This commit is contained in:
Reinhard Max
Git OBS Bridge
parent
ccc8eeefa0
commit
5fa347475a
33
dnsmasq-CVE-2019-14834.patch
Normal file
33
dnsmasq-CVE-2019-14834.patch
Normal file
@ -0,0 +1,33 @@
|
||||
X-Git-Url: http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blobdiff_plain;f=src%2Fhelper.c;h=c392eeced3e73762d3ea6a2f9fa27ab5ae389241;hp=33ba120ab39e3788719a18796b5b58338972e1e8;hb=69bc94779c2f035a9fffdb5327a54c3aeca73ed5;hpb=3052ce208acf602f0163166dcefb7330d537cedb
|
||||
|
||||
--- src/helper.c.orig
|
||||
+++ src/helper.c
|
||||
@@ -82,7 +82,8 @@ int create_helper(int event_fd, int err_
|
||||
pid_t pid;
|
||||
int i, pipefd[2];
|
||||
struct sigaction sigact;
|
||||
-
|
||||
+ unsigned char *alloc_buff = NULL;
|
||||
+
|
||||
/* create the pipe through which the main program sends us commands,
|
||||
then fork our process. */
|
||||
if (pipe(pipefd) == -1 || !fix_fd(pipefd[1]) || (pid = fork()) == -1)
|
||||
@@ -188,11 +189,16 @@ int create_helper(int event_fd, int err_
|
||||
struct script_data data;
|
||||
char *p, *action_str, *hostname = NULL, *domain = NULL;
|
||||
unsigned char *buf = (unsigned char *)daemon->namebuff;
|
||||
- unsigned char *end, *extradata, *alloc_buff = NULL;
|
||||
+ unsigned char *end, *extradata;
|
||||
int is6, err = 0;
|
||||
int pipeout[2];
|
||||
|
||||
- free(alloc_buff);
|
||||
+ /* Free rarely-allocated memory from previous iteration. */
|
||||
+ if (alloc_buff)
|
||||
+ {
|
||||
+ free(alloc_buff);
|
||||
+ alloc_buff = NULL;
|
||||
+ }
|
||||
|
||||
/* we read zero bytes when pipe closed: this is our signal to exit */
|
||||
if (!read_write(pipefd[0], (unsigned char *)&data, sizeof(data), 1))
|
||||
@ -1,3 +1,12 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Nov 13 10:46:21 UTC 2019 - Reinhard Max <max@suse.com>
|
||||
|
||||
- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
|
||||
memory leak in the create_helper() function in /src/helper.c
|
||||
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
|
||||
- Package contrib/lease-tools/dhcp_release6.
|
||||
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Sep 4 18:47:39 UTC 2019 - Stefan Brüns <stefan.bruens@rwth-aachen.de>
|
||||
|
||||
|
||||
25
dnsmasq.spec
25
dnsmasq.spec
@ -35,6 +35,7 @@ Patch0: dnsmasq-groups.patch
|
||||
Patch1: 0001-fix-build-after-y2038-changes-in-glibc.patch
|
||||
# PATCH-FIX-UPSTREAM -- http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=ab73a746a0d6fcac2e682c5548eeb87fb9c9c82e
|
||||
Patch2: Fix-build-with-libnettle-3.5.patch
|
||||
Patch3: dnsmasq-CVE-2019-14834.patch
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
BuildRequires: dbus-1-devel
|
||||
BuildRequires: dos2unix
|
||||
@ -45,7 +46,7 @@ BuildRequires: pkg-config
|
||||
BuildRequires: pkgconfig(libnetfilter_conntrack)
|
||||
BuildRequires: pkgconfig(systemd)
|
||||
Requires(pre): group(nogroup)
|
||||
Requires(pre): /usr/sbin/useradd
|
||||
Requires(pre): user(tftp)
|
||||
|
||||
%description
|
||||
Dnsmasq provides network infrastructure for small networks: DNS,
|
||||
@ -69,6 +70,7 @@ server's leases.
|
||||
%patch0
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3
|
||||
|
||||
# Remove the executable bit from python example files to
|
||||
# avoid unwanted automatic dependencies
|
||||
@ -86,7 +88,7 @@ sed -i -e 's|\(PREFIX *= *\)/usr/local|\1/usr|;
|
||||
sed -i -e 's|lua5.2|lua5.3|' Makefile
|
||||
|
||||
# SED-FIX-UPSTREAM -- Fix man page
|
||||
sed -i -e 's|The defaults to "dip",|The default is "nogroup",|' \
|
||||
sed -i -e 's|The default is "dip",|The default is "nogroup",|' \
|
||||
man/dnsmasq.8
|
||||
|
||||
# SED-FIX-UPSTREAM -- Fix cachesize, group and user
|
||||
@ -95,8 +97,9 @@ sed -i -e 's|CACHESIZ 150|CACHESIZ 2000|;
|
||||
s|CHGRP "dip"|CHGRP "nogroup"|' \
|
||||
src/config.h
|
||||
|
||||
# Fix trust-anchor.conf location
|
||||
# Fix trust-anchor.conf location and include /etc/dnsmasq.d/*.conf by default
|
||||
sed -i -e '/trust-anchors.conf/c\#conf-file=/etc/dnsmasq.d/trust-anchors.conf' \
|
||||
-e '/conf-dir=.*conf/s/^\#//' \
|
||||
dnsmasq.conf.example
|
||||
|
||||
%build
|
||||
@ -107,16 +110,8 @@ export LDFLAGS="-Wl,-z,relro,-z,now -pie"
|
||||
# same flags for make and make install, else everything gets recompiled
|
||||
%define _copts "-DHAVE_DBUS -DHAVE_CONNTRACK -DHAVE_LIBIDN2 -DHAVE_DNSSEC -DHAVE_LUASCRIPT"
|
||||
make %{?_smp_mflags} AWK=gawk all-i18n CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS" COPTS=%{_copts}
|
||||
make -C contrib/lease-tools %{?_smp_mflags}
|
||||
|
||||
%pre
|
||||
if ! /usr/bin/getent group tftp >/dev/null; then
|
||||
%{_sbindir}/groupadd -r tftp
|
||||
fi
|
||||
if ! /usr/bin/getent passwd tftp >/dev/null; then
|
||||
%{_sbindir}/useradd -c "TFTP account" -d /srv/tftpboot -G tftp -g tftp \
|
||||
-r -s /bin/false tftp
|
||||
fi
|
||||
if ! /usr/bin/getent passwd dnsmasq >/dev/null; then
|
||||
/usr/sbin/useradd -r -d /var/lib/empty -s /bin/false -c "dnsmasq" -g nogroup -G tftp dnsmasq
|
||||
fi
|
||||
@ -149,18 +144,20 @@ install -m 644 %SOURCE3 %{buildroot}/%{_sysconfdir}/slp.reg.d/
|
||||
install -d 755 %{buildroot}/etc/dbus-1/system.d/
|
||||
install -m 644 dbus/dnsmasq.conf %{buildroot}/etc/dbus-1/system.d/dnsmasq.conf
|
||||
install -D -m 0644 %SOURCE4 %{buildroot}%{_unitdir}/dnsmasq.service
|
||||
install -d -m 0755 %{buildroot}/srv/tftpboot
|
||||
ln -sf %{_sbindir}/service %{buildroot}/usr/sbin/rcdnsmasq
|
||||
install -d -m 755 %{buildroot}/%{_sysconfdir}/dnsmasq.d
|
||||
install -m 644 trust-anchors.conf %{buildroot}/%{_sysconfdir}/dnsmasq.d/trust-anchors.conf
|
||||
|
||||
# utils subpackage
|
||||
mkdir -p %{buildroot}/%{_bindir} %{buildroot}/%{_mandir}/man1
|
||||
make -C contrib/lease-tools %{?_smp_mflags}
|
||||
install -m 755 contrib/lease-tools/dhcp_release %{buildroot}/%{_bindir}/dhcp_release
|
||||
install -m 644 contrib/lease-tools/dhcp_release.1 %{buildroot}/%{_mandir}/man1/dhcp_release.1
|
||||
install -m 755 contrib/lease-tools/dhcp_release6 %{buildroot}/%{_bindir}/dhcp_release6
|
||||
install -m 644 contrib/lease-tools/dhcp_release6.1 %{buildroot}/%{_mandir}/man1/dhcp_release6.1
|
||||
install -m 755 contrib/lease-tools/dhcp_lease_time %{buildroot}/%{_bindir}/dhcp_lease_time
|
||||
install -m 644 contrib/lease-tools/dhcp_lease_time.1 %{buildroot}/%{_mandir}/man1/dhcp_lease_time.1
|
||||
rm contrib/lease-tools/{dhcp_release,dhcp_lease_time}
|
||||
make -C contrib/lease-tools clean
|
||||
rm -rf contrib/Suse
|
||||
rm -rf contrib/Solaris10
|
||||
rm -rf contrib/dnsmasq_MacOSX-pre10.4
|
||||
@ -183,8 +180,6 @@ rm -rf contrib/MacOSX-launchd
|
||||
%dir %{_sysconfdir}/dnsmasq.d
|
||||
%config(noreplace) %{_sysconfdir}/dnsmasq.d/trust-anchors.conf
|
||||
|
||||
%dir %attr(0755,tftp,tftp) /srv/tftpboot
|
||||
|
||||
%files utils
|
||||
%{_bindir}/dhcp_*
|
||||
%{_mandir}/man1/dhcp_*
|
||||
|
||||
Loading…
Reference in New Issue
Block a user