Description: Address memory corruption and information leakage
 cheery-picked from upstream git commit 42896939822b44f44ecd1b6d35afdfa4473ed35d
Author: Jörg Frings-Fürst <debian@jff-webhosting.net>
Origin: https://anonscm.debian.org/cgit/sane/sane-backends.git/commit/frontend/saned.c?id=42896939822b44f44ecd1b6d35afdfa4473ed35d
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854804
Forwarded: not-needed
Last-Update: 2017-04-19
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
Index: jessie/frontend/saned.c
===================================================================
--- jessie.orig/frontend/saned.c
+++ jessie/frontend/saned.c
@@ -1986,6 +1986,38 @@ process_request (Wire * w)
 	    return 1;
 	  }
 
+        /* Addresses CVE-2017-6318 (#315576, Debian BTS #853804) */
+        /* This is done here (rather than in sanei/sanei_wire.c where
+         * it should be done) to minimize scope of impact and amount
+         * of code change.
+         */
+        if (w->direction == WIRE_DECODE
+            && req.value_type == SANE_TYPE_STRING
+            && req.action     == SANE_ACTION_GET_VALUE)
+          {
+            if (req.value)
+              {
+                /* FIXME: If req.value contains embedded NUL
+                 *        characters, this is wrong but we do not have
+                 *        access to the amount of memory allocated in
+                 *        sanei/sanei_wire.c at this point.
+                 */
+                w->allocated_memory -= (1 + strlen (req.value));
+                free (req.value);
+              }
+            req.value = malloc (req.value_size);
+            if (!req.value)
+              {
+                w->status = ENOMEM;
+                DBG (DBG_ERR,
+                     "process_request: (control_option) "
+                     "h=%d (%s)\n", req.handle, strerror (w->status));
+                return 1;
+              }
+            memset (req.value, 0, req.value_size);
+            w->allocated_memory += req.value_size;
+          }
+
 	can_authorize = 1;
 
 	memset (&reply, 0, sizeof (reply));	/* avoid leaking bits */