Bug#1133124: evolution-data-server: evolution-source-registry crashes with microsoft-identity-broker 3.0.1

[Jonas Andradas]

Package: evolution-data-server
Version: 3.56.2-9
Followup-For: Bug #1133124
X-Debbugs-Cc: j.andradas at gmail.com

Dear Maintainer,

With the update to version 3.56.2-9, in which the issue still exists, the
debdiff provided previously would be incorrect due to the versions.  However,
the patch itself still solves the issue if reapplied to the source:

Description: Fix NULL dereference when broker returns no PRT SSO cookie
 When microsoft-identity-broker >= 3.0.1 returns an error response or omits the
 cookieName/cookieContent fields, json_object_get_string_member() returns NULL,
 causing soup_cookie_new() to return NULL. The subsequent unguarded call to
 soup_cookie_set_secure() then crashes with SIGSEGV in evolution-source-
registry
 on startup. Add a NULL check after soup_cookie_new() and propagate a
 descriptive G_IO_ERROR_INVALID_DATA error to the caller instead.
Origin: other
Bug-Debian: https://bugs.debian.org/1133124
Bug: https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/635
Forwarded: https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/635
Author: Jonas <j.andradas at gmail.com>
Last-Update: 2026-09-24

--- a/src/libedataserver/e-ms-oapxbc.c
+++ b/src/libedataserver/e-ms-oapxbc.c
@@ -372,6 +372,12 @@
                /* [ms-oapxbc] is only supported on Microsoft Entra ID */
                "login.microsoftonline.com",
                "/", -1);
+       if (!soup_cookie) {
+               g_set_error (error, G_IO_ERROR, G_IO_ERROR_INVALID_DATA,
+                       _("Failed to create PRT SSO cookie: broker response
missing cookieName or cookieContent"));
+               g_clear_object (&parser);
+               return NULL;
+       }
        soup_cookie_set_secure (soup_cookie, TRUE);
        soup_cookie_set_http_only (soup_cookie, TRUE);


Thanks,
Jonas.


-- System Information:
Debian Release: forky/sid
  APT prefers stable-security
  APT policy: (500, 'stable-security'), (500, 'unstable'), (500, 'stable'), (1, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 7.1.13+deb14-amd64 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages evolution-data-server depends on:
ii  evolution-data-server-common  3.56.2-9~jonas-identitybroker
ii  gnome-keyring                 51.1-1
ii  init-system-helpers           1.69+nmu3
ii  libc6                         2.43-6
ii  libcamel-1.2-64t64            3.56.2-9~jonas-identitybroker
ii  libcanberra-gtk3-0            0.30-20+b1
ii  libcanberra0                  0.30-20+b1
ii  libdb5.3t64                   5.3.28+dfsg2-11+b1
ii  libebackend-1.2-11t64         3.56.2-9~jonas-identitybroker
ii  libebook-1.2-21t64            3.56.2-9~jonas-identitybroker
ii  libebook-contacts-1.2-4t64    3.56.2-9~jonas-identitybroker
ii  libecal-2.0-3                 3.56.2-9~jonas-identitybroker
ii  libedata-book-1.2-27t64       3.56.2-9~jonas-identitybroker
ii  libedata-cal-2.0-2t64         3.56.2-9~jonas-identitybroker
ii  libedataserver-1.2-27t64      3.56.2-9~jonas-identitybroker
ii  libedataserverui-1.2-4t64     3.56.2-9~jonas-identitybroker
ii  libglib2.0-0t64               2.90.0-1
ii  libgoa-1.0-0b                 3.58.1-2
ii  libgtk-3-0t64                 3.24.52-1
ii  libgweather-4-0t64            4.4.4-5
ii  libical3t64                   3.0.20-3
ii  libjson-glib-1.0-0            1.10.8+ds-2+b1
ii  libldap2                      2.6.14+dfsg-2
ii  libpango-1.0-0                1.58.0-1
ii  libsecret-1-0                 0.21.7-2+b1
ii  libsoup-3.0-0                 3.6.6-1
ii  libxml2-16                    2.15.4+dfsg-1
ii  perl                          5.42.3-1

evolution-data-server recommends no packages.

Versions of packages evolution-data-server suggests:
ii  evolution  3.56.2-10+b1

-- no debconf information