Fix CVE-2020-12049:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12049
https://lists.freedesktop.org/archives/ftp-release/2020-June/000753.html

Taken from upstream:

https://gitlab.freedesktop.org/dbus/dbus/-/commit/272d484283883fa9ff95b69d924fff6cd34842f5

diff --git a/dbus/dbus-sysdeps-unix.c b/dbus/dbus-sysdeps-unix.c
--- a/dbus/dbus-sysdeps-unix.c
+++ b/dbus/dbus-sysdeps-unix.c
@@ -435,18 +435,6 @@ _dbus_read_socket_with_unix_fds (DBusSocket        fd,
       struct cmsghdr *cm;
       dbus_bool_t found = FALSE;
 
-      if (m.msg_flags & MSG_CTRUNC)
-        {
-          /* Hmm, apparently the control data was truncated. The bad
-             thing is that we might have completely lost a couple of fds
-             without chance to recover them. Hence let's treat this as a
-             serious error. */
-
-          errno = ENOSPC;
-          _dbus_string_set_length (buffer, start);
-          return -1;
-        }
-
       for (cm = CMSG_FIRSTHDR(&m); cm; cm = CMSG_NXTHDR(&m, cm))
         if (cm->cmsg_level == SOL_SOCKET && cm->cmsg_type == SCM_RIGHTS)
           {
@@ -501,6 +489,26 @@ _dbus_read_socket_with_unix_fds (DBusSocket        fd,
       if (!found)
         *n_fds = 0;
 
+      if (m.msg_flags & MSG_CTRUNC)
+        {
+          unsigned int i;
+
+          /* Hmm, apparently the control data was truncated. The bad
+             thing is that we might have completely lost a couple of fds
+             without chance to recover them. Hence let's treat this as a
+             serious error. */
+
+          /* We still need to close whatever fds we *did* receive,
+           * otherwise they'll never get closed. (CVE-2020-12049) */
+          for (i = 0; i < *n_fds; i++)
+            close (fds[i]);
+
+          *n_fds = 0;
+          errno = ENOSPC;
+          _dbus_string_set_length (buffer, start);
+          return -1;
+        }
+
       /* put length back (doesn't actually realloc) */
       _dbus_string_set_length (buffer, start + bytes_read);
 

<div class='path'>path: <a href='/guix/log/?id=c5b4916294d693bd69ea5fe82fab6740936d6c90'>root</a>/<a href='/guix/log/nix?id=c5b4916294d693bd69ea5fe82fab6740936d6c90'>nix</a>/<a href='/guix/log/nix/libutil?id=c5b4916294d693bd69ea5fe82fab6740936d6c90'>libutil</a>/<a href='/guix/log/nix/libutil/archive.cc?id=c5b4916294d693bd69ea5fe82fab6740936d6c90'>archive.cc</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/nix/libutil/archive.cc?id=c5b4916294d693bd69ea5fe82fab6740936d6c90&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2018-12-16 16:28:07 +0100'>2018-12-16</span></td><td><a href='/guix/commit/nix/libutil/archive.cc?id=8327e733966cc4a93dfaadd1a761ca1088078baa'>daemon: Use unbranded phrases in comments and messages.</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/libstore/build.cc, nix/libstore/globals.cc,
nix/libstore/gc.cc, nix/libstore/local-store.cc,
nix/libstore/optimise-store.cc, nix/libstore/store-api.cc,
nix/libutil/archive.cc, nix/nix-daemon/nix-daemon.cc: Replace "Nix
store" by "store", and "Nix daemon" by "build daemon".
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-10-02 23:08:30 +0200'>2018-10-02</span></td><td><a href='/guix/commit/nix/libutil/archive.cc?id=7eca7892014d173ff523417138b90aeff5b7dec1'>daemon: Remove "case hack" for nars.</a><span class='msg-avail'>...<span class='msg-tooltip'>This code has never been of any use in Guix.

* nix/libutil/archive.cc (useCaseHack): Remove.
(parse): Keep only the alternate branch in "if (useCaseHack)".
</span></span></td><td>Ludovic Courtès</td></tr>