aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches/transmission-CVE-2018-10756.patch
blob: f9bdcf60aaae2cd74e48f82a3f68081db6cabdae (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
Fix CVE-2018-10756:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10756

Patch copied from Fedora:

https://src.fedoraproject.org/rpms/transmission/blob/master/f/2123adf8e5e1c2b48791f9d22fc8c747e974180e.patch

--- a/libtransmission/variant.c	2018-05-01 12:21:08.000000000 -0500
+++ b/libtransmission/variant.c	2020-05-18 10:21:27.554214128 -0500
@@ -820,7 +820,7 @@
 struct SaveNode
 {
   const tr_variant * v;
-  tr_variant sorted;
+  tr_variant* sorted;
   size_t childIndex;
   bool isVisited;
 };
@@ -849,26 +849,33 @@
 
       qsort (tmp, n, sizeof (struct KeyIndex), compareKeyIndex);
 
-      tr_variantInitDict (&node->sorted, n);
+      node->sorted = tr_new(tr_variant, 1);
+      tr_variantInitDict (node->sorted, n);
       for (i=0; i<n; ++i)
-        node->sorted.val.l.vals[i] = *tmp[i].val;
+        node->sorted->val.l.vals[i] = *tmp[i].val;
       node->sorted.val.l.count = n;
 
       tr_free (tmp);
 
-      node->v = &node->sorted;
+      v = node->sorted;
     }
   else
     {
-      node->v = v;
+      node->sorted = NULL;
     }
+    
+    node->v = v;
 }
 
 static void
 nodeDestruct (struct SaveNode * node)
 {
-  if (node->v == &node->sorted)
-    tr_free (node->sorted.val.l.vals);
+    //TR_ASSERT(node != NULL);
+    if (node->sorted != NULL)
+    {
+        tr_free(node->sorted->val.l.vals);
+        tr_free(node->sorted);    
+    }
 }
 
 /**
--- a/libtransmission/variant.c	2020-05-18 10:21:49.000000000 -0500
+++ b/libtransmission/variant.c	2020-05-18 10:24:34.673648865 -0500
@@ -853,7 +853,7 @@
       tr_variantInitDict (node->sorted, n);
       for (i=0; i<n; ++i)
         node->sorted->val.l.vals[i] = *tmp[i].val;
-      node->sorted.val.l.count = n;
+      node->sorted->val.l.count = n;
 
       tr_free (tmp);