Your message dated Fri, 01 Mar 2013 05:02:30 +0000 with message-id <[email protected]> and subject line Bug#700805: fixed in openconnect 3.20-4 has caused the Debian Bug report #700805, regarding openconnect: Fix for CVE-2012-6128 causes memory leak on error to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 700805: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700805 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: openconnect Version: 3.20-3 Severity: normal ++ ++static void buf_append(struct oc_text_buf *buf, const char *fmt, ...) ++{ ++ va_list ap; [...] ++ ++ buf->data = realloc(buf->data, new_buf_len); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ++ if (!buf->data) { ++ buf->error = -ENOMEM; ++ break; ++ } ++ buf->buf_len = new_buf_len; If realloc fails, it will return NULL but without freeing the original buffer. This means the marked code will leak the (old) buf->data on error. ~Niels
--- End Message ---
--- Begin Message ---Source: openconnect Source-Version: 3.20-4 We believe that the bug you reported is fixed in the latest version of openconnect, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Mike Miller <[email protected]> (supplier of updated openconnect package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Thu, 28 Feb 2013 23:42:31 -0500 Source: openconnect Binary: openconnect libopenconnect1 libopenconnect-dev Architecture: source amd64 Version: 3.20-4 Distribution: unstable Urgency: low Maintainer: Mike Miller <[email protected]> Changed-By: Mike Miller <[email protected]> Description: libopenconnect-dev - Open client for Cisco AnyConnect VPN - development files libopenconnect1 - Open client for Cisco AnyConnect VPN - shared library openconnect - Open client for Cisco AnyConnect VPN Closes: 700805 Changes: openconnect (3.20-4) unstable; urgency=low . * debian/patches/03_fix-abuse-of-realloc.patch: Backport patch from upstream to fix possible memory leaks on realloc. (Closes: #700805) Checksums-Sha1: 2eb28bd3ac9fc8d7733dd8b6d69dd3bcca23305f 2070 openconnect_3.20-4.dsc f3bf5b9532eb0edd380999040f2422b89084a289 8718 openconnect_3.20-4.debian.tar.gz e30b5e67bf0e1046e399526fd68b32e1e84167aa 197630 openconnect_3.20-4_amd64.deb 0bc3c28316592ba287090b93fbdb1a61f9c0cd9e 43566 libopenconnect1_3.20-4_amd64.deb 9632900dfa05f2d9c6363ca09ab519a7254b84cf 17938 libopenconnect-dev_3.20-4_amd64.deb Checksums-Sha256: ffc10e06b17c0a7c988c50e689bfcdb9318b3a233047193fe44af74a906b182c 2070 openconnect_3.20-4.dsc 98e7a83ae2df4303b1f73da21147b5f97e3414a86348e9f902f60f50901bed34 8718 openconnect_3.20-4.debian.tar.gz 102114d1233a214e34023965775621a4b1b7d0a2c9ea35ba263d2751b848c0e1 197630 openconnect_3.20-4_amd64.deb 86bf89ebdd970305c98a7dfa6ea41f8f6c16cf2b9a1c4258f62352196d738077 43566 libopenconnect1_3.20-4_amd64.deb c48658422aa693437fe0b1d50c6cb7a1f5e850d406596fe411ba35f8bcb5fe05 17938 libopenconnect-dev_3.20-4_amd64.deb Files: c1ae72bf7b949ff9dd8ba8183f3f6b0e 2070 net optional openconnect_3.20-4.dsc e3c4d412b7cf7149e670f0de237797ea 8718 net optional openconnect_3.20-4.debian.tar.gz c2c739f3d3f0391161effd8ed07f8f30 197630 net optional openconnect_3.20-4_amd64.deb 45c1f8881c43ad669323b596ef93a08a 43566 libs optional libopenconnect1_3.20-4_amd64.deb db391a88293f166b488d2d0f77a1474a 17938 libdevel optional libopenconnect-dev_3.20-4_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBCAAGBQJRMDNoAAoJECj6gBpDvdY3VuUQALzfARrC99fUVr5S7CkqD5c5 0UuBsgKZl3fF6DGBMuyzLqej6jzBl41jnC7U2s6o8m72w6S+oy+V/z0rqGR9S+Nt qMNSQp7trmuz3IZdMMAVuwEG4YJ8INa8XQIjbv8toUE811vvSkyf8Copv7VQu0aC FHhfDl3QlC8NL2XT0J8GM/R7SDxYKHHe+CBSk8B8QfYZUphlhd+P2qr11+YATy1O mHmxr7zACrpCm/SiDX04vtsfDutZM6Z+Lg2DU/UVqtp8aJSTkeYVoCpryMViB4Wa yeiCz1sZM0Hu2v+mtKs5pGYCOjjbQJgKwaDwL0wk9bQKsFzJwiYxA2Q9UG65Ou0k Hnm5l70uaqXQwOqM3+/7bcTSEmOwX0+UKVkQ4o7Cch7W+iMVjkEbzdyWASabMjZb bqmVo2BPONW0aVjEppzSjip0y9xJ2AULxcfN+mNF09O+RUSd5IqA/l3hxbK50Rab 1WurcaufcHTnjnKHuSbHUXrW+usiOvk/qkZF/Iwc548FYmFPsQXjUpq34rvOStGe sxRjaOzOhT5suZgUNolyTYViBPGNHGAQuGTeRAUJvZnCtq9L2jbFHRCDNaO3ZWDH BYNkX0bPB5e3ABSqLoQ+2wavvNrstHhQeYkT3w52u/vVY2ISJhLbE5pjZ1cDrP7u BmlXHuGXhcsxjbFd64XM =5wkE -----END PGP SIGNATURE-----
--- End Message ---
