pullup ticket #2372 - requested by tonnerre
licq-core: fix for DoS vulnerability

revisions pulled up:
- pkgsrc/chat/licq-core/Makefile		1.11
- pkgsrc/chat/licq-core/distinfo		1.13
- pkgsrc/chat/licq-core/patches/patch-aa	1.2
- pkgsrc/chat/licq-core/patches/patch-ab	1.3
- pkgsrc/chat/licq-core/patches/patch-ac	1.3
- pkgsrc/chat/licq-core/patches/patch-ag	1.5

   Module Name:	pkgsrc
   Committed By:	tonnerre
   Date:		Sun May 11 04:12:34 UTC 2008

   Modified Files:
   	pkgsrc/chat/licq-core: Makefile distinfo
   	pkgsrc/chat/licq-core/patches: patch-aa
   Added Files:
   	pkgsrc/chat/licq-core/patches: patch-ab patch-ac patch-ag

   Log Message:
   Fix multiple connection handling Denial of Service vulnerability in licq
   (CVE-2008-1996). Before this, the application would crash if too many
   TCP connections are opened.


(rtr)

$NetBSD: patch-ab,v 1.2.4.1 2008/05/12 10:47:37 rtr Exp $

--- src/icqd-chat.cpp.orig	2007-09-09 14:05:24.000000000 +0200
+++ src/icqd-chat.cpp
@@ -23,6 +23,7 @@
 // Localization
 #include "gettext.h"
 
+#define MAX_CONNECTS  256
 #define DEBUG_THREADS(x)
 
 
@@ -2383,16 +2384,24 @@ void *ChatManager_tep(void *arg)
         // Connection on the server port ---------------------------------------
         else if (nCurrentSocket == chatman->chatServer.Descriptor())
         {
-          CChatUser *u = new CChatUser;
-          u->m_pClient = new CChatClient;
-
-          chatman->chatServer.RecvConnection(u->sock);
-          chatman->sockman.AddSocket(&u->sock);
-          chatman->sockman.DropSocket(&u->sock);
-
-          u->state = CHAT_STATE_HANDSHAKE;
-          chatman->chatUsers.push_back(u);
-          gLog.Info(tr("%sChat: Received connection.\n"), L_TCPxSTR);
+	  if (chatman->sockman.Num() >= MAX_CONNECTS)
+	  {
+	    // Too many sockets, drop this one
+	    gLog.Warn(tr("%sToo many connected clients, rejecting new connection.\n"), L_WARNxSTR);
+	  }
+	  else
+	  {
+            CChatUser *u = new CChatUser;
+            u->m_pClient = new CChatClient;
+
+            chatman->chatServer.RecvConnection(u->sock);
+            chatman->sockman.AddSocket(&u->sock);
+            chatman->sockman.DropSocket(&u->sock);
+
+            u->state = CHAT_STATE_HANDSHAKE;
+            chatman->chatUsers.push_back(u);
+            gLog.Info(tr("%sChat: Received connection.\n"), L_TCPxSTR);
+	  }
         }
 
         // Message from connected socket----------------------------------------

$NetBSD: patch-ag,v 1.2.4.1 2008/05/12 10:47:37 rtr Exp $

--- src/socket.cpp.orig	2007-10-15 20:11:50.000000000 +0200
+++ src/socket.cpp
@@ -817,8 +817,19 @@ void TCPSocket::RecvConnection(TCPSocket
 {
   socklen_t sizeofSockaddr = sizeof(struct sockaddr_in);
 
-  newSocket.m_nDescriptor = accept(m_nDescriptor, (struct sockaddr *)&newSocket.m_sRemoteAddr, &sizeofSockaddr);
-  newSocket.SetLocalAddress();
+  int newDesc = accept(m_nDescriptor, (struct sockaddr *)&newSocket.m_sRemoteAddr, &sizeofSockaddr);
+  if (newDesc < FD_SETSIZE)
+  {
+    newSocket.m_nDescriptor = newDesc;
+    newSocket.SetLocalAddress();
+  }
+  else
+  {
+    gLog.Error(tr("%sCannot accept new connection, too many descriptors in use.\n"), L_ERRORxSTR);
+    close(newDesc);
+
+    // TODO throw an exception, or do something to tell the caller it failed
+  }
 }
 
 #define m_pSSL ((SSL *) m_p_SSL)

$NetBSD: patch-ac,v 1.4.4.1 2008/05/12 10:47:37 rtr Exp $

--- src/icqd-threads.cpp.orig	2007-09-28 22:11:35.000000000 +0200
+++ src/icqd-threads.cpp
@@ -23,6 +23,7 @@
 // Localization
 #include "gettext.h"
 
+#define MAX_CONNECTS  256
 #define DEBUG_THREADS(x)
 //#define DEBUG_THREADS(x) gLog.Info(x)
 
@@ -780,8 +781,21 @@ void *MonitorSockets_tep(void *p)
               TCPSocket *newSocket = new TCPSocket(0);
               tcp->RecvConnection(*newSocket);
               gSocketManager.DropSocket(tcp);
-              gSocketManager.AddSocket(newSocket);
-              gSocketManager.DropSocket(newSocket);
+
+	      // Make sure we can handle another socket before accepting it
+	      if (gSocketManager.Num() > MAX_CONNECTS)
+	      {
+		// Too many sockets, drop this one
+		char remoteIp[32];
+		gLog.Warn(tr("%sToo many connected sockets, rejecting connection from %s.\n"),
+			L_WARNxSTR, newSocket->RemoteIpStr(remoteIp));
+		delete newSocket;
+	      }
+	      else
+	      {
+                gSocketManager.AddSocket(newSocket);
+                gSocketManager.DropSocket(newSocket);
+	      }
             }
           }