summaryrefslogtreecommitdiff
path: root/gnu/packages
diff options
context:
space:
mode:
authorMarius Bakke <mbakke@fastmail.com>2017-09-20 20:50:00 +0200
committerMarius Bakke <mbakke@fastmail.com>2017-09-20 20:50:00 +0200
commita9bd50e3527d1f16cf7e70c457dd165cafeb6372 (patch)
tree40d43ddfde3db05fb4a8164d94ab4cb36977c945 /gnu/packages
parent3d695e6ae4909d012ea18828945ef4f4d73b22e3 (diff)
downloadpatches-a9bd50e3527d1f16cf7e70c457dd165cafeb6372.tar
patches-a9bd50e3527d1f16cf7e70c457dd165cafeb6372.tar.gz
gnu: bluez: Remove leftover patch.
This is a follow-up to commit 164fccea7eead86c6ebe389bc0255c72b161d109. * gnu/packages/patches/bluez-CVE-2017-1000250.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it.
Diffstat (limited to 'gnu/packages')
-rw-r--r--gnu/packages/patches/bluez-CVE-2017-1000250.patch42
1 files changed, 0 insertions, 42 deletions
diff --git a/gnu/packages/patches/bluez-CVE-2017-1000250.patch b/gnu/packages/patches/bluez-CVE-2017-1000250.patch
deleted file mode 100644
index 81f209d7b2..0000000000
--- a/gnu/packages/patches/bluez-CVE-2017-1000250.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-Description: CVE-2017-1000250: information disclosure vulnerability in service_search_attr_req
-Origin: vendor
-Bug-Debian: https://bugs.debian.org/875633
-Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1489446
-Bug-SuSE: https://bugzilla.suse.com/show_bug.cgi?id=1057342
-Forwarded: no
-Author: Armis Security <security@armis.com>
-Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
-Last-Update: 2017-09-13
-
---- a/src/sdpd-request.c
-+++ b/src/sdpd-request.c
-@@ -918,15 +918,20 @@ static int service_search_attr_req(sdp_r
- /* continuation State exists -> get from cache */
- sdp_buf_t *pCache = sdp_get_cached_rsp(cstate);
- if (pCache) {
-- uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
-- pResponse = pCache->data;
-- memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
-- buf->data_size += sent;
-- cstate->cStateValue.maxBytesSent += sent;
-- if (cstate->cStateValue.maxBytesSent == pCache->data_size)
-- cstate_size = sdp_set_cstate_pdu(buf, NULL);
-- else
-- cstate_size = sdp_set_cstate_pdu(buf, cstate);
-+ if (cstate->cStateValue.maxBytesSent >= pCache->data_size) {
-+ status = SDP_INVALID_CSTATE;
-+ SDPDBG("Got bad cstate with invalid size");
-+ } else {
-+ uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
-+ pResponse = pCache->data;
-+ memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
-+ buf->data_size += sent;
-+ cstate->cStateValue.maxBytesSent += sent;
-+ if (cstate->cStateValue.maxBytesSent == pCache->data_size)
-+ cstate_size = sdp_set_cstate_pdu(buf, NULL);
-+ else
-+ cstate_size = sdp_set_cstate_pdu(buf, cstate);
-+ }
- } else {
- status = SDP_INVALID_CSTATE;
- SDPDBG("Non-null continuation state, but null cache buffer");