ppp/ppp-CVE-2015-3310.patch

--- pppd/plugins/radius/util.c.orig
+++ pppd/plugins/radius/util.c
@@ -77,7 +77,7 @@ rc_mksid (void)
   static unsigned short int cnt = 0;
   sprintf (buf, "%08lX%04X%02hX",
 	   (unsigned long int) time (NULL),
-	   (unsigned int) getpid (),
+	   (unsigned int) getpid () % 65535,
 	   cnt & 0xFF);
   cnt++;
   return buf;
- New version 2.4.8. * New pppd options have been added: * ifname, to set the name for the PPP interface device * defaultroute-metric, to set the metric for the default route * defaultroute6, to add an IPv6 default route (with nodefaultroute6 to prevent adding an IPv6 default route). * up_sdnotify, to have pppd notify systemd when the link is up. * The rp-pppoe plugin has new options: * host-uniq, to set the Host-Uniq value to send * pppoe-padi-timeout, to set the timeout for discovery packets * pppoe-padi-attempts, to set the number of discovery attempts. * Added the CLASS attribute in radius packets. * Fixed warnings and issues found by static analysis. - Obsoleted patches: [...] - Patches that got renamed, because they needed rediffing: [...] - bsc#1172916: Fix an outdated comment for lcp-echo-interval. OBS-URL: https://build.opensuse.org/package/show/network/ppp?expand=0&rev=60 2020-08-03 15:45:36 +00:00			`--- pppd/plugins/radius/util.c.orig`
- bnc#927841, CVE-2015-3310: Fix buffer overflow in radius plug-in's rc_mksid(). OBS-URL: https://build.opensuse.org/package/show/network/ppp?expand=0&rev=32 2015-11-13 15:39:47 +00:00			`+++ pppd/plugins/radius/util.c`
			`@@ -77,7 +77,7 @@ rc_mksid (void)`
			`static unsigned short int cnt = 0;`
			`sprintf (buf, "%08lX%04X%02hX",`
			`(unsigned long int) time (NULL),`
			`- (unsigned int) getpid (),`
			`+ (unsigned int) getpid () % 65535,`
			`cnt & 0xFF);`
			`cnt++;`
			`return buf;`