Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:open-isns User: [email protected] Usertags: pu
[ Reason ] Fix CVE-2026-55995 (bug #1143053). It is a pre-auth DoS. [ Impact ] The DoS stays unfixed. [ Tests ] There are autopkgtests. I cannot verify the bug as no reproducer is publicly available. [ Risks ] The diff seems small and nothing is obviously wrong with it. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Picks two upstream patches: 1) to fix the CVE 2) to fix an issue that showed up in autopkgtests, which was fixed only for forky. The issue is due to gcc changes, and IIRC autopkgtests for the version that forky inherited from trixie failed. Including it to avoid future surprises. [ Other info ] Nothing I'm aware of. Best, Chris
diff -Nru open-isns-0.101/debian/changelog open-isns-0.101/debian/changelog --- open-isns-0.101/debian/changelog 2024-05-25 09:32:22.000000000 +0200 +++ open-isns-0.101/debian/changelog 2026-08-01 14:56:05.000000000 +0200 @@ -1,3 +1,17 @@ +open-isns (0.101-1+deb13u1) trixie; urgency=medium + + * Team upload. + + [ Chris Hofstaedtler ] + * d/gbp.conf: setup for trixie branch + * Pick upstream fix for CVE-2026-55995 (Closes: #1143053) + + [ Jochen Sprickerhof ] + * Pick upstream fix to "Fix the bug in compare value", to fix + autopkgtest regression. + + -- Chris Hofstaedtler <[email protected]> Sat, 01 Aug 2026 14:56:05 +0200 + open-isns (0.101-1) unstable; urgency=medium * Team upload. diff -Nru open-isns-0.101/debian/gbp.conf open-isns-0.101/debian/gbp.conf --- open-isns-0.101/debian/gbp.conf 2021-12-15 09:09:17.000000000 +0100 +++ open-isns-0.101/debian/gbp.conf 2026-08-01 14:55:01.000000000 +0200 @@ -2,7 +2,7 @@ pristine-tar = True color = auto upstream-branch = upstream/master -debian-branch = debian/master +debian-branch = debian/trixie [import-orig] dch = True diff -Nru open-isns-0.101/debian/patches/0001-Fix-issue-in-error-path-causing-double-free.patch open-isns-0.101/debian/patches/0001-Fix-issue-in-error-path-causing-double-free.patch --- open-isns-0.101/debian/patches/0001-Fix-issue-in-error-path-causing-double-free.patch 1970-01-01 01:00:00.000000000 +0100 +++ open-isns-0.101/debian/patches/0001-Fix-issue-in-error-path-causing-double-free.patch 2026-08-01 14:54:46.000000000 +0200 @@ -0,0 +1,35 @@ +From: Lee Duncan <[email protected]> +Date: Tue, 28 Jul 2026 11:07:24 -0700 +Subject: Fix issue in error path causing double-free. + +In attrs.c, when buf_get() fails and allocated memory is +freed, we also need to set the pointer to that memory to +NULL, to prevent a double free from occuring, would could +lead to a DoS attack. + +References: CVE-2026-55995 +Found-by: <[email protected]> +--- + attrs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/attrs.c b/attrs.c +index a12c222..15c930d 100644 +--- a/attrs.c ++++ b/attrs.c +@@ -1371,6 +1371,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_string = isns_malloc(len + 1); + if (!buf_get(bp, value->iv_string, len)) { + isns_free(value->iv_string); ++ value->iv_string = NULL; + return 0; + } + value->iv_string[len] = '\0'; +@@ -1546,6 +1547,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_opaque.ptr = isns_malloc(len); + if (!buf_get(bp, value->iv_opaque.ptr, len)) { + isns_free(value->iv_opaque.ptr); ++ value->iv_opaque.ptr = NULL; + return 0; + } + diff -Nru open-isns-0.101/debian/patches/0002-Fix-the-bug-in-compare-value.patch open-isns-0.101/debian/patches/0002-Fix-the-bug-in-compare-value.patch --- open-isns-0.101/debian/patches/0002-Fix-the-bug-in-compare-value.patch 1970-01-01 01:00:00.000000000 +0100 +++ open-isns-0.101/debian/patches/0002-Fix-the-bug-in-compare-value.patch 2026-08-01 14:55:58.000000000 +0200 @@ -0,0 +1,39 @@ +From: =?utf-8?b?5a6i5Liy5LiA5Zue?= <[email protected]> +Date: Wed, 20 Mar 2024 13:20:13 +0800 +Subject: Fix the bug in compare value + +GCC fill zero in padding bits in struct and union are undifined behavior to C std, and clang not do this. So if we use clang to compile code, we will see the error result of comparing isns_value_t. +So I fill zero in initialization of isns_value_t. +--- + include/libisns/attrs.h | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/include/libisns/attrs.h b/include/libisns/attrs.h +index e10f1d8..23aaace 100644 +--- a/include/libisns/attrs.h ++++ b/include/libisns/attrs.h +@@ -7,6 +7,7 @@ + #ifndef ISNS_ATTRS_H + #define ISNS_ATTRS_H + ++#include <memory.h> + #include <netinet/in.h> + #include <libisns/buffer.h> + #include <libisns/isns.h> +@@ -53,9 +54,13 @@ typedef struct isns_value { + + #define __ISNS_ATTRTYPE(type) isns_attr_type_##type + #define __ISNS_MEMBER(type) iv_##type +-#define ISNS_VALUE_INIT(type, value) \ +- (isns_value_t) { .iv_type = &__ISNS_ATTRTYPE(type), \ +- { .__ISNS_MEMBER(type) = (value) } } ++#define ISNS_VALUE_INIT(type, value) ({ \ ++ isns_value_t __v; \ ++ memset(&__v, 0, sizeof(__v)); \ ++ __v.iv_type = &__ISNS_ATTRTYPE(type); \ ++ __v.__ISNS_MEMBER(type) = (value); \ ++ __v; \ ++}) + + #define isns_attr_initialize(attrp, tag, type, value) do { \ + isns_attr_t *__attr = (attrp); \ diff -Nru open-isns-0.101/debian/patches/series open-isns-0.101/debian/patches/series --- open-isns-0.101/debian/patches/series 1970-01-01 01:00:00.000000000 +0100 +++ open-isns-0.101/debian/patches/series 2026-08-01 14:55:58.000000000 +0200 @@ -0,0 +1,2 @@ +0001-Fix-issue-in-error-path-causing-double-free.patch +0002-Fix-the-bug-in-compare-value.patch
