From 4643b9cb9e6c0331fd663437a7ed8061b9edf971 Mon Sep 17 00:00:00 2001
From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Date: Mon, 24 Aug 2020 19:26:03 +0200
Subject: [PATCH] switch to libupnp 1.14.x API

Use the new libupnp 1.14.x API (i.e. UpnpInit2) to allow ushare to be
protected against CallStranger a.k.a. CVE-2020-12695

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Retrieved from:
https://github.com/ddugovic/uShare/commit/4643b9cb9e6c0331fd663437a7ed8061b9edf971]
---
 configure      |  2 --
 src/http.c     | 50 +++++++++++++++++++++++++++++++-------------------
 src/http.h     | 24 ++++++++++++++++++------
 src/services.c | 28 ++++++++++++++++++----------
 src/services.h |  6 +++---
 src/ushare.c   | 36 ++++++++++++++++++------------------
 src/ushare.h   |  2 +-
 7 files changed, 89 insertions(+), 59 deletions(-)

diff --git a/configure b/configure
index 20a08ed..4a3efe0 100755
--- a/configure
+++ b/configure
@@ -638,8 +638,6 @@ fi
 echolog "Checking for libixml ..."
 check_lib upnp/ixml.h ixmlRelaxParser -lixml || die "Error, can't find libixml !"
 
-echolog "Checking for libthreadutil ..."
-check_lib upnp/ThreadPool.h ThreadPoolAdd "-lthreadutil -lpthread" || die "Error, can't find libthreadutil !"
 add_extralibs -lpthread
 
 libupnp_min_version="1.4.2"
diff --git a/src/http.c b/src/http.c
index 8a4e67d..1e5b350 100644
--- a/src/http.c
+++ b/src/http.c
@@ -68,17 +68,19 @@ struct web_file_t {
 
 
 static inline void
-set_info_file (struct File_Info *info, const size_t length,
+set_info_file (UpnpFileInfo *info, const size_t length,
                const char *content_type)
 {
-  info->file_length = length;
-  info->last_modified = 0;
-  info->is_directory = 0;
-  info->is_readable = 1;
-  info->content_type = ixmlCloneDOMString (content_type);
+  UpnpFileInfo_set_FileLength(info, length);
+  UpnpFileInfo_set_LastModified(info, 0);
+  UpnpFileInfo_set_IsDirectory(info, 0);
+  UpnpFileInfo_set_IsReadable(info, 1);
+  UpnpFileInfo_set_ContentType(info, ixmlCloneDOMString (content_type));
 }
 
-int http_get_info (const char *filename, struct File_Info *info)
+int http_get_info (const char *filename, UpnpFileInfo *info,
+                   const void* cookie __attribute__((unused)),
+                   const void** requestCookie __attribute__((unused)))
 {
   extern struct ushare_t *ut;
   struct upnp_entry_t *entry = NULL;
@@ -143,15 +145,15 @@ int http_get_info (const char *filename, struct File_Info *info)
   {
     if (errno != EACCES)
       return -1;
-    info->is_readable = 0;
+    UpnpFileInfo_set_IsReadable(info, 0);
   }
   else
-    info->is_readable = 1;
+    UpnpFileInfo_set_IsReadable(info, 1);
 
   /* file exist and can be read */
-  info->file_length = st.st_size;
-  info->last_modified = st.st_mtime;
-  info->is_directory = S_ISDIR (st.st_mode);
+  UpnpFileInfo_set_FileLength(info, st.st_size);
+  UpnpFileInfo_set_LastModified(info, st.st_mtime);
+  UpnpFileInfo_set_IsDirectory(info, S_ISDIR (st.st_mode));
 
   protocol = 
 #ifdef HAVE_DLNA
@@ -172,11 +174,11 @@ int http_get_info (const char *filename, struct File_Info *info)
 
   if (content_type)
   {
-    info->content_type = ixmlCloneDOMString (content_type);
+    UpnpFileInfo_set_ContentType(info, ixmlCloneDOMString (content_type));
     free (content_type);
   }
   else
-    info->content_type = ixmlCloneDOMString ("");
+    UpnpFileInfo_set_ContentType(info, ixmlCloneDOMString (""));
 
   return 0;
 }
@@ -197,7 +199,9 @@ get_file_memory (const char *fullpath, const char *description,
   return ((UpnpWebFileHandle) file);
 }
 
-UpnpWebFileHandle http_open (const char *filename, enum UpnpOpenFileMode mode)
+UpnpWebFileHandle http_open (const char *filename, enum UpnpOpenFileMode mode,
+                             const void* cookie __attribute__((unused)),
+                             const void* requestCookie __attribute__((unused)))
 {
   extern struct ushare_t *ut;
   struct upnp_entry_t *entry = NULL;
@@ -250,7 +254,9 @@ UpnpWebFileHandle http_open (const char *filename, enum UpnpOpenFileMode mode)
   return ((UpnpWebFileHandle) file);
 }
 
-int http_read (UpnpWebFileHandle fh, char *buf, size_t buflen)
+int http_read (UpnpWebFileHandle fh, char *buf, size_t buflen,
+               const void* cookie __attribute__((unused)),
+               const void* requestCookie __attribute__((unused)))
 {
   struct web_file_t *file = (struct web_file_t *) fh;
   ssize_t len = -1;
@@ -285,14 +291,18 @@ int http_read (UpnpWebFileHandle fh, char *buf, size_t buflen)
 
 int http_write (UpnpWebFileHandle fh __attribute__((unused)),
             char *buf __attribute__((unused)),
-            size_t buflen __attribute__((unused)))
+            size_t buflen __attribute__((unused)),
+            const void* cookie __attribute__((unused)),
+            const void* requestCookie __attribute__((unused)))
 {
   log_verbose ("http write\n");
 
   return 0;
 }
 
-int http_seek (UpnpWebFileHandle fh, off_t offset, int origin)
+int http_seek (UpnpWebFileHandle fh, off_t offset, int origin,
+               const void* cookie __attribute__((unused)),
+               const void* requestCookie __attribute__((unused)))
 {
   struct web_file_t *file = (struct web_file_t *) fh;
   off_t newpos = -1;
@@ -366,7 +376,9 @@ int http_seek (UpnpWebFileHandle fh, off_t offset, int origin)
   return 0;
 }
 
-int http_close (UpnpWebFileHandle fh)
+int http_close (UpnpWebFileHandle fh,
+                const void* cookie __attribute__((unused)),
+                const void* requestCookie __attribute__((unused)))
 {
   struct web_file_t *file = (struct web_file_t *) fh;
 
diff --git a/src/http.h b/src/http.h
index 32d6bcc..c912a7b 100644
--- a/src/http.h
+++ b/src/http.h
@@ -25,18 +25,30 @@
 #include <upnp/upnp.h>
 #include <upnp/upnptools.h>
 
-int http_get_info (const char *filename, struct File_Info *info);
+int http_get_info (const char *filename, UpnpFileInfo *info,
+	const void* cookie __attribute__((unused)),
+	const void** requestCookie __attribute__((unused)));
 
-UpnpWebFileHandle http_open (const char *filename, enum UpnpOpenFileMode mode);
+UpnpWebFileHandle http_open (const char *filename, enum UpnpOpenFileMode mode,
+	const void* cookie __attribute__((unused)),
+	const void* requestCookie __attribute__((unused)));
 
-int http_read (UpnpWebFileHandle fh, char *buf, size_t buflen);
+int http_read (UpnpWebFileHandle fh, char *buf, size_t buflen,
+	const void* cookie __attribute__((unused)),
+	const void* requestCookie __attribute__((unused)));
 
-int http_seek (UpnpWebFileHandle fh, off_t offset, int origin);
+int http_seek (UpnpWebFileHandle fh, off_t offset, int origin,
+	const void* cookie __attribute__((unused)),
+	const void* requestCookie __attribute__((unused)));
 
 int http_write (UpnpWebFileHandle fh __attribute__((unused)),
 	char *buf __attribute__((unused)),
-	size_t buflen __attribute__((unused)));
+	size_t buflen __attribute__((unused)),
+	const void* cookie __attribute__((unused)),
+	const void* requestCookie __attribute__((unused)));
 
-int http_close (UpnpWebFileHandle fh);
+int http_close (UpnpWebFileHandle fh,
+ 	const void* cookie __attribute__((unused)),
+	const void* requestCookie __attribute__((unused)));
 
 #endif /* _HTTP_H_ */
diff --git a/src/services.c b/src/services.c
index aec9cf8..287df55 100644
--- a/src/services.c
+++ b/src/services.c
@@ -62,25 +62,28 @@ static struct service_t services[] = {
 };
 
 bool
-find_service_action (struct Upnp_Action_Request *request,
+find_service_action (UpnpActionRequest *request,
                      struct service_t **service,
                      struct service_action_t **action)
 {
   int c, d;
+  const char *actionName = NULL;
 
   *service = NULL;
   *action = NULL;
+  
+  actionName = UpnpActionRequest_get_ActionName_cstr(request);
 
-  if (!request || !request->ActionName)
+  if (!request || !actionName)
     return false;
 
   for (c = 0; services[c].id != NULL; c++)
-    if (!strcmp (services[c].id, request->ServiceID))
+    if (!strcmp (services[c].id, UpnpActionRequest_get_ServiceID_cstr(request)))
     {
       *service = &services[c];
       for (d = 0; services[c].actions[d].name; d++)
       {
-        if (!strcmp (services[c].actions[d].name, request->ActionName))
+        if (!strcmp (services[c].actions[d].name, actionName))
         {
           *action = &services[c].actions[d];
           return true;
@@ -97,6 +100,7 @@ upnp_add_response (struct action_event_t *event, char *key, const char *value)
 {
   char *val;
   int res;
+  IXML_Document* actionResult = NULL;
 
   if (!event || !event->status || !key || !value)
     return false;
@@ -105,8 +109,9 @@ upnp_add_response (struct action_event_t *event, char *key, const char *value)
   if (!val)
     return false;
 
-  res = UpnpAddToActionResponse (&event->request->ActionResult,
-                                 event->request->ActionName,
+  actionResult = UpnpActionRequest_get_ActionResult(event->request);
+  res = UpnpAddToActionResponse (&actionResult,
+                                 UpnpActionRequest_get_ActionName_cstr(event->request),
                                  event->service->type, key, val);
 
   if (res != UPNP_E_SUCCESS)
@@ -120,14 +125,17 @@ upnp_add_response (struct action_event_t *event, char *key, const char *value)
 }
 
 char *
-upnp_get_string (struct Upnp_Action_Request *request, const char *key)
+upnp_get_string (UpnpActionRequest *request, const char *key)
 {
   IXML_Node *node = NULL;
+  IXML_Document *actionRequest = NULL;
 
-  if (!request || !request->ActionRequest || !key)
+  actionRequest = UpnpActionRequest_get_ActionRequest(request);
+
+  if (!request || !actionRequest || !key)
     return NULL;
 
-  node = (IXML_Node *) request->ActionRequest;
+  node = (IXML_Node *) actionRequest;
   if (!node)
   {
     log_verbose ("Invalid action request document\n");
@@ -157,7 +165,7 @@ upnp_get_string (struct Upnp_Action_Request *request, const char *key)
 }
 
 int
-upnp_get_ui4 (struct Upnp_Action_Request *request, const char *key)
+upnp_get_ui4 (UpnpActionRequest *request, const char *key)
 {
   char *value;
   int val;
diff --git a/src/services.h b/src/services.h
index 89c072e..d5726b4 100644
--- a/src/services.h
+++ b/src/services.h
@@ -39,15 +39,15 @@ struct service_t {
 
 #define SERVICE_CONTENT_TYPE "text/xml"
 
-bool find_service_action (struct Upnp_Action_Request *request,
+bool find_service_action (UpnpActionRequest *request,
                           struct service_t **service,
                           struct service_action_t **action);
 
 bool upnp_add_response (struct action_event_t *event,
                         char *key, const char *value);
 
-char * upnp_get_string (struct Upnp_Action_Request *request, const char *key);
+char * upnp_get_string (UpnpActionRequest *request, const char *key);
 
-int upnp_get_ui4 (struct Upnp_Action_Request *request, const char *key);
+int upnp_get_ui4 (UpnpActionRequest *request, const char *key);
 
 #endif /* _SERVICES_H_ */
diff --git a/src/ushare.c b/src/ushare.c
index 28fd67e..92e2345 100644
--- a/src/ushare.c
+++ b/src/ushare.c
@@ -177,7 +177,7 @@ ushare_signal_exit (void)
 }
 
 static void
-handle_action_request (struct Upnp_Action_Request *request)
+handle_action_request (UpnpActionRequest *request)
 {
   struct service_t *service;
   struct service_action_t *action;
@@ -187,25 +187,25 @@ handle_action_request (struct Upnp_Action_Request *request)
   if (!request || !ut)
     return;
 
-  if (request->ErrCode != UPNP_E_SUCCESS)
+  if (UpnpActionRequest_get_ErrCode(request) != UPNP_E_SUCCESS)
     return;
 
-  if (strcmp (request->DevUDN + 5, ut->udn))
+  if (strcmp (UpnpActionRequest_get_DevUDN_cstr(request) + 5, ut->udn))
     return;
 
-  ip = (*(struct sockaddr_in *)&request->CtrlPtIPAddr).sin_addr.s_addr;
+  ip = (*(struct sockaddr_in *)UpnpActionRequest_get_CtrlPtIPAddr(request)).sin_addr.s_addr;
   ip = ntohl (ip);
   sprintf (val, "%d.%d.%d.%d",
            (ip >> 24) & 0xFF, (ip >> 16) & 0xFF, (ip >> 8) & 0xFF, ip & 0xFF);
 
   if (ut->verbose)
   {
-    DOMString str = ixmlPrintDocument (request->ActionRequest);
+    DOMString str = ixmlPrintDocument (UpnpActionRequest_get_ActionRequest(request));
     log_verbose ("***************************************************\n");
     log_verbose ("**             New Action Request                **\n");
     log_verbose ("***************************************************\n");
-    log_verbose ("ServiceID: %s\n", request->ServiceID);
-    log_verbose ("ActionName: %s\n", request->ActionName);
+    log_verbose ("ServiceID: %s\n", UpnpActionRequest_get_ServiceID_cstr(request));
+    log_verbose ("ActionName: %s\n", UpnpActionRequest_get_ActionName_cstr(request));
     log_verbose ("CtrlPtIP: %s\n", val);
     log_verbose ("Action Request:\n%s\n", str);
     ixmlFreeDOMString (str);
@@ -220,11 +220,11 @@ handle_action_request (struct Upnp_Action_Request *request)
       event.service = service;
 
       if (action->function (&event) && event.status)
-        request->ErrCode = UPNP_E_SUCCESS;
+        UpnpActionRequest_set_ErrCode(request, UPNP_E_SUCCESS);
 
       if (ut->verbose)
       {
-        DOMString str = ixmlPrintDocument (request->ActionResult);
+        DOMString str = ixmlPrintDocument (UpnpActionRequest_get_ActionResult(request));
         log_verbose ("Action Result:\n%s", str);
         log_verbose ("***************************************************\n");
         log_verbose ("\n");
@@ -235,22 +235,22 @@ handle_action_request (struct Upnp_Action_Request *request)
     }
 
   if (service) /* Invalid Action name */
-    strcpy (request->ErrStr, "Unknown Service Action");
+    UpnpActionRequest_strcpy_ErrStr(request, "Unknown Service Action");
   else /* Invalid Service name */
-    strcpy (request->ErrStr, "Unknown Service ID");
+    UpnpActionRequest_strcpy_ErrStr(request, "Unknown Service ID");
 
-  request->ActionResult = NULL;
-  request->ErrCode = UPNP_SOAP_E_INVALID_ACTION;
+  UpnpActionRequest_set_ActionResult(request, NULL);
+  UpnpActionRequest_set_ErrCode(request, UPNP_SOAP_E_INVALID_ACTION);
 }
 
 static int
-device_callback_event_handler (Upnp_EventType type, void *event,
+device_callback_event_handler (Upnp_EventType type, const void *event,
                                void *cookie __attribute__((unused)))
 {
   switch (type)
     {
     case UPNP_CONTROL_ACTION_REQUEST:
-      handle_action_request ((struct Upnp_Action_Request *) event);
+      handle_action_request ((UpnpActionRequest *) event);
       break;
     case UPNP_CONTROL_ACTION_COMPLETE:
     case UPNP_EVENT_SUBSCRIPTION_REQUEST:
@@ -323,7 +323,7 @@ init_upnp (struct ushare_t *ut)
 #endif /* HAVE_DLNA */
 
   log_info (_("Initializing UPnP subsystem ...\n"));
-  res = UpnpInit (ut->ip, ut->port);
+  res = UpnpInit2 (ut->interface, ut->port);
   if (res != UPNP_E_SUCCESS)
   {
     log_error (_("Cannot initialize UPnP subsystem\n"));
@@ -351,7 +351,7 @@ init_upnp (struct ushare_t *ut)
   log_info (_("UPnP MediaServer listening on %s:%d\n"),
             UpnpGetServerIpAddress (), ut->port);
 
-  UpnpEnableWebserver (TRUE);
+  UpnpEnableWebserver (1);
 
 #define upnp_set_callback(cb, func) \
   do {                                                            \
@@ -371,7 +371,7 @@ init_upnp (struct ushare_t *ut)
   upnp_set_callback(Write,   http_write);
   upnp_set_callback(Close,   http_close);
 
-  res = UpnpAddVirtualDir (VIRTUAL_DIR);
+  res = UpnpAddVirtualDir (VIRTUAL_DIR, NULL, NULL);
   if (res != UPNP_E_SUCCESS)
   {
     log_error (_("Cannot add virtual directory for web server\n"));
diff --git a/src/ushare.h b/src/ushare.h
index a29da01..cd86cef 100644
--- a/src/ushare.h
+++ b/src/ushare.h
@@ -125,7 +125,7 @@ struct ushare_t {
 };
 
 struct action_event_t {
-  struct Upnp_Action_Request *request;
+  UpnpActionRequest *request;
   bool status;
   struct service_t *service;
 };