@ -853,7 +853,7 @@
  63        tr_variantInitDict (node->sorted, n);
  64        for (i=0; i<n; ++i)
  65          node->sorted->val.l.vals[i] = *tmp[i].val;
  66 -      node->sorted.val.l.count = n;
  67 +      node->sorted->val.l.count = n;
  68
  69        tr_free (tmp);
  70
  71