[gupnp] service: Limit number of call-backs to 6

[Jens Georg <jensgeorg src gnome org>]

commit 31b77b114b80b81f0fa0b004760126864d3bb3f2
Author: Jens Georg <mail jensge org>
Date:   Thu Jun 18 20:38:17 2020 +0200

    service: Limit number of call-backs to 6

 libgupnp/gupnp-service.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
---
diff --git a/libgupnp/gupnp-service.c b/libgupnp/gupnp-service.c
index cf90a0c..a6e7532 100644
--- a/libgupnp/gupnp-service.c
+++ b/libgupnp/gupnp-service.c
@@ -1223,6 +1223,7 @@ subscribe (GUPnPService *service,
         char *start, *end;
         GUPnPServicePrivate *priv;
         GUPnPContext *context;
+        int callbacks = 0;
 
         priv = gupnp_service_get_instance_private (service);
         context = gupnp_service_info_get_context
@@ -1232,7 +1233,10 @@ subscribe (GUPnPService *service,
 
         /* Parse callback list */
         start = (char *) callback;
-        while ((start = strchr (start, '<'))) {
+
+        // Arbitrarily limit the list of callbacks to 6
+        // Part of CVE-2020-12695 mitigation
+        while (callbacks < 6 && (start = strchr (start, '<'))) {
                 start += 1;
                 if (!start || !*start)
                         break;
@@ -1258,6 +1262,7 @@ subscribe (GUPnPService *service,
                 *end = '>';
 
                 start = end;
+                callbacks++;
         }
 
         if (!data->callbacks) {