summaryrefslogtreecommitdiff
path: root/gnu/packages/patches/icecat-CVE-2014-1587-bug-1079729.patch
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches/icecat-CVE-2014-1587-bug-1079729.patch')
-rw-r--r--gnu/packages/patches/icecat-CVE-2014-1587-bug-1079729.patch191
1 files changed, 191 insertions, 0 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2014-1587-bug-1079729.patch b/gnu/packages/patches/icecat-CVE-2014-1587-bug-1079729.patch
new file mode 100644
index 0000000000..3ef60baaad
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2014-1587-bug-1079729.patch
@@ -0,0 +1,191 @@
+commit 5de6730cc26744b9efcf4d4adb4a4c45023ef8a0
+Author: Randell Jesup <rjesup@jesup.org>
+Date: Tue Oct 28 11:06:00 2014 -0400
+
+ Bug 1079729: Fix handling of increasing number of SCTP channels used by DataChannels r=tuexen a=lsblakk
+
+ Modified media/webrtc/signaling/src/sipcc/core/gsm/h/fsm.h
+diff --git a/media/webrtc/signaling/src/sipcc/core/gsm/h/fsm.h b/media/webrtc/signaling/src/sipcc/core/gsm/h/fsm.h
+index ba8e1ff..8d964f1 100755
+--- a/media/webrtc/signaling/src/sipcc/core/gsm/h/fsm.h
++++ b/media/webrtc/signaling/src/sipcc/core/gsm/h/fsm.h
+@@ -225,7 +225,7 @@ typedef struct fsmdef_media_t_ {
+ /*
+ * Data Channel properties
+ */
+-#define WEBRTC_DATACHANNEL_STREAMS_DEFAULT 16
++#define WEBRTC_DATACHANNEL_STREAMS_DEFAULT 256
+ uint32 datachannel_streams;
+ char datachannel_protocol[SDP_MAX_STRING_LEN + 1];
+
+ Modified netwerk/sctp/datachannel/DataChannel.cpp
+diff --git a/netwerk/sctp/datachannel/DataChannel.cpp b/netwerk/sctp/datachannel/DataChannel.cpp
+index 414e3db..a00d938 100644
+--- a/netwerk/sctp/datachannel/DataChannel.cpp
++++ b/netwerk/sctp/datachannel/DataChannel.cpp
+@@ -910,10 +910,12 @@ DataChannelConnection::RequestMoreStreams(int32_t aNeeded)
+ uint32_t outStreamsNeeded;
+ socklen_t len;
+
+- if (aNeeded + mStreams.Length() > MAX_NUM_STREAMS)
++ if (aNeeded + mStreams.Length() > MAX_NUM_STREAMS) {
+ aNeeded = MAX_NUM_STREAMS - mStreams.Length();
+- if (aNeeded <= 0)
++ }
++ if (aNeeded <= 0) {
+ return false;
++ }
+
+ len = (socklen_t)sizeof(struct sctp_status);
+ if (usrsctp_getsockopt(mMasterSocket, IPPROTO_SCTP, SCTP_STATUS, &status, &len) < 0) {
+@@ -922,19 +924,25 @@ DataChannelConnection::RequestMoreStreams(int32_t aNeeded)
+ }
+ outStreamsNeeded = aNeeded; // number to add
+
+- memset(&sas, 0, sizeof(struct sctp_add_streams));
++ // Note: if multiple channel opens happen when we don't have enough space,
++ // we'll call RequestMoreStreams() multiple times
++ memset(&sas, 0, sizeof(sas));
+ sas.sas_instrms = 0;
+ sas.sas_outstrms = (uint16_t)outStreamsNeeded; /* XXX error handling */
+ // Doesn't block, we get an event when it succeeds or fails
+ if (usrsctp_setsockopt(mMasterSocket, IPPROTO_SCTP, SCTP_ADD_STREAMS, &sas,
+ (socklen_t) sizeof(struct sctp_add_streams)) < 0) {
+- if (errno == EALREADY)
++ if (errno == EALREADY) {
++ LOG(("Already have %u output streams", outStreamsNeeded));
+ return true;
++ }
+
+ LOG(("***failed: setsockopt ADD errno=%d", errno));
+ return false;
+ }
+ LOG(("Requested %u more streams", outStreamsNeeded));
++ // We add to mStreams when we get a SCTP_STREAM_CHANGE_EVENT and the
++ // values are larger than mStreams.Length()
+ return true;
+ }
+
+@@ -1050,6 +1058,13 @@ DataChannelConnection::SendDeferredMessages()
+ channel->mFlags & DATA_CHANNEL_FLAGS_OUT_OF_ORDER_ALLOWED,
+ channel->mPrPolicy, channel->mPrValue)) {
+ channel->mFlags &= ~DATA_CHANNEL_FLAGS_SEND_REQ;
++
++ channel->mState = OPEN;
++ channel->mReady = true;
++ LOG(("%s: sending ON_CHANNEL_OPEN for %p", __FUNCTION__, channel.get()));
++ NS_DispatchToMainThread(new DataChannelOnMessageAvailable(
++ DataChannelOnMessageAvailable::ON_CHANNEL_OPEN, this,
++ channel));
+ sent = true;
+ } else {
+ if (errno == EAGAIN || errno == EWOULDBLOCK) {
+@@ -1177,6 +1192,7 @@ DataChannelConnection::HandleOpenRequestMessage(const struct rtcweb_datachannel_
+ prPolicy = SCTP_PR_SCTP_TTL;
+ break;
+ default:
++ LOG(("Unknown channel type", req->channel_type));
+ /* XXX error handling */
+ return;
+ }
+@@ -1203,6 +1219,10 @@ DataChannelConnection::HandleOpenRequestMessage(const struct rtcweb_datachannel_
+ }
+ return;
+ }
++ if (stream >= mStreams.Length()) {
++ LOG(("%s: stream %u out of bounds (%u)", __FUNCTION__, stream, mStreams.Length()));
++ return;
++ }
+
+ nsCString label(nsDependentCSubstring(&req->label[0], ntohs(req->label_length)));
+ nsCString protocol(nsDependentCSubstring(&req->label[ntohs(req->label_length)],
+@@ -1220,8 +1240,8 @@ DataChannelConnection::HandleOpenRequestMessage(const struct rtcweb_datachannel_
+
+ channel->mState = DataChannel::WAITING_TO_OPEN;
+
+- LOG(("%s: sending ON_CHANNEL_CREATED for %s/%s: %u", __FUNCTION__,
+- channel->mLabel.get(), channel->mProtocol.get(), stream));
++ LOG(("%s: sending ON_CHANNEL_CREATED for %s/%s: %u (state %u)", __FUNCTION__,
++ channel->mLabel.get(), channel->mProtocol.get(), stream, channel->mState));
+ NS_DispatchToMainThread(new DataChannelOnMessageAvailable(
+ DataChannelOnMessageAvailable::ON_CHANNEL_CREATED,
+ this, channel));
+@@ -1739,13 +1759,14 @@ DataChannelConnection::HandleStreamResetEvent(const struct sctp_stream_reset_eve
+ // 2. We sent our own reset (CLOSING); either they crossed on the
+ // wire, or this is a response to our Reset.
+ // Go to CLOSED
+- // 3. We've sent a open but haven't gotten a response yet (OPENING)
++ // 3. We've sent a open but haven't gotten a response yet (CONNECTING)
+ // I believe this is impossible, as we don't have an input stream yet.
+
+ LOG(("Incoming: Channel %u closed, state %d",
+ channel->mStream, channel->mState));
+ ASSERT_WEBRTC(channel->mState == DataChannel::OPEN ||
+ channel->mState == DataChannel::CLOSING ||
++ channel->mState == DataChannel::CONNECTING ||
+ channel->mState == DataChannel::WAITING_TO_OPEN);
+ if (channel->mState == DataChannel::OPEN ||
+ channel->mState == DataChannel::WAITING_TO_OPEN) {
+@@ -1791,20 +1812,21 @@ DataChannelConnection::HandleStreamChangeEvent(const struct sctp_stream_change_e
+ return;
+ } else {
+ if (strchg->strchange_instrms > mStreams.Length()) {
+- LOG(("Other side increased streamds from %u to %u",
++ LOG(("Other side increased streams from %u to %u",
+ mStreams.Length(), strchg->strchange_instrms));
+ }
+- if (strchg->strchange_outstrms > mStreams.Length()) {
++ if (strchg->strchange_outstrms > mStreams.Length() ||
++ strchg->strchange_instrms > mStreams.Length()) {
+ uint16_t old_len = mStreams.Length();
++ uint16_t new_len = std::max(strchg->strchange_outstrms,
++ strchg->strchange_instrms);
+ LOG(("Increasing number of streams from %u to %u - adding %u (in: %u)",
+- old_len,
+- strchg->strchange_outstrms,
+- strchg->strchange_outstrms - old_len,
++ old_len, new_len, new_len - old_len,
+ strchg->strchange_instrms));
+ // make sure both are the same length
+- mStreams.AppendElements(strchg->strchange_outstrms - old_len);
++ mStreams.AppendElements(new_len - old_len);
+ LOG(("New length = %d (was %d)", mStreams.Length(), old_len));
+- for (uint32_t i = old_len; i < mStreams.Length(); ++i) {
++ for (size_t i = old_len; i < mStreams.Length(); ++i) {
+ mStreams[i] = nullptr;
+ }
+ // Re-process any channels waiting for streams.
+@@ -1815,13 +1837,17 @@ DataChannelConnection::HandleStreamChangeEvent(const struct sctp_stream_change_e
+ // Could make a more complex API for OpenXxxFinish() and avoid this loop
+ int32_t num_needed = mPending.GetSize();
+ LOG(("%d of %d new streams already needed", num_needed,
+- strchg->strchange_outstrms - old_len));
+- num_needed -= (strchg->strchange_outstrms - old_len); // number we added
++ new_len - old_len));
++ num_needed -= (new_len - old_len); // number we added
+ if (num_needed > 0) {
+ if (num_needed < 16)
+ num_needed = 16;
+ LOG(("Not enough new streams, asking for %d more", num_needed));
+ RequestMoreStreams(num_needed);
++ } else if (strchg->strchange_outstrms < strchg->strchange_instrms) {
++ LOG(("Requesting %d output streams to match partner",
++ strchg->strchange_instrms - strchg->strchange_outstrms));
++ RequestMoreStreams(strchg->strchange_instrms - strchg->strchange_outstrms);
+ }
+
+ ProcessQueuedOpens();
+ Modified netwerk/sctp/datachannel/DataChannelProtocol.h
+diff --git a/netwerk/sctp/datachannel/DataChannelProtocol.h b/netwerk/sctp/datachannel/DataChannelProtocol.h
+index 549f74b..74fbe58 100644
+--- a/netwerk/sctp/datachannel/DataChannelProtocol.h
++++ b/netwerk/sctp/datachannel/DataChannelProtocol.h
+@@ -17,7 +17,7 @@
+ #endif
+
+ // Duplicated in fsm.def
+-#define WEBRTC_DATACHANNEL_STREAMS_DEFAULT 16
++#define WEBRTC_DATACHANNEL_STREAMS_DEFAULT 256
+
+ #define DATA_CHANNEL_PPID_CONTROL 50
+ #define DATA_CHANNEL_PPID_BINARY 52
generated by cgit v1.2.3 (git 2.45.2) at 2024-08-05 08:17:53 +0000