[bug#73696] [PATCH 0/3] Update osip, exosip, sipwitch. [security fixes]

[bug#73696] [PATCH 0/3] Update osip, exosip, sipwitch. [security fixes]

[Nicolas Graves via Guix-patches via]

Nicolas Graves (3):
  gnu: osip: Update to 5.3.1.
  gnu: exosip: Update to 5.3.0. [security fixes]
  gnu: sipwitch: Fix build.

 gnu/local.mk                                  |  2 +-
 gnu/packages/patches/osip-CVE-2017-7853.patch | 40 ----------
 .../sipwitch-fix-build-with-exosip5.patch     | 77 +++++++++++++++++++
 gnu/packages/telephony.scm                    | 16 ++--
 4 files changed, 86 insertions(+), 49 deletions(-)
 delete mode 100644 gnu/packages/patches/osip-CVE-2017-7853.patch
 create mode 100644 gnu/packages/patches/sipwitch-fix-build-with-exosip5.patch

-- 
2.46.0

[bug#73696] [PATCH 1/3] gnu: osip: Update to 5.3.1.

[Nicolas Graves via Guix-patches via]

* gnu/packages/telephony.scm (osip): Update to 5.3.1.
[origin]<patches>: Remove patch.
* gnu/packages/patches/osip-CVE-2017-7853.patch : Remove it.
* gnu/local.mk: Remove patch.
---
 gnu/local.mk                                  |  1 -
 gnu/packages/patches/osip-CVE-2017-7853.patch | 40 -------------------
 gnu/packages/telephony.scm                    |  5 +--
 3 files changed, 2 insertions(+), 44 deletions(-)
 delete mode 100644 gnu/packages/patches/osip-CVE-2017-7853.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index c48f4bfeca..25d6249319 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1878,7 +1878,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/orangeduck-mpc-fix-pkg-config.patch	\
   %D%/packages/patches/orbit2-fix-array-allocation-32bit.patch \
   %D%/packages/patches/orpheus-cast-errors-and-includes.patch	\
-  %D%/packages/patches/osip-CVE-2017-7853.patch			\
   %D%/packages/patches/ots-no-include-missing-file.patch	\
   %D%/packages/patches/owncloud-disable-updatecheck.patch	\
   %D%/packages/patches/p7zip-CVE-2016-9296.patch		\
diff --git a/gnu/packages/patches/osip-CVE-2017-7853.patch b/gnu/packages/patches/osip-CVE-2017-7853.patch
deleted file mode 100644
index 33d95cdb0e..0000000000
--- a/gnu/packages/patches/osip-CVE-2017-7853.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-Fix CVE-2017-7853:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7853
-https://savannah.gnu.org/support/index.php?109265
-
-Patch copied from upstream source repository:
-
-https://git.savannah.gnu.org/cgit/osip.git/commit/?id=1ae06daf3b2375c34af23083394a6f010be24a45
-
-From 1ae06daf3b2375c34af23083394a6f010be24a45 Mon Sep 17 00:00:00 2001
-From: Aymeric Moizard <amoizard@gmail.com>
-Date: Tue, 21 Feb 2017 17:16:26 +0100
-Subject: [PATCH]  * fix bug report: sr #109265: SIP message body length
- underflow in libosip2-4.1.0    https://savannah.gnu.org/support/?109265   
- also applicable to current latest version
-
----
- src/osipparser2/osip_message_parse.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/src/osipparser2/osip_message_parse.c b/src/osipparser2/osip_message_parse.c
-index 1628c60..aa35446 100644
---- a/src/osipparser2/osip_message_parse.c
-+++ b/src/osipparser2/osip_message_parse.c
-@@ -784,6 +784,12 @@ msg_osip_body_parse (osip_message_t * sip, const char *start_of_buf, const char
-     if ('\n' == start_of_body[0] || '\r' == start_of_body[0])
-       start_of_body++;
- 
-+    /* if message body is empty or contains a single CR/LF */
-+    if (end_of_body <= start_of_body) {
-+      osip_free (sep_boundary);
-+      return OSIP_SYNTAXERROR;
-+    }
-+
-     body_len = end_of_body - start_of_body;
- 
-     /* Skip CR before end boundary. */
--- 
-2.13.1
-
diff --git a/gnu/packages/telephony.scm b/gnu/packages/telephony.scm
index a08e6cf031..c06178cafb 100644
--- a/gnu/packages/telephony.scm
+++ b/gnu/packages/telephony.scm
@@ -359,14 +359,13 @@ (define-public zrtpcpp
 (define-public osip
   (package
    (name "osip")
-   (version "5.2.1")
+   (version "5.3.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/osip/libosip2-" version ".tar.gz"))
-            (patches (search-patches "osip-CVE-2017-7853.patch"))
             (sha256
              (base32
-              "1wibs2zs035ay7qvl5ai8drv6f0xw7iscb0frmpgax3pisy88dzf"))))
+              "0yfwd8g2nxf3i9d8gqh6a16ma350dlhih4awbb0nl9h82s2gx0py"))))
    (build-system gnu-build-system)
 
    (synopsis "Library implementing SIP (RFC-3261)")
-- 
2.46.0

[bug#73696] [PATCH 2/3] gnu: exosip: Update to 5.3.0. [security fixes]

[Nicolas Graves via Guix-patches via]

This fixes CVE-2014-10375.

* gnu/packages/telephony.scm (exosip): Update to 5.3.0.
---
 gnu/packages/telephony.scm | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/gnu/packages/telephony.scm b/gnu/packages/telephony.scm
index c06178cafb..714982c5b0 100644
--- a/gnu/packages/telephony.scm
+++ b/gnu/packages/telephony.scm
@@ -377,17 +377,16 @@ (define-public osip
                  (upstream-name . "libosip2")))
    (home-page "https://www.gnu.org/software/osip/")))
 
-
 (define-public exosip
   (package
    (name "exosip")
-   (version "4.1.0")
+   (version "5.3.0")
    (source (origin
             (method url-fetch)
-            (uri (string-append "mirror://savannah/exosip/libeXosip2-"
+            (uri (string-append "mirror://savannah/exosip/libexosip2-"
                                 version ".tar.gz"))
             (sha256 (base32
-                     "17cna8kpc8nk1si419vgr6r42k2lda0rdk50vlxrw8rzg0xp2xrw"))))
+                     "1hn9xgy8ny04hjqd1rra7c4nz5nf9abdd5ghr7nmrsiicjc26y2v"))))
    (build-system gnu-build-system)
    (inputs (list osip))
    (synopsis "Sip abstraction library")
-- 
2.46.0

[bug#73696] [PATCH 3/3] gnu: sipwitch: Fix build.

[Nicolas Graves via Guix-patches via]

* gnu/packages/telephony.scm (sipwitch): Fix build.
[origin]<patches>: Add sipwitch-fix-build-with-exosip5.patch here...
* gnu/packages/patches: ...here and...
* gnu/local.mk: ...here.
---
 gnu/local.mk                                  |  1 +
 .../sipwitch-fix-build-with-exosip5.patch     | 77 +++++++++++++++++++
 gnu/packages/telephony.scm                    |  4 +-
 3 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/sipwitch-fix-build-with-exosip5.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 25d6249319..fa9d7f7e0b 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -2158,6 +2158,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/shakespeare-spl-fix-grammar.patch		\
   %D%/packages/patches/shared-mime-info-xdgmime-path.patch	\
   %D%/packages/patches/sharutils-CVE-2018-1000097.patch		\
+  %D%/packages/patches/sipwitch-fix-build-with-exosip5.patch	\
   %D%/packages/patches/slim-config.patch			\
   %D%/packages/patches/slim-login.patch				\
   %D%/packages/patches/slim-display.patch			\
diff --git a/gnu/packages/patches/sipwitch-fix-build-with-exosip5.patch b/gnu/packages/patches/sipwitch-fix-build-with-exosip5.patch
new file mode 100644
index 0000000000..d18aa75f32
--- /dev/null
+++ b/gnu/packages/patches/sipwitch-fix-build-with-exosip5.patch
@@ -0,0 +1,77 @@
+From 59c0063443ce0de7f93c34b6c29dd3f12e678848 Mon Sep 17 00:00:00 2001
+From: Fredrick Brennan <copypaste@kittens.ph>
+Date: Fri, 3 Nov 2023 20:57:59 -0400
+Subject: [PATCH] Fix build with 5.x series of libexosip2
+
+---
+ common/voip.cpp    | 5 +++--
+ utils/Makefile.am  | 3 ++-
+ utils/sipquery.cpp | 6 +++++-
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/common/voip.cpp b/common/voip.cpp
+index d3ee15b..d0f6ebd 100644
+--- a/common/voip.cpp
++++ b/common/voip.cpp
+@@ -138,9 +138,10 @@ bool voip::make_prack_message(context_t ctx, tid_t tid, msg_t *msg)
+     if(!msg)
+         return false;
+ 
++    msg_t onexxmsg = NULL;
+     *msg = NULL;
+     eXosip_lock(ctx);
+-    eXosip_call_build_prack(ctx, tid, msg);
++    eXosip_call_build_prack(ctx, tid, onexxmsg, msg);
+     if(!*msg) {
+         eXosip_unlock(ctx);
+         return false;
+@@ -438,7 +439,7 @@ void voip::create(context_t *ctx, const char *agent, int f)
+ 
+ #ifdef  AF_INET6
+     if(family == AF_INET6)
+-        eXosip_enable_ipv6(1);
++        voip::option(*ctx, EXOSIP_OPT_ENABLE_IPV6, (void *)2);
+ #endif
+ }
+ 
+diff --git a/utils/Makefile.am b/utils/Makefile.am
+index dd2040f..ffe6d09 100644
+--- a/utils/Makefile.am
++++ b/utils/Makefile.am
+@@ -22,7 +22,8 @@ sipcontrol_SOURCES = sipcontrol.cpp
+ sipcontrol_LDADD = @LDFLAGS@ @SIPWITCH_LIBS@
+ 
+ sipquery_SOURCES = sipquery.cpp
+-sipquery_LDADD = @LDFLAGS@ @SIPWITCH_EXOSIP2@ @SIPWITCH_LIBS@
++sipquery_LDFLAGS = -L$(top_builddir)/common -lsipwitch
++sipquery_LDADD = @LDFLAGS@ @SIPWITCH_LIBS@ @SIPWITCH_EXOSIP2@
+ 
+ sippasswd_SOURCES = sippasswd.cpp
+ sippasswd_LDADD = @LDFLAGS@ @SIPWITCH_LIBS@
+diff --git a/utils/sipquery.cpp b/utils/sipquery.cpp
+index 5b83590..f99512d 100644
+--- a/utils/sipquery.cpp
++++ b/utils/sipquery.cpp
+@@ -50,6 +50,10 @@ static struct eXosip_t *context = NULL;
+ 
+ using namespace ucommon;
+ 
++#include "sipwitch/voip.h"
++
++using namespace sipwitch;
++
+ #if defined(_MSWINDOWS_) && defined(__GNUC__)
+ // binds addrinfo for mingw32 linkage since otherwise mingw32 cannot
+ // cannot link proper getaddrinfo/freeaddrinfo calls that eXosip uses.
+@@ -226,7 +230,7 @@ usage:
+ 
+ #ifdef  AF_INET6
+     if(family == AF_INET6) {
+-        eXosip_enable_ipv6(1);
++        sipwitch::voip::option(EXOSIP_CONTEXT, EXOSIP_OPT_ENABLE_IPV6, (void *)2);
+         if(binding == NULL)
+             binding = "::0";
+     }
+-- 
+2.42.0
+
diff --git a/gnu/packages/telephony.scm b/gnu/packages/telephony.scm
index 714982c5b0..99a8486b7f 100644
--- a/gnu/packages/telephony.scm
+++ b/gnu/packages/telephony.scm
@@ -409,7 +409,9 @@ (define-public sipwitch
             (uri (string-append "mirror://gnu/sipwitch/sipwitch-"
                    version ".tar.gz"))
             (sha256 (base32
-                     "10lli9c703d7qbarzc0lgmz963ppncvnrklwrnri0s1zcmmahyia"))))
+                     "10lli9c703d7qbarzc0lgmz963ppncvnrklwrnri0s1zcmmahyia"))
+            (patches
+             (search-patches "sipwitch-fix-build-with-exosip5.patch"))))
    (build-system gnu-build-system)
    ;; The configure.ac uses pkg-config but in a kludgy way which breaks when
    ;; cross-compiling.  Among other issues there the program name "pkg-config"
-- 
2.46.0

bug#73696: [PATCH 0/3] Update osip, exosip, sipwitch. [security fixes]

[Ludovic Courtès]

Nicolas Graves <ngraves@ngraves.fr> skribis:

>   gnu: osip: Update to 5.3.1.
>   gnu: exosip: Update to 5.3.0. [security fixes]
>   gnu: sipwitch: Fix build.

Applied, thanks!

Ludo’.