Attachment 160266 Details for Bug 250161 – Patch for CVE-2007-4045 CUPS DoS sucked from SUSE package

[patch] Patch for CVE-2007-4045 CUPS DoS sucked from SUSE package

cups-1.1.23-ssl_negotiation2.patch (text/plain), 2.32 KB, created by Lubomir Kundrak on 2007-07-30 19:34:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2007-07-30 19:34:22 UTC

Size: 2.32 KB

patch

obsolete

>diff -uNr cups-1.1.23/scheduler/client.c cups-1.1.23/scheduler/client.c
>--- cups-1.1.23/scheduler/client.c	2007-05-31 13:28:14.000000000 +0200
>+++ cups-1.1.23/scheduler/client.c	2007-05-31 03:38:12.000000000 +0200
>@@ -621,6 +633,11 @@
> 
>     if (con < (Clients + NumClients))
>       memmove(con, con + 1, (Clients + NumClients - con) * sizeof(client_t));
>+ #ifdef HAVE_SSL
>+    for (; con < (Clients + NumClients); con++)
>+      if (con->http.tls)
>+	BIO_ctrl(SSL_get_wbio(con->http.tls), BIO_C_SET_FILE_PTR, 0, (char *)HTTP(con));
>+ #endif
>   }
> 
>   return (partial);
>diff -uNr cups-1.1.23/scheduler/main.c cups-1.1.23/scheduler/main.c
>--- cups-1.1.23/scheduler/main.c	2007-05-31 13:28:14.000000000 +0200
>+++ cups-1.1.23/scheduler/main.c	2007-05-31 13:46:54.000000000 +0200
>@@ -478,14 +478,14 @@
> 
>       if (NumClients > 0)
>       {
>-        for (i = NumClients, con = Clients; i > 0; i --, con ++)
>-	  if (con->http.state == HTTP_WAITING)
>+        for (i = NumClients; i > 0; i --)
> 	  {
>-	    CloseClient(con);
>-	    con --;
>+	    con = Clients + NumClients - i;
>+	    if (con->http.state == HTTP_WAITING)
>+	      CloseClient(con);
>+	    else
>+	      con->http.keep_alive = HTTP_KEEPALIVE_OFF;
> 	  }
>-	  else
>-	    con->http.keep_alive = HTTP_KEEPALIVE_OFF;
> 
>         PauseListening();
>       }
>@@ -596,24 +596,21 @@
>       if (FD_ISSET(lis->fd, input))
>         AcceptClient(lis);
> 
>-    for (i = NumClients, con = Clients; i > 0; i --, con ++)
>+    for (i = NumClients; i > 0; i --)
>     {
>      /*
>       * Process the input buffer...
>       */
>-
>+      con = Clients + NumClients - i;
>       if (FD_ISSET(con->http.fd, input) || con->http.used)
>         if (!ReadClient(con))
>-	{
>-	  con --;
> 	  continue;
>-	}
> 
>      /*
>       * Write data as needed...
>       */
> 
>-      if (con->pipe_pid && FD_ISSET(con->file, input))
>+      if (con->pipe_pid && con->file >= 0 && FD_ISSET(con->file, input))
>       {
>        /*
>         * Keep track of pending input from the file/pipe separately
>@@ -637,10 +634,7 @@
>       if (FD_ISSET(con->http.fd, output) &&
>           (!con->pipe_pid || con->file_ready))
>         if (!WriteClient(con))
>-	{
>-	  con --;
> 	  continue;
>-	}
> 
>      /*
>       * Check the activity and close old clients...
>@@ -653,7 +647,6 @@
> 	           con->http.fd, Timeout);
> 
>         CloseClient(con);
>-        con --;
>         continue;
>       }
>     }

Actions: View | Diff

Attachments on bug 250161: 160266