mikebrady/shairport-sync 5.5

Version 5.5 -- Security Updates

on GitHub

This update is recommended for all users of Shairport Sync.

Note:
The version number has been bumped from 5.2.3 to 5.5 to harmonise version numbers across release and development branches, so that it can be stated that "these security updates apply to any version of Shairport Sync from 5.5 onwards".

Security Updates

This update contains important security updates:

• An AirPlay 2 client could crash Shairport Sync by sending a SETUP request whose timingPeerInfo.Addresses array contains a non-string element. Fixed by improved checking.

• The AirPlay-2 SETUP shk (session key) value's length was not validated, so a short shk could cause an out-of-bounds read, potentially leaking information or causing a crash. Fixed by improved validation.

• On a classic-AirPlay session using the (deprecated) Hammerton decoder that negotiates an uncompressed PCM session, the audio buffer is sized for exactly one packet, but the decode copy was bounded by the received packet length and was not checked against the allocation. Thus, a single oversized UDP audio packet could overflow the heap with attacker-controlled data. Fixed by extra bounds checking.

  Note that use of the Hammerton decoder continues to be deprecated for security reasons.

• A unauthenticated client on an AirPlay 2 receiver could overflow a stack buffer by sending an RTSP request with an unrecognised method and a large body. Fixed by sizing the buffer correctly.

• A remote, unauthenticated client could crash the daemon with a two-byte pairing message. Fixed by improved operand checking.

• A number of updates have been made for classic-AirPlay builds that use the (deprecated) tinysvcmdns mDNS library.

  Note that the tinysvcmdns library is no longer maintained upstream, and its use is strongly deprecated for security reasons.

Sincere thanks to Haavar Valeur for these security reports and fixes.