Merge ~ahasenack/ubuntu/+source/ipmitool:disco-segfault-1817307 into ubuntu/+source/ipmitool:ubuntu/devel

[Andreas Hasenack]

Patch found in upstream's git repo, and confirmed by the reporter to fix the segfault. I don't have a way to reproduce it atm, though.

Reporter will try other releases. Based on the version, it should at least happen in bionic as well. I will prepare branches for those once this lands, and if we get confirmation of the problem in the other ubuntu releases.

The upstream patch applies with offset, but I checked and the change is inserted in the correct places. Because of that I chose to not refresh the patch and keep it like it was committed upstream. If you prefer, however, I can refresh it and use our normal full DEP3 header instead of the github "add .patch to the url" trick.

[Christian Ehrhardt  (paelzer)]

Generally LGTM, but one thing - the patch has no dep-3 headers at all.
It is just the upstream patch as is.

Once that is fixed feel free to self-approve and upload as the rest really is ok.

Furthermore since they seem to release [1] rareley or lets call it sporadic let us bother Manoj to also report that to Debian.

[1]: https://github.com/pjdhpe/ipmitool/releases

review: Needs Fixing

[Christian Ehrhardt  (paelzer)]

I did the "bothering" :-)

[Andreas Hasenack (ahasenack)]

Hm, I forgot to push, uups

[Andreas Hasenack (ahasenack)]

There

[Andreas Hasenack (ahasenack)]

self +1

review: Approve

[Andreas Hasenack (ahasenack)]

Tagged and uploaded:
$ git push pkg upload/1.8.18-6ubuntu1
Enumerating objects: 21, done.
Counting objects: 100% (21/21), done.
Delta compression using up to 4 threads
Compressing objects: 100% (15/15), done.
Writing objects: 100% (15/15), 2.61 KiB | 667.00 KiB/s, done.
Total 15 (delta 10), reused 0 (delta 0)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/ipmitool
 * [new tag] upload/1.8.18-6ubuntu1 -> upload/1.8.18-6ubuntu1

$ dput ubuntu ../ipmitool_1.8.18-6ubuntu1_source.changes
Checking signature on .changes
gpg: ../ipmitool_1.8.18-6ubuntu1_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../ipmitool_1.8.18-6ubuntu1.dsc: Valid signature from AC983EB5BF6BCBA9
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading ipmitool_1.8.18-6ubuntu1.dsc: done.
  Uploading ipmitool_1.8.18-6ubuntu1.debian.tar.xz: done.
  Uploading ipmitool_1.8.18-6ubuntu1_source.buildinfo: done.
  Uploading ipmitool_1.8.18-6ubuntu1_source.changes: done.
Successfully uploaded packages.

[Christian Ehrhardt  (paelzer)]

LGTM now, thanks!

diff --git a/debian/changelog b/debian/changelog
index 5c14961..be80ee8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ipmitool (1.8.18-6ubuntu1) disco; urgency=medium
+
+  * d/p/0130-fix-segfault.patch: Correct lanplus segment violation for
+    truncated response. (LP: #1817307)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 28 Feb 2019 11:21:41 -0300
+
 ipmitool (1.8.18-6build1) disco; urgency=medium
 
   * No-change rebuild for readline soname change.
diff --git a/debian/control b/debian/control
index 2b6d4c3..eb59734 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: ipmitool
 Section: utils
 Priority: optional
-Maintainer: Jörg Frings-Fürst <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Jörg Frings-Fürst <[e-mail]>
 Build-Depends:
  debhelper (>> 11),
  libncurses-dev,
diff --git a/debian/patches/0130-fix-segfault.patch b/debian/patches/0130-fix-segfault.patch
 new file mode 100644
index 0000000..c8aaa06
--- /dev/null
+++ b/debian/patches/0130-fix-segfault.patch
@@ -0,0 +1,47 @@
+From 815aae70cf8dc9f0e1ba1923fc4ec3cc16d0d2f1 Mon Sep 17 00:00:00 2001
+From: pjdhpe <[e-mail]>
+Date: Wed, 28 Nov 2018 07:27:29 -0600
+Subject: [PATCH] Correct lanplus segment violation for truncated response.
+
+Correct segment violation in lanplus from dcmi truncated response.
+
+ This corrects Issue #72.
+    On occasion a dcmi power reading will return error C6, and a
+    truncated response payload. As the decrypted payload is shorter
+    than the expected length, lanplus_decrypt_aes_cbc_128() adjusts
+    the payload_size downward by one byte. In ipmi_lan_poll_single()
+    the calculation to determine if the payload size has increased
+    erroniously sets extra_data_length to -1, with a subsequent
+    segv when calling a memmove to shift response data.
+    The fix is to check for a positive value in the extra_data_length.
+
+Origin: upstream, https://github.com/pjdhpe/ipmitool/commit/815aae70cf8dc9f0e1ba1923fc4ec3cc16d0d2f1
+Bug: https://github.com/ipmitool/ipmitool/issues/72
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ipmitool/+bug/1817307
+Last-Update: 2019-02-28
+---
+ src/plugins/lanplus/lanplus.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/plugins/lanplus/lanplus.c b/src/plugins/lanplus/lanplus.c
+index b7dfc3d9..d3e4e91b 100644
+--- a/src/plugins/lanplus/lanplus.c
++++ b/src/plugins/lanplus/lanplus.c
+@@ -792,7 +792,7 @@ ipmi_lan_poll_single(struct ipmi_intf * intf)
+ 			 * rsp->data_len becomes the length of that data
+ 			 */
+ 			extra_data_length = payload_size - (offset - payload_start) - 1;
+-			if (extra_data_length) {
++			if (extra_data_length > 0) {
+ 				rsp->data_len = extra_data_length;
+ 				memmove(rsp->data, rsp->data + offset, extra_data_length);
+ 			} else {
+@@ -846,7 +846,7 @@ ipmi_lan_poll_single(struct ipmi_intf * intf)
+ 		}
+ 		read_sol_packet(rsp, &offset);
+ 		extra_data_length = payload_size - (offset - payload_start);
+-		if (rsp && extra_data_length) {
++		if (rsp && extra_data_length > 0) {
+ 			rsp->data_len = extra_data_length;
+ 			memmove(rsp->data, rsp->data + offset, extra_data_length);
+ 		} else {
diff --git a/debian/patches/series b/debian/patches/series
index 80f7a3c..c4a885b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -9,3 +9,4 @@
 0110-getpass-prototype.patch
 0115-typo.patch
 0125-nvidia-iana.patch
+0130-fix-segfault.patch