From 4e84c1d6eb2f54d1643bd7ce62817c722ca36d25 Mon Sep 17 00:00:00 2001 From: Hugo Muis <198191869+friendlyhugo@users.noreply.github.com> Date: Sun, 2 Mar 2025 18:06:24 +0100 Subject: [PATCH] core: fix DoS bug by changing assert to return Closes https://github.com/avahi/avahi/issues/678 CVE: CVE-2025-68471 Upstream-Status: Backport [https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1] Signed-off-by: Amaury Couderc --- avahi-core/browse.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/avahi-core/browse.c b/avahi-core/browse.c index 2941e57..86e4432 100644 --- a/avahi-core/browse.c +++ b/avahi-core/browse.c @@ -320,7 +320,10 @@ static int lookup_start(AvahiSRBLookup *l) { assert(l); assert(!(l->flags & AVAHI_LOOKUP_USE_WIDE_AREA) != !(l->flags & AVAHI_LOOKUP_USE_MULTICAST)); - assert(!l->wide_area && !l->multicast); + if (l->wide_area || l->multicast) { + /* Avoid starting a duplicate lookup */ + return 0; + } if (l->flags & AVAHI_LOOKUP_USE_WIDE_AREA) { -- 2.43.0