aboutsummaryrefslogtreecommitdiffstats
path: root/main/dbus/cve-2011-2200.patch
blob: af3b3d1fe7a707aeeaf9585fd094d84f35eaab0e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
From c3223ba6c401ba81df1305851312a47c485e6cd7 Mon Sep 17 00:00:00 2001
From: Simon McVittie <simon.mcvittie@collabora.co.uk>
Date: Thu, 09 Jun 2011 16:52:10 +0000
Subject: _dbus_header_byteswap: change the first byte of the message, not just the struct member

This has been wrong approximately forever, for instance see:
http://lists.freedesktop.org/archives/dbus/2007-March/007357.html

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=38120
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629938
Reviewed-by: Will Thompson <will.thompson@collabora.co.uk>
---
diff --git a/dbus/dbus-marshal-header.c b/dbus/dbus-marshal-header.c
index 3f31d7a..a6c9b80 100644
--- a/dbus/dbus-marshal-header.c
+++ b/dbus/dbus-marshal-header.c
@@ -1468,14 +1468,20 @@ void
 _dbus_header_byteswap (DBusHeader *header,
                        int         new_order)
 {
+  unsigned char byte_order;
+
   if (header->byte_order == new_order)
     return;
 
+  byte_order = _dbus_string_get_byte (&header->data, BYTE_ORDER_OFFSET);
+  _dbus_assert (header->byte_order == byte_order);
+
   _dbus_marshal_byteswap (&_dbus_header_signature_str,
                           0, header->byte_order,
                           new_order,
                           &header->data, 0);
 
+  _dbus_string_set_byte (&header->data, BYTE_ORDER_OFFSET, new_order);
   header->byte_order = new_order;
 }
 
--
cgit v0.9.0.2-2-gbebe