[rpms/isns-utils] rawhide: CVE-2026-55995: Denial of Service via double-free in iSNS attribute decoder (rhbz#2508456)

[rpms/isns-utils] rawhide: CVE-2026-55995: Denial of Service via double-free in iSNS attribute decoder (rhbz#2508456)

[Chris Leech]

            A new commit has been pushed.

            Repo   : rpms/isns-utils
            Branch : rawhide
            Commit : 9939d99242ecece582e98e37bf6ceb30fc69e338
            Author : Chris Leech <cleech@redhat.com>
            Date   : 2026-07-29T15:41:00-07:00
            Stats  : +40/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/isns-utils/c/9939d99242ecece582e98e37bf6ceb30fc69e338?branch=rawhide

            Log:
            CVE-2026-55995: Denial of Service via double-free in iSNS attribute decoder (rhbz#2508456)

Signed-off-by: Chris Leech <cleech@redhat.com>

---
diff --git a/0001-Fix-issue-in-error-path-causing-double-free.patch b/0001-Fix-issue-in-error-path-causing-double-free.patch
new file mode 100644
index 0000000..7025a92
--- /dev/null
+++ b/0001-Fix-issue-in-error-path-causing-double-free.patch
@@ -0,0 +1,39 @@
+From 56718d4e9d1a4f51c30697b5c0534144bb41c9bb Mon Sep 17 00:00:00 2001
+From: Lee Duncan <lduncan@suse.com>
+Date: Tue, 28 Jul 2026 11:07:24 -0700
+Subject: [PATCH 1/1] Fix issue in error path causing double-free.
+
+In attrs.c, when buf_get() fails and allocated memory is
+freed, we also need to set the pointer to that memory to
+NULL, to prevent a double free from occuring, would could
+lead to a DoS attack.
+
+References: CVE-2026-55995
+Found-by: <keith@linnemanlabs.com>
+---
+ attrs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/attrs.c b/attrs.c
+index a12c222..15c930d 100644
+--- a/attrs.c
++++ b/attrs.c
+@@ -1371,6 +1371,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value)
+ 	value->iv_string = isns_malloc(len + 1);
+ 	if (!buf_get(bp, value->iv_string, len)) {
+ 		isns_free(value->iv_string);
++		value->iv_string = NULL;
+ 		return 0;
+ 	}
+ 	value->iv_string[len] = '\0';
+@@ -1546,6 +1547,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value)
+ 	value->iv_opaque.ptr = isns_malloc(len);
+ 	if (!buf_get(bp, value->iv_opaque.ptr, len)) {
+ 		isns_free(value->iv_opaque.ptr);
++		value->iv_opaque.ptr = NULL;
+ 		return 0;
+ 	}
+ 
+-- 
+2.55.0
+

diff --git a/isns-utils.spec b/isns-utils.spec
index f7cc372..e1d12ea 100644
--- a/isns-utils.spec
+++ b/isns-utils.spec
@@ -8,6 +8,7 @@ URL:            https://github.com/open-iscsi/open-isns
 Source0:        https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz
 Source1:        isnsd.service
 Patch1:         test_as_installed.patch
+Patch2:         0001-Fix-issue-in-error-path-causing-double-free.patch
 
 BuildRequires:  gcc
 BuildRequires:  pkgconfig systemd-devel systemd