Merge lp:~kentb/ubuntu/trusty/openwsman/bug-1319098 into lp:ubuntu/trusty/openwsman

[Kent Baxley]

[Jamie Strandboge (jdstrand)]

Looks good except for some very minor trailing whitespace in debian/changelog. I can adjust this for the upload. Thanks!

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2014-01-24 08:45:40 +0000
+++ debian/changelog	2014-06-06 18:06:02 +0000
@@ -1,3 +1,33 @@
+openwsman (2.4.3-0ubuntu4.1) trusty-security; urgency=low
+
+  * SECURITY UPDATE: Add security fixes from upstream openwsman (LP: #1319089)
+    - debian/patches/ws-xml-make-default-prefix-buff-overflow-fix.patch:
+      ws_xml_make_default_prefix() can overflow buf parameter via sprintf()
+    - debian/patches/wsmc-create-request-fix-buff-overflow.patch:
+      wsmc_create_request() potential buf[20] overflow via WSMAN_ACTION_RENEW
+    - debian/patches/LocalSubscriptionOpUpdate-fix-fopen.patch:
+      address LocalSubscriptionOpUpdate() unchecked fopen()
+    - debian/patches/wsman-get-fault-status-sanity-guard-fix.patch:
+      Fix incorrect order of sanity guards in wsman_get_fault_status_from_doc()
+    - debian/patches/mem-allocation-wsman-init-plugins-fix.patch:
+      Fix unchecked memory allocation in wsman_init_plugins(), p->ifc
+    - debian/patches/mem-allocation-mem-double-newptr-fix.patch:
+      Fix unchecked memory allocation in mem_double(), newptr
+    - debian/patches/mem-allocation-dictionary-new-fix.patch:
+      Fix unchecked memory allocation in dictionary_new(), d, d->val, d->key, 
+      d->hash
+    - debian/patches/mem-allocation-u-error-new-fix.patch:
+      Fix unchecked memory allocation in u_error_new(), *error
+    - debian/patches/remove-unsafe-debug-call-from-sighup-handler.patch:
+      sighup_handler() in wsmand.c use of unsafe functions in a signal handler
+    - debian/patches/SHA512-password-fixes.patch:
+      Support SHA512 password encoding, use safe_cmp to prevent brute-force
+      attacks
+    - debian/patches/increase-password-upper-limit.patch:
+      increase password upper limit to 128 characters (from 64)
+           
+ -- Kent Baxley <[e-mail]>  Fri, 06 Jun 2014 12:55:02 -0500
+
 openwsman (2.4.3-0ubuntu4) trusty; urgency=low
 
   * debian/control: fix the breaks and replaces version numbers 

=== added file 'debian/patches/LocalSubscriptionOpUpdate-fix-fopen.patch'
--- debian/patches/LocalSubscriptionOpUpdate-fix-fopen.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/LocalSubscriptionOpUpdate-fix-fopen.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,74 @@
+Description: fix LocalSubscriptionOpUpdate() unchecked fopen()
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/09c3fcf4d209f6890eb9cb9e554bff637eae73b5
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+
+---
+--- openwsman-2.4.3.orig/src/lib/wsman-subscription-repository.c
++++ openwsman-2.4.3/src/lib/wsman-subscription-repository.c
+@@ -91,8 +91,12 @@ int LocalSubscriptionOpGet(char * uri_repository, char * uuid, unsigned char  **
+ 	if(LocalSubscriptionInitFlag == 0) return -1;
+ 	char *subs_path = u_strdup_printf ("%s/uuid:%s", uri_repository, uuid);
+ 	FILE *fp = fopen(subs_path, "r");
++	if (fp == NULL) {
++          fprintf(stderr, "Can't open %s: %s", subs_path, strerror(errno));
++          u_free(subs_path);
++          return -1;
++        }
+ 	u_free(subs_path);
+-	if(fp == NULL) return -1;
+ 	while(!feof(fp)) {
+ 				memset(block, 0, 512);
+ 				m = fread(block, 1, 511, fp);
+@@ -116,8 +120,12 @@ int LocalSubscriptionOpSearch(char * uri_repository, char * uuid)
+ 	if(LocalSubscriptionInitFlag == 0) return -1;
+ 	char *subs_path = u_strdup_printf ("%s/uuid:%s", uri_repository, uuid);
+ 	FILE *fp = fopen(subs_path, "r");
++	if (fp == NULL) {
++          fprintf(stderr, "Can't open %s: %s", subs_path, strerror(errno));
++          u_free(subs_path);
++          return -1;
++        }
+ 	u_free(subs_path);
+-	if(fp == NULL) return -1;
+ 	fclose(fp);
+ 	return 0;
+ }
+@@ -145,6 +153,11 @@ int LocalSubscriptionOpLoad (char * uri_repository, list_t * subscription_list)
+ 			}
+ 			char *subs_path = u_strdup_printf ("%s/%s", uri_repository, namelist[n]->d_name);
+ 			FILE *subs = fopen(subs_path, "r");
++                        if (subs == NULL) {
++                          fprintf(stderr, "Can't open %s: %s", subs_path, strerror(errno));
++                          u_free(subs_path);
++                          return -1;
++                        }
+ 			u_free(subs_path);
+ 			count = 0;
+ 			buf = NULL;
+@@ -180,7 +193,10 @@ int LocalSubscriptionOpSave (char * uri_repository, char * uuid, unsigned char *
+ 	if(LocalSubscriptionInitFlag == 0) return -1;
+ 	snprintf(buf, U_NAME_MAX, "%s/uuid:%s", uri_repository, uuid);
+ 	FILE *subsfile = fopen(buf, "w");
+-	if(subsfile == NULL) return -1;
++	if (subsfile == NULL) {
++          fprintf(stderr, "Can't open %s: %s", buf, strerror(errno));
++          return -1;
++        }
+ 	fprintf(subsfile, "%s", subscriptionDoc);
+ 	fclose(subsfile);
+ 	return 0;
+@@ -201,6 +217,10 @@ int LocalSubscriptionOpUpdate(char * uri_repository, char * uuid, char *expire)
+ 		ws_xml_set_node_text(node, expire);
+ 		ws_xml_dump_memory_enc(doc, &temp, &len, "UTF-8");
+ 		FILE *subsfile = fopen(buf, "w");
++                if (subsfile == NULL) {
++                  fprintf(stderr, "Can't open %s: %s", buf, strerror(errno));
++                  return -1;
++                }
+ 		fprintf(subsfile, "%s", temp);
+ 		fclose(subsfile);
+ 		ws_xml_free_memory(temp);
+

=== added file 'debian/patches/SHA512-password-fixes.patch'
--- debian/patches/SHA512-password-fixes.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/SHA512-password-fixes.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,82 @@
+Description: support SHA512 password encoding, use safe_cmp to prevent
+ brute-force attacks
+ .
+ SHA512 passwords needs more space than 64bytes
+ .
+ The runtime of strcmp depends on the string size, thus allows for
+ brute-force password attacks. Replace it by constant-time safe_cmp
+ when comparing usernames and passwords.
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/b1c2192f4b4fa04286dc1bb7e467b34926099720
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-05-19
+---
+--- openwsman-2.4.3.orig/src/authenticators/file/file_auth.c
++++ openwsman-2.4.3/src/authenticators/file/file_auth.c
+@@ -70,14 +70,31 @@ int initialize(void *arg) {
+     return 0;
+ }
+ 
++/*
++ * constant-time comparison to prevent brute-force attacks on authorize()
++ *
++ * returns zero only if s1 and s2 are bit-wise identical for the first len characters.
++ */
++static int
++safe_cmp(unsigned const char *s1, unsigned const char *s2, size_t len)
++{
++  size_t i = 0;
++  unsigned char result = 0;
+ 
++  while (i++ < len) {
++    result |= *s1++ ^ *s2++;
++  }
++  return result;
++}
+ 
+ int
+ authorize(char *username, const char *password)
+ {
+         int             authorized = 0;
+-        char            l[256], u[65], passwd[65];
++        char            l[256], u[65], passwd[129];
+         char *newpw = NULL ;
++        size_t username_l;
++        size_t min_len;
+ 
+         debug( "Checking basic for user: %s; password XXXXX",
+                             username);
+@@ -88,6 +105,7 @@ authorize(char *username, const char *password)
+                     username);
+                 return 0;
+         }
++        username_l = strlen(username);
+         FILE *fp = fopen(filename, "r");
+         if (!fp) {
+             debug( "Couldn't open basic passwd file %s",
+@@ -99,10 +117,20 @@ authorize(char *username, const char *password)
+                 if (sscanf(l, "%64[^:]:%64s", u, passwd) != 2)
+                     continue;       /* Ignore malformed lines */
+                 debug( "user: %s,  passwd: XXXX", u);
+-                if (!strcmp(username, u)) {
++                min_len = strlen(u);
++                if (username_l < min_len) {
++                  min_len = username_l;
++                }
++                if (!safe_cmp(username, u, min_len)) {
++                        size_t newpw_l;
++                        min_len = strlen(passwd);
+                         newpw = crypt(password, passwd);
++                        newpw_l = strlen(newpw);
++                        if (newpw_l < min_len) {
++                          min_len = newpw_l;
++                        }
+                         debug( "user: %s,  passwd: XXXXX", u );
+-                        authorized = ( strcmp (newpw, passwd) == 0 );
++                        authorized = ( safe_cmp (newpw, passwd, min_len) == 0 );
+                     break;
+                 }
+        }
+
+

=== added file 'debian/patches/increase-password-upper-limit.patch'
--- debian/patches/increase-password-upper-limit.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/increase-password-upper-limit.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,20 @@
+Subject: increase password upper limit to 128 characters (from 64)
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/9b51b3c49600846751d3e06043da53d93c62b566
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-05-21
+---
+--- openwsman-2.4.3.orig/src/authenticators/file/file_auth.c
++++ openwsman-2.4.3/src/authenticators/file/file_auth.c
+@@ -114,7 +114,7 @@ authorize(char *username, const char *password)
+         }
+ 
+         while (fgets(l, sizeof(l), fp) != NULL) {
+-                if (sscanf(l, "%64[^:]:%64s", u, passwd) != 2)
++                if (sscanf(l, "%64[^:]:%128s", u, passwd) != 2)
+                     continue;       /* Ignore malformed lines */
+                 debug( "user: %s,  passwd: XXXX", u);
+                 min_len = strlen(u);
+
+

=== added file 'debian/patches/mem-allocation-dictionary-new-fix.patch'
--- debian/patches/mem-allocation-dictionary-new-fix.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/mem-allocation-dictionary-new-fix.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,58 @@
+Description: fix unchecked memory allocation in dictionary_new(), d, d->val,
+ d->key, d->hash
+ .
+ iniparser_new might return NULL, handle this case in redirect.c
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: https://github.com/Openwsman/openwsman/commit/638abcbf5faa97ccb2c3ab15faeb2f2cc9363b56
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+---
+--- openwsman-2.4.3.orig/src/lib/u/iniparser.c
++++ openwsman-2.4.3/src/lib/u/iniparser.c
+@@ -218,11 +218,16 @@ static dictionary * dictionary_new(int size)
+     if (size<DICTMINSZ) size=DICTMINSZ ;
+ 
+     d = (dictionary *)calloc(1, sizeof(dictionary));
+-    d->size = size ;
+-    d->val  = (char **)calloc(size, sizeof(char*));
+-    d->key  = (char **)calloc(size, sizeof(char*));
+-    d->hash = (unsigned int *)calloc(size, sizeof(unsigned));
+-
++    if (d != NULL) {
++      d->size = size ;
++      d->val  = (char **)calloc(size, sizeof(char*));
++      d->key  = (char **)calloc(size, sizeof(char*));
++      d->hash = (unsigned int *)calloc(size, sizeof(unsigned));
++    }
++    if ((d == NULL) || (d->val == NULL) || (d->key == NULL) || (d->hash == NULL)) {
++      fprintf(stderr, "dictionary_new: memory allocation failure\n");
++      d = NULL;
++    }
+     return d;
+ }
+ 
+@@ -884,6 +889,8 @@ dictionary * iniparser_new(char *ininame)
+      * Initialize a new dictionary entry
+      */
+     d = dictionary_new(0);
++    if (d == NULL)
++      return d;
+     lineno = 0 ;
+     while (fgets(lin, ASCIILINESZ, ini)!=NULL) {
+         lineno++ ;
+--- openwsman-2.4.3.orig/src/plugins/redirect/redirect.c
++++ openwsman-2.4.3/src/plugins/redirect/redirect.c
+@@ -99,7 +99,10 @@ int init( void *self, void **data )
+     dictionary *ini, *inc_ini;
+     filename = (char *) wsmand_options_get_config_file();
+     ini = iniparser_new(filename);
+-
++    if (ini == NULL) {
++      error("redirect: iniparser_new failed");
++      return 0;
++    }
+     redirect_data =  malloc (sizeof(struct __Redirect_Data));
+     if (redirect_data == NULL){
+ 	error("Failed while allocating memory for redirect_data");	
+

=== added file 'debian/patches/mem-allocation-mem-double-newptr-fix.patch'
--- debian/patches/mem-allocation-mem-double-newptr-fix.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/mem-allocation-mem-double-newptr-fix.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,37 @@
+Description: fix unchecked memory allocation in mem_double(), newptr
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/89dabd4582e3fbb88328dd780e89baf6efb4ad3f
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+---
+--- openwsman-2.4.3.orig/src/lib/u/iniparser.c
++++ openwsman-2.4.3/src/lib/u/iniparser.c
+@@ -152,6 +152,10 @@ static void * mem_double(void * ptr, int size)
+     void *newptr;
+ 
+     newptr = calloc(2*size, 1);
++    if (newptr == NULL) {
++      fprintf(stderr, "mem_double: allocation failed\n");
++      return NULL;
++    }
+     memcpy(newptr, ptr, size);
+     free(ptr);
+     return newptr ;
+@@ -346,8 +350,14 @@ static void dictionary_set(dictionary * d, char * key, char * val)
+ 
+         /* Reached maximum size: reallocate blackboard */
+         d->val  = (char **)mem_double(d->val,  d->size * sizeof(char*)) ;
++        if (d->val == NULL)
++          exit(1);
+         d->key  = (char **)mem_double(d->key,  d->size * sizeof(char*)) ;
++        if (d->key == NULL)
++          exit(1);
+         d->hash = (unsigned int *)mem_double(d->hash, d->size * sizeof(unsigned)) ;
++        if (d->hash == NULL)
++          exit(1);
+ 
+         /* Double size */
+         d->size *= 2 ;
+
+

=== added file 'debian/patches/mem-allocation-u-error-new-fix.patch'
--- debian/patches/mem-allocation-u-error-new-fix.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/mem-allocation-u-error-new-fix.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,22 @@
+Description: fix unchecked memory allocation in u_error_new(), *error
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/d9b48a472819b258a34746a07256516653d5a141
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+---
+--- openwsman-2.4.3.orig/src/lib/u/uerr.c
++++ openwsman-2.4.3/src/lib/u/uerr.c
+@@ -44,6 +44,10 @@ void u_error_new(u_error_t **error, int code, const char *format, ...)
+ 		return;
+ 
+ 	*error = u_malloc(sizeof(u_error_t));
++        if (*error == NULL) {
++          fprintf(stderr, "u_error_new: memory allocation failure\n");
++          return;
++        }
+ 	(*error)->code = code;
+ 	va_start(args, format);
+ 	(*error)->message = u_strdup_vprintf(format, args);
+
+

=== added file 'debian/patches/mem-allocation-wsman-init-plugins-fix.patch'
--- debian/patches/mem-allocation-wsman-init-plugins-fix.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/mem-allocation-wsman-init-plugins-fix.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,52 @@
+Description: unchecked memory allocation in wsman_init_plugins(), p->ifc
+ return NULL if alloc fails, handle NULL return in callers
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/d51551bf791083c00105e5d8ef0b3bc24e5bb4b5
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+---
+--- openwsman-2.4.3.orig/src/lib/wsman-server.c
++++ openwsman-2.4.3/src/lib/wsman-server.c
+@@ -102,6 +102,10 @@ WsContextH wsman_init_plugins(WsManListenerH * listener)
+ 	      
+                 p->ifc = (WsDispatchInterfaceInfo *)
+                           malloc(sizeof(WsDispatchInterfaceInfo));
++                if (p->ifc == NULL) {
++                  error("Memory allocation error while loading plugin");
++                  return NULL;
++                }
+ 		ifcinfo = p->ifc;
+ 	        ifcinfo->extraData = p->data;
+ 		p->set_config = dlsym(p->p_handle, "set_config");
+--- openwsman-2.4.3.orig/src/server/wsmand-listener.c
++++ openwsman-2.4.3/src/server/wsmand-listener.c
+@@ -674,21 +674,21 @@ WsManListenerH *wsmand_start_server(dictionary * ini)
+ 	WsManListenerH *listener = wsman_dispatch_list_new();
+ 	listener->config = ini;
+ 	WsContextH cntx = wsman_init_plugins(listener);
+-        int num_threads=0;
+-        int max_threads=wsmand_options_get_max_threads();
++        int num_threads = 0;
++        int max_threads = wsmand_options_get_max_threads();
+         int max_connections_per_thread = wsmand_options_get_max_connections_per_thread();
+-        if(max_threads && !max_connections_per_thread){
++        if (max_threads && !max_connections_per_thread) {
+                 error("max_threads: %d and max_connections_per_thread : %d", max_threads, max_connections_per_thread);
+                 return listener;
+         }
+ 
++	if (cntx == NULL) {
++		return listener;
++	}
+ #ifdef ENABLE_EVENTING_SUPPORT
+ 	wsman_event_init(cntx->soap);
+ #endif
+ 
+-	if (cntx == NULL) {
+-		return listener;
+-	}
+ #ifndef HAVE_SSL
+ 	if (use_ssl) {
+ 		error("Server configured without SSL support");
+

=== added file 'debian/patches/remove-unsafe-debug-call-from-sighup-handler.patch'
--- debian/patches/remove-unsafe-debug-call-from-sighup-handler.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/remove-unsafe-debug-call-from-sighup-handler.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,19 @@
+Description: remove (unsafe) debug() call from sighup_handler
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/2cd98b07fa6930727a35da2b7409610b74535cae
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+---
+--- openwsman-2.4.3.orig/src/server/wsmand.c
++++ openwsman-2.4.3/src/server/wsmand.c
+@@ -141,8 +141,6 @@ static void signal_handler(int sig_num)
+ 
+ static void sighup_handler(int sig_num)
+ {
+-	debug("SIGHUP received; reloading data");
+-
+ 	if (wsmand_options_get_debug_level() == 0) {
+ 		int fd;
+ 
+

=== modified file 'debian/patches/series'
--- debian/patches/series	2014-01-13 12:11:37 +0000
+++ debian/patches/series	2014-06-06 18:06:02 +0000
@@ -1,1 +1,12 @@
 cmake-python-includes.patch
+ws-xml-make-default-prefix-buff-overflow-fix.patch
+wsmc-create-request-fix-buff-overflow.patch
+LocalSubscriptionOpUpdate-fix-fopen.patch
+wsman-get-fault-status-sanity-guard-fix.patch
+mem-allocation-wsman-init-plugins-fix.patch
+mem-allocation-mem-double-newptr-fix.patch
+mem-allocation-dictionary-new-fix.patch
+mem-allocation-u-error-new-fix.patch
+remove-unsafe-debug-call-from-sighup-handler.patch
+SHA512-password-fixes.patch
+increase-password-upper-limit.patch

=== added file 'debian/patches/ws-xml-make-default-prefix-buff-overflow-fix.patch'
--- debian/patches/ws-xml-make-default-prefix-buff-overflow-fix.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/ws-xml-make-default-prefix-buff-overflow-fix.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,29 @@
+Description: ws_xml_make_default_prefix() overflow fix
+ [PATCH] ws_xml_make_default_prefix() can overflow buf parameter via
+ sprintf().
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/1c21816f1d2cc63eee6326d0f1340d3341694e60
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+
+---
+--- openwsman-2.4.3.orig/src/lib/wsman-xml.c
++++ openwsman-2.4.3/src/lib/wsman-xml.c
+@@ -94,13 +94,13 @@ ws_xml_make_default_prefix(WsXmlNodeH node,
+ 		for (i = 0; g_wsNsData[i].uri != NULL; i++) {
+ 			WsXmlNsData *nsd = &g_wsNsData[i];
+ 			if (strcmp(uri, nsd->uri) == 0 && nsd->prefix) {
+-				sprintf(buf, "%s",  nsd->prefix );
++				snprintf(buf, bufsize, "%s",  nsd->prefix );
+ 				return;
+ 			}
+ 		}
+ 	}
+ 	if(g_wsNsData[i].uri == NULL && bufsize >= 12)
+-		sprintf(buf, "n%lu", ++doc->prefixIndex);
++		snprintf(buf, bufsize, "n%lu", ++doc->prefixIndex);
+ 	else
+ 		buf[0] = 0;
+ }
+

=== added file 'debian/patches/wsman-get-fault-status-sanity-guard-fix.patch'
--- debian/patches/wsman-get-fault-status-sanity-guard-fix.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/wsman-get-fault-status-sanity-guard-fix.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,64 @@
+Description: fix incorrect order of sanity guards in 
+ wsman_get_fault_status_from_doc().
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/ca68ddd7c24b238cbb94bc97ffac349ff25f07bf
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+---
+--- openwsman-2.4.3.orig/src/lib/wsman-faults.c
++++ openwsman-2.4.3/src/lib/wsman-faults.c
+@@ -607,22 +607,37 @@ void
+ wsman_get_fault_status_from_doc (WsXmlDocH doc, WsmanStatus *status)
+ {
+   int i;
+-  char *subcode_value=ws_xml_get_xpath_value(doc, FAULT_SUBCODE_VALUE_XPATH);
+-  char *subcode_value_msg =calloc(1,strlen(subcode_value));
+-  char *start_pos = strchr(subcode_value,':');
+-  strcpy(subcode_value_msg, start_pos+1); 
+-  if (strlen(subcode_value)== 0 ) return ;
++  char *subcode_value = ws_xml_get_xpath_value(doc, FAULT_SUBCODE_VALUE_XPATH);
++  char *subcode_value_msg;
++  char *start_pos;
++
++  if (strlen(subcode_value) == 0)
++    return;
++
++  subcode_value_msg = calloc(1, strlen(subcode_value));
++  if (subcode_value_msg == NULL) {
++    error("Out of memory");
++    status->fault_code = WSMAN_INTERNAL_ERROR;
++    /* some default values */
++    status->fault_detail_code = OWSMAN_SYSTEM_ERROR;
++    status->fault_msg = NULL;
++    return;
++  }
++
++  start_pos = strchr(subcode_value, ':');
++  if (start_pos != NULL) {
++    strcpy(subcode_value_msg, start_pos+1); 
+  
+-  int nfaults = sizeof (fault_code_table) / sizeof (fault_code_table[0]);
+-  for (i = 0; i < nfaults; i++) {
+-    if (strcmp (subcode_value_msg , fault_code_table[i].subCode) == 0) {
+-      status->fault_code = fault_code_table[i].fault_code;
+-      //some default values
+-      status->fault_detail_code = 0;
+-      status->fault_msg='\0';
+-      return;
++    int nfaults = sizeof (fault_code_table) / sizeof (fault_code_table[0]);
++    for (i = 0; i < nfaults; i++) {
++      if (strcmp (subcode_value_msg , fault_code_table[i].subCode) == 0) {
++        status->fault_code = fault_code_table[i].fault_code;
++        /* some default values */
++        status->fault_detail_code = 0;
++        status->fault_msg = NULL;
++        return;
++      }
+     }
+-
+   }
+   return;
+ }
+
+

=== added file 'debian/patches/wsmc-create-request-fix-buff-overflow.patch'
--- debian/patches/wsmc-create-request-fix-buff-overflow.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/wsmc-create-request-fix-buff-overflow.patch	2014-06-06 18:06:02 +0000
@@ -0,0 +1,41 @@
+Description: wsmc_create_request() buffer overflow fix
+ wsmc_create_request() correct a potential buf[20] overflow via WSMAN_ACTION_RENEW.
+Author: <[e-mail]>
+Forwarded: not-needed
+Origin: upstream, https://github.com/Openwsman/openwsman/commit/a61b2074a90c9fb3019f49b6b347ad651a3f80af
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openwsman/+bug/1319089
+Last-Update: 2014-02-27
+
+---
+--- openwsman-2.4.3.orig/src/lib/wsman-client.c
++++ openwsman-2.4.3/src/lib/wsman-client.c
+@@ -855,7 +855,6 @@ wsmc_create_request(WsManClient * cl, const char *resource_uri,
+ 	WsXmlNodeH      header;
+ 	WsXmlNodeH      node;
+ 	char           *_action = NULL;
+-	char            buf[20];
+ 	if (action == WSMAN_ACTION_IDENTIFY) {
+ 		request = ws_xml_create_envelope();
+ 	} else {
+@@ -964,14 +963,18 @@ wsmc_create_request(WsManClient * cl, const char *resource_uri,
+ 		}
+ 		break;
+ 	case WSMAN_ACTION_RENEW:
++          {
++                char buf[20];
+ 		node = ws_xml_add_child(body,
+ 				XML_NS_EVENTING, WSEVENT_RENEW, NULL);
+-		sprintf(buf, "PT%fS", options->expires);
++                /* %f default precision is 6 -> [-]ddd.ddd */
++		snprintf(buf, 20, "PT%fS", options->expires);
+ 		ws_xml_add_child(node, XML_NS_EVENTING, WSEVENT_EXPIRES, buf);
+ 		if(data) {
+ 			if(((char *)data)[0] != 0)
+ 				add_subscription_context(ws_xml_get_soap_header(request), (char *)data);
+ 		}
++          }
+ 		break;
+ 	case WSMAN_ACTION_NONE:
+ 	case WSMAN_ACTION_TRANSFER_CREATE:
+
+