From 23aeddf9618bd8ad6bb1b7336886d66e975b6244 Mon Sep 17 00:00:00 2001
From: Nathan Owens <ndowens04@gmail.com>
Date: Wed, 8 Jan 2020 23:15:05 -0600
Subject: [PATCH] dnsmasq: patch for CVE-2019-14834

---
 srcpkgs/dnsmasq/patches/CVE-2019-14834.patch | 45 ++++++++++++++++++++
 srcpkgs/dnsmasq/template                     |  2 +-
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 srcpkgs/dnsmasq/patches/CVE-2019-14834.patch

diff --git a/srcpkgs/dnsmasq/patches/CVE-2019-14834.patch b/srcpkgs/dnsmasq/patches/CVE-2019-14834.patch
new file mode 100644
index 00000000000..77748e31bdc
--- /dev/null
+++ b/srcpkgs/dnsmasq/patches/CVE-2019-14834.patch
@@ -0,0 +1,45 @@
+From 69bc94779c2f035a9fffdb5327a54c3aeca73ed5 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 14 Aug 2019 20:44:50 +0100
+Subject: [PATCH] Fix memory leak in helper.c
+
+Thanks to Xu Mingjie <xumingjie1995@outlook.com> for spotting this.
+---
+ src/helper.c |   12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/src/helper.c b/src/helper.c
+index 33ba120..c392eec 100644
+--- src/helper.c
++++ src/helper.c
+@@ -80,7 +80,8 @@ int create_helper(int event_fd, int err_fd, uid_t uid, gid_t gid, long max_fd)
+   pid_t pid;
+   int i, pipefd[2];
+   struct sigaction sigact;
+-
++  unsigned char *alloc_buff = NULL;
++
+   /* create the pipe through which the main program sends us commands,
+      then fork our process. */
+   if (pipe(pipefd) == -1 || !fix_fd(pipefd[1]) || (pid = fork()) == -1)
+@@ -186,11 +187,16 @@ int create_helper(int event_fd, int err_fd, uid_t uid, gid_t gid, long max_fd)
+       struct script_data data;
+       char *p, *action_str, *hostname = NULL, *domain = NULL;
+       unsigned char *buf = (unsigned char *)daemon->namebuff;
+-      unsigned char *end, *extradata, *alloc_buff = NULL;
++      unsigned char *end, *extradata;
+       int is6, err = 0;
+       int pipeout[2];
+
+-      free(alloc_buff);
++      /* Free rarely-allocated memory from previous iteration. */
++      if (alloc_buff)
++	{
++	  free(alloc_buff);
++	  alloc_buff = NULL;
++	}
+
+       /* we read zero bytes when pipe closed: this is our signal to exit */
+       if (!read_write(pipefd[0], (unsigned char *)&data, sizeof(data), 1))
+--
+1.7.10.4
diff --git a/srcpkgs/dnsmasq/template b/srcpkgs/dnsmasq/template
index 946e9792655..a4e6be72e78 100644
--- a/srcpkgs/dnsmasq/template
+++ b/srcpkgs/dnsmasq/template
@@ -1,7 +1,7 @@
 # Template file for 'dnsmasq'
 pkgname=dnsmasq
 version=2.80
-revision=6
+revision=7
 conf_files="/etc/dnsmasq.conf"
 hostmakedepends="pkg-config"
 makedepends="dbus-devel libcap-devel libidn2-devel $(vopt_if dnssec nettle-devel)"