net-snmp/CVE-2019-20892-2.patch
2020-07-09 21:37:26 +08:00

90 lines
3.1 KiB
Diff

From 92ccd5a82a019fbfa835cc8ab2294cf0ca48c8f2 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Sat, 25 May 2019 16:33:31 +0200
Subject: [PATCH] libsnmp: Move the securityStateRef check into
free_securityStateRef()
Instead of making each free_securityStateRef() caller check the
securityStateRef pointer, move that check into free_securityStateRef().
---
agent/snmp_agent.c | 4 ++--
snmplib/snmp_api.c | 21 ++++++++++-----------
2 files changed, 12 insertions(+), 13 deletions(-)
diff --git a/agent/snmp_agent.c b/agent/snmp_agent.c
index 9d2355e33..b1881c96e 100644
--- a/agent/snmp_agent.c
+++ b/agent/snmp_agent.c
@@ -1606,9 +1606,9 @@ free_agent_snmp_session(netsnmp_agent_session *asp)
asp, asp->reqinfo));
/* Clean up securityStateRef here to prevent a double free */
- if (asp->orig_pdu && asp->orig_pdu->securityStateRef)
+ if (asp->orig_pdu)
snmp_free_securityStateRef(asp->orig_pdu);
- if (asp->pdu && asp->pdu->securityStateRef)
+ if (asp->pdu)
snmp_free_securityStateRef(asp->pdu);
if (asp->orig_pdu)
diff --git a/snmplib/snmp_api.c b/snmplib/snmp_api.c
index 36ab2d2d8..7922ea794 100644
--- a/snmplib/snmp_api.c
+++ b/snmplib/snmp_api.c
@@ -4020,7 +4020,12 @@ snmpv3_parse(netsnmp_pdu *pdu,
static void
free_securityStateRef(netsnmp_pdu* pdu)
{
- struct snmp_secmod_def *sptr = find_sec_mod(pdu->securityModel);
+ struct snmp_secmod_def *sptr;
+
+ if (!pdu->securityStateRef)
+ return;
+
+ sptr = find_sec_mod(pdu->securityModel);
if (sptr) {
if (sptr->pdu_free_state_ref) {
(*sptr->pdu_free_state_ref) (pdu->securityStateRef);
@@ -4142,9 +4147,7 @@ snmpv3_make_report(netsnmp_pdu *pdu, int error)
* FIX - yes they should but USM needs to follow new EoP to determine
* which cached values to use
*/
- if (pdu->securityStateRef) {
- free_securityStateRef(pdu);
- }
+ free_securityStateRef(pdu);
if (error == SNMPERR_USM_NOTINTIMEWINDOW) {
pdu->securityLevel = SNMP_SEC_LEVEL_AUTHNOPRIV;
@@ -5658,9 +5661,7 @@ _sess_process_packet_parse_pdu(void *sessp, netsnmp_session * sp,
/*
* Call the security model to free any securityStateRef supplied w/ msg.
*/
- if (pdu->securityStateRef != NULL) {
- free_securityStateRef(pdu);
- }
+ free_securityStateRef(pdu);
snmp_free_pdu(pdu);
return NULL;
}
@@ -5698,9 +5699,7 @@ _sess_process_packet_handle_pdu(void *sessp, netsnmp_session * sp,
/*
* Call USM to free any securityStateRef supplied with the message.
*/
- if (pdu->securityStateRef) {
- free_securityStateRef(pdu);
- }
+ free_securityStateRef(pdu);
for (rp = isp->requests; rp; orp = rp, rp = rp->next_request) {
snmp_callback callback;
@@ -5845,7 +5844,7 @@ _sess_process_packet_handle_pdu(void *sessp, netsnmp_session * sp,
/*
* Call USM to free any securityStateRef supplied with the message.
*/
- if (pdu->securityStateRef && pdu->command == SNMP_MSG_TRAP2)
+ if (pdu->command == SNMP_MSG_TRAP2)
free_securityStateRef(pdu);
if (!handled) {