58ba99ebdd
- Drop 0002-Do-not-warn-about-interface-socket-not-binded.patch. It worked around a net-tools-1.60 specific problem, that does not happen in net-tools-2.10. It is more harmful than useful, as it can hide real problems. (bsc#430864#c15, https://github.com/ecki/net-tools/issues/32#issuecomment-3265471116). - Drop 0004-By-default-do-not-fopen-anything-in-netrom_gr.patch. It was net-tools-1.60 specific leak fix and breaks netrom in net-tools-2.10 (bnc#544339#c2). - Drop old Fedora patch 0006-Allow-interface-stacking.patch. It provided a fix for CVE-2025-46836 (bsc#142461), but it was fixes by the upstream in 2025 in a different way. Revert interferring net-tools-CVE-2025-46836.patch back to the upstream version. - Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58, net-tools-parse_hex-stack-overflow.patch). - Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59, net-tools-proc_gen_fmt-buffer-overflow.patch). - Avoid unsafe memcpy in ifconfig (bsc#1248687, net-tools-ifconfig-avoid-unsafe-memcpy.patch). - Prevent overflow in ax25 and netrom (bsc#1248687, net-tools-ax25+netrom-overflow-1.patch, net-tools-ax25+netrom-overflow-2.patch). - Keep possibility to enter long interface names, even if they are not accepted by the kernel, because it was always possible up to CVE-2025-46836 fix. But issue a warning about an interface name concatenation (bsc#1248410, net-tools-ifconfig-long-name-warning.patch).
57 lines
1.5 KiB
Diff
57 lines
1.5 KiB
Diff
From a7926399a04ee8e629a02a2aeb6de1952d42d559 Mon Sep 17 00:00:00 2001
|
|
From: Bernd Eckenfels <net-tools@lina.inka.de>
|
|
Date: Sat, 17 May 2025 21:11:07 +0200
|
|
Subject: [PATCH] ipmaddr.c: Stack-based buffer Overflow in parse_hex()
|
|
|
|
Coordinated as GHSA-h667-qrp8-gj58.
|
|
---
|
|
ipmaddr.c | 10 +++++-----
|
|
1 file changed, 5 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/ipmaddr.c b/ipmaddr.c
|
|
index 64b7564..623fadd 100644
|
|
--- a/ipmaddr.c
|
|
+++ b/ipmaddr.c
|
|
@@ -91,17 +91,17 @@ static int parse_lla(char *str, char *addr)
|
|
return len;
|
|
}
|
|
|
|
-static int parse_hex(char *str, unsigned char *addr)
|
|
+static int parse_hex(char *str, unsigned char *dst, size_t dstlen)
|
|
{
|
|
int len=0;
|
|
|
|
- while (*str) {
|
|
+ while (len < dstlen && *str) {
|
|
int tmp;
|
|
if (str[1] == 0)
|
|
return -1;
|
|
if (sscanf(str, "%02x", &tmp) != 1)
|
|
return -1;
|
|
- addr[len] = tmp;
|
|
+ dst[len] = tmp;
|
|
len++;
|
|
str += 2;
|
|
}
|
|
@@ -152,7 +152,7 @@ void read_dev_mcast(struct ma_info **result_p)
|
|
|
|
m.addr.family = AF_PACKET;
|
|
|
|
- len = parse_hex(hexa, (unsigned char*)&m.addr.data);
|
|
+ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data));
|
|
if (len >= 0) {
|
|
struct ma_info *ma = xmalloc(sizeof(m));
|
|
memcpy(ma, &m, sizeof(m));
|
|
@@ -222,7 +222,7 @@ void read_igmp6(struct ma_info **result_p)
|
|
|
|
m.addr.family = AF_INET6;
|
|
|
|
- len = parse_hex(hexa, (unsigned char*)&m.addr.data);
|
|
+ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data));
|
|
if (len >= 0) {
|
|
struct ma_info *ma = xmalloc(sizeof(m));
|
|
memcpy(ma, &m, sizeof(m));
|
|
--
|
|
2.48.1
|
|
|