58ba99ebdd
- Drop 0002-Do-not-warn-about-interface-socket-not-binded.patch. It worked around a net-tools-1.60 specific problem, that does not happen in net-tools-2.10. It is more harmful than useful, as it can hide real problems. (bsc#430864#c15, https://github.com/ecki/net-tools/issues/32#issuecomment-3265471116). - Drop 0004-By-default-do-not-fopen-anything-in-netrom_gr.patch. It was net-tools-1.60 specific leak fix and breaks netrom in net-tools-2.10 (bnc#544339#c2). - Drop old Fedora patch 0006-Allow-interface-stacking.patch. It provided a fix for CVE-2025-46836 (bsc#142461), but it was fixes by the upstream in 2025 in a different way. Revert interferring net-tools-CVE-2025-46836.patch back to the upstream version. - Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58, net-tools-parse_hex-stack-overflow.patch). - Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59, net-tools-proc_gen_fmt-buffer-overflow.patch). - Avoid unsafe memcpy in ifconfig (bsc#1248687, net-tools-ifconfig-avoid-unsafe-memcpy.patch). - Prevent overflow in ax25 and netrom (bsc#1248687, net-tools-ax25+netrom-overflow-1.patch, net-tools-ax25+netrom-overflow-2.patch). - Keep possibility to enter long interface names, even if they are not accepted by the kernel, because it was always possible up to CVE-2025-46836 fix. But issue a warning about an interface name concatenation (bsc#1248410, net-tools-ifconfig-long-name-warning.patch).
76 lines
2.1 KiB
Diff
76 lines
2.1 KiB
Diff
Backported to exclude f84cd22a921c25c56a6c194d4825dbd9ceea0e5f
|
|
From 84041080a5d4794045b098ced90e0309bcbcff44 Mon Sep 17 00:00:00 2001
|
|
From: Zephkeks <zephyrofficialdiscord@gmail.com>
|
|
Date: Sat, 17 May 2025 22:11:37 +0200
|
|
Subject: [PATCH] proc.c: Stack-based Buffer Overflow in net-tools
|
|
(proc_gen_fmt)
|
|
|
|
Coordinated as GHSA-w7jq-cmw2-cq59.
|
|
---
|
|
lib/proc.c | 37 ++++++++++++++++++++++++++++++++++---
|
|
1 file changed, 34 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/lib/proc.c b/lib/proc.c
|
|
index d51d09f..02aae49 100644
|
|
--- a/lib/proc.c
|
|
+++ b/lib/proc.c
|
|
@@ -17,6 +17,8 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
|
|
char buf[512], format[512] = "";
|
|
char *title, *head, *hdr;
|
|
va_list ap;
|
|
+ size_t format_len = 0;
|
|
+ size_t format_size = sizeof(format);
|
|
|
|
if (!fgets(buf, (sizeof buf) - 1, fh))
|
|
return NULL;
|
|
@@ -33,14 +35,43 @@ char *proc_gen_fmt(const char *name, int more, FILE * fh,...)
|
|
*hdr++ = 0;
|
|
|
|
if (!strcmp(title, head)) {
|
|
- strcat(format, va_arg(ap, char *));
|
|
+ const char *arg = va_arg(ap, char *);
|
|
+ size_t arg_len = strlen(arg);
|
|
+
|
|
+ /* Check if we have enough space for format specifier + space */
|
|
+ if (format_len + arg_len + 1 >= format_size) {
|
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
|
+ va_end(ap);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ strcpy(format + format_len, arg);
|
|
+ format_len += arg_len;
|
|
+
|
|
title = va_arg(ap, char *);
|
|
if (!title || !head)
|
|
break;
|
|
} else {
|
|
- strcat(format, "%*s"); /* XXX */
|
|
+ /* Check if we have enough space for "%*s" */
|
|
+ if (format_len + 3 >= format_size) {
|
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
|
+ va_end(ap);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ strcpy(format + format_len, "%*s");
|
|
+ format_len += 3;
|
|
}
|
|
- strcat(format, " ");
|
|
+
|
|
+ /* Check if we have space for the trailing space */
|
|
+ if (format_len + 1 >= format_size) {
|
|
+ fprintf(stderr, "warning: format buffer overflow in %s\n", name);
|
|
+ va_end(ap);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ format[format_len++] = ' ';
|
|
+ format[format_len] = '\0';
|
|
}
|
|
va_end(ap);
|
|
|
|
--
|
|
2.48.1
|
|
|