https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=d1a5ede5d255bde8ef707f8441b997563b9312bd

From d1a5ede5d255bde8ef707f8441b997563b9312bd Mon Sep 17 00:00:00 2001
From: Nathan Crandall <ncrandall@tesla.com>
Date: Tue, 12 Jul 2022 08:56:34 +0200
Subject: gweb: Fix OOB write in received_data()

There is a mismatch of handling binary vs. C-string data with memchr
and strlen, resulting in pos, count, and bytes_read to become out of
sync and result in a heap overflow.  Instead, do not treat the buffer
as an ASCII C-string. We calculate the count based on the return value
of memchr, instead of strlen.

Fixes: CVE-2022-32292
---
 gweb/gweb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gweb/gweb.c b/gweb/gweb.c
index 12fcb1d8..13c6c5f2 100644
--- a/gweb/gweb.c
+++ b/gweb/gweb.c
@@ -918,7 +918,7 @@ static gboolean received_data(GIOChannel *channel, GIOCondition cond,
 		}
 
 		*pos = '\0';
-		count = strlen((char *) ptr);
+		count = pos - ptr;
 		if (count > 0 && ptr[count - 1] == '\r') {
 			ptr[--count] = '\0';
 			bytes_read--;
-- 
cgit 

><a href='/guix/refs/?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'>refs</a><a class='active' href='/guix/log/gnu/packages/telephony.scm'>log</a><a href='/guix/tree/gnu/packages/telephony.scm?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'>tree</a><a href='/guix/commit/gnu/packages/telephony.scm?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'>commit</a><a href='/guix/diff/gnu/packages/telephony.scm?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/telephony.scm'>
<input type='hidden' name='id' value='d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'>root</a>/<a href='/guix/log/gnu?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'>gnu</a>/<a href='/guix/log/gnu/packages?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'>packages</a>/<a href='/guix/log/gnu/packages/telephony.scm?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9'>telephony.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/telephony.scm?id=d0e3fd2dc42c3bcba96fd8e4256b1283d589d7d9&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2023-05-03 12:36:08 +0200'>2023-05-03</span></td><td><a href='/guix/commit/gnu/packages/telephony.scm?id=0cbbc1996d366ee8408898ae255085e745f3d292'>gnu: Add sipp.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/telephony.scm (sipp): New variable.

Signed-off-by: Nicolas Goaziou &lt;mail@nicolasgoaziou.fr&gt;
</span></span></td><td>Ivan Gankevich</td></tr>
<tr><td><span title='2023-04-28 08:56:48 +0800'>2023-04-28</span></td><td><a href='/guix/commit/gnu/packages/telephony.scm?id=e42117bfc9afd7650f14efd2b2def68fcbfd4e36'>gnu: mumble: Update to 1.4.287, fix build.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/telephony.scm (mumble): Update to 1.4.287.
[inputs]: Use openssl-1.1.
</span></span></td><td>宋文武</td></tr>
<tr><td><span title='2023-04-14 17:15:08 -0400'>2023-04-14</span></td><td><a href='/guix/commit/gnu/packages/telephony.scm?id=3bacd3c76a58ebe70f98be654f09cbd4166093ab'>Merge branch 'master' into core-updates.</a><span class='msg-avail'>...<span class='msg-tooltip'>Conflicts:
	gnu/local.mk
	gnu/packages/build-tools.scm
	gnu/packages/certs.scm
	gnu/packages/check.scm
	gnu/packages/compression.scm
	gnu/packages/cups.scm
	gnu/packages/fontutils.scm
	gnu/packages/gnuzilla.scm
	gnu/packages/guile.scm
	gnu/packages/ibus.scm
	gnu/packages/image-processing.scm
	gnu/packages/linux.scm
	gnu/packages/music.scm
	gnu/packages/nss.scm
	gnu/packages/pdf.scm
	gnu/packages/python-xyz.scm
	gnu/packages/qt.scm
	gnu/packages/ruby.scm
	gnu/packages/shells.scm
	gnu/packages/tex.scm
	gnu/packages/video.scm
	gnu/packages/vulkan.scm
	gnu/packages/web.scm
	gnu/packages/webkit.scm
	gnu/packages/wm.scm
</span></span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2023-03-31 13:24:48 +0200'>2023-03-31</span></td><td><a href='/guix/commit/gnu/packages/telephony.scm?id=651505807e7847b01bf6e53af8866958294d417c'>gnu: ucommon: Explicitly select C++ version.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/telephony.scm (ucommon)[arguments]: Set -std=c++14.
</span></span></td><td>Lars-Dominik Braun</td></tr>
<tr><td><span title='2023-03-28 20:16:06 -0400'>2023-03-28</span></td><td><a href='/guix/commit/gnu/packages/telephony.scm?id=846c615e15b6848c1e4c7d18146d6b40d417cf9f'>gnu: pjproject: Update to 2.13.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/telephony.scm (pjproject): Update to 2.13.
[arguments]: Disable the resolver-related tests.
</span></span></td><td>Maxim Cournoyer</td></tr>