Stanislav Brabec
d854ad294d
provided a fix for CVE-2025-46836 (bsc#142461), but it was fixes by the upstream in 2025 in a different way. Revert interferring net-tools-CVE-2025-46836.patch back to the upstream version. - Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58, net-tools-parse_hex-stack-overflow.patch). - Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59, net-tools-proc_gen_fmt-buffer-overflow.patch). - Avoid unsafe memcpy in ifconfig (bsc#1248687, net-tools-ifconfig-avoid-unsafe-memcpy.patch). - Prevent overflow in ax25 and netrom (bsc#1248687, ). - Keep possibility to enter long interface names, even if they are not accepted by the kernel, because it was always possible up to CVE-2025-46836 fix. But issue a warning about an interface name concatenation. OBS-URL: https://build.opensuse.org/package/show/network:utilities/net-tools?expand=0&rev=75
76 lines
2.1 KiB
Diff
76 lines
2.1 KiB
Diff
Backported to exclude f84cd22a921c25c56a6c194d4825dbd9ceea0e5f
|
|
From 84041080a5d4794045b098ced90e0309bcbcff44 Mon Sep 17 00:00:00 2001
|
|
From: Zephkeks <zephyrofficialdiscord@gmail.com>
|
|
Date: Sat, 17 May 2025 22:11:37 +0200
|
|
Subject: [PATCH] proc.c: Stack-based Buffer Overflow in net-tools
|
|
(proc_gen_fmt)
|
|
|
|
Coordinated as GHSA-w7jq-cmw2-cq59.
|
|
---
|
|
lib/proc.c | 37 ++++++++++++++++++++++++++++++++++---
|
|
1 file changed, 34 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/lib/proc.c b/lib/proc.c
|
|
index d51d09f..02aae49 100644
|
|
--- a/lib/proc.c
|
|
+++ b/lib/proc.c
|
|
@@ -17,6 +17,8 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
|
|
char buf[512], format[512] = "";
|
|
char *title, *head, *hdr;
|
|
va_list ap;
|
|
+ size_t format_len = 0;
|
|
+ size_t format_size = sizeof(format);
|
|
|
|
if (!fgets(buf, (sizeof buf) - 1, fh))
|
|
return NULL;
|
|
@@ -33,14 +35,43 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
|
|
*hdr++ = 0;
|
|
|
|
if (!strcmp(title, head)) {
|
|
- strcat(format, va_arg(ap, char *));
|
|
+ const char *arg = va_arg(ap, char *);
|
|
+ size_t arg_len = strlen(arg);
|
|
+
|
|
+ /* Check if we have enough space for format specifier + space */
|
|
+ if (format_len + arg_len + 1 >= format_size) {
|
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
|
+ va_end(ap);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ strcpy(format + format_len, arg);
|
|
+ format_len += arg_len;
|
|
+
|
|
title = va_arg(ap, char *);
|
|
if (!title || !head)
|
|
break;
|
|
} else {
|
|
- strcat(format, "%*s"); /* XXX */
|
|
+ /* Check if we have enough space for "%*s" */
|
|
+ if (format_len + 3 >= format_size) {
|
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
|
+ va_end(ap);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ strcpy(format + format_len, "%*s");
|
|
+ format_len += 3;
|
|
}
|
|
- strcat(format, " ");
|
|
+
|
|
+ /* Check if we have space for the trailing space */
|
|
+ if (format_len + 1 >= format_size) {
|
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
|
+ va_end(ap);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ format[format_len++] = ' ';
|
|
+ format[format_len] = '\0';
|
|
}
|
|
va_end(ap);
|
|
|
|
--
|
|
2.48.1
|
|
|