Sync changes to SLFO-1.2 branch

OBS-URL: https://build.opensuse.org/request/show/1283388
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/iputils?expand=0&rev=74

iputils-20240117.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:2c3f1f4d6f2481dec05b441de9c81d4059bdb202d4d0e98404f62ee1502bf1dc
-size 445684

iputils-CVE-2025-47268.patch

@@ -0,0 +1,134 @@
+From 7ec315109dfa20d7734033ff5ffabf44d5ae8ddd Mon Sep 17 00:00:00 2001
+From: Petr Vorel <pvorel@suse.cz>
+Date: Mon, 5 May 2025 23:55:57 +0200
+Subject: [PATCH] ping: Fix signed 64-bit integer overflow in RTT calculation
+
+Crafted ICMP Echo Reply packet can cause signed integer overflow in
+
+1) triptime calculation:
+triptime = tv->tv_sec * 1000000 + tv->tv_usec;
+
+2) tsum2 increment which uses triptime
+rts->tsum2 += (double)((long long)triptime * (long long)triptime);
+
+3) final tmvar:
+tmvar = (rts->tsum2 / total) - (tmavg * tmavg)
+
+    $ export CFLAGS="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer"
+    $ export LDFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
+    $ meson setup .. -Db_sanitize=address,undefined
+    $ ninja
+    $ ./ping/ping -c2 127.0.0.1
+
+    PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
+    64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.061 ms
+    ../ping/ping_common.c:757:25: runtime error: signed integer overflow: -2513732689199106 * 1000000 cannot be represented in type 'long int'
+    ../ping/ping_common.c:757:12: runtime error: signed integer overflow: -4975495174606980224 + -6510615555425289427 cannot be represented in type 'long int'
+    ../ping/ping_common.c:769:47: runtime error: signed integer overflow: 6960633343677281965 * 6960633343677281965 cannot be represented in type 'long int'
+    24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
+    ./ping/ping: Warning: time of day goes back (-7256972569576721377us), taking countermeasures
+    ./ping/ping: Warning: time of day goes back (-7256972569576721232us), taking countermeasures
+    24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
+    ../ping/ping_common.c:265:16: runtime error: signed integer overflow: 6960633343677281965 * 2 cannot be represented in type 'long int'
+    64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.565 ms
+
+    --- 127.0.0.1 ping statistics ---
+    2 packets transmitted, 2 received, +2 duplicates, 0% packet loss, time 1002ms
+    ../ping/ping_common.c:940:42: runtime error: signed integer overflow: 1740158335919320832 * 1740158335919320832 cannot be represented in type 'long int'
+    rtt min/avg/max/mdev = 0.000/1740158335919320.832/6960633343677281.965/-1623514645242292.-224 ms
+
+To fix the overflow check allowed ranges of struct timeval members:
+* tv_sec <0, LONG_MAX/1000000>
+* tv_usec <0, 999999>
+
+Fix includes 2 new error messages (needs translation).
+Also existing message "time of day goes back ..." needed to be modified
+as it now prints tv->tv_sec which is a second (needs translation update).
+
+After fix:
+
+    $ ./ping/ping -c2 127.0.0.1
+    64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.057 ms
+    ./ping/ping: Warning: invalid tv_usec -6510615555424928611 us
+    ./ping/ping: Warning: time of day goes back (-3985394643238914 s), taking countermeasures
+    ./ping/ping: Warning: invalid tv_usec -6510615555424928461 us
+    ./ping/ping: Warning: time of day goes back (-3985394643238914 s), taking countermeasures
+    24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
+    ./ping/ping: Warning: invalid tv_usec -6510615555425884541 us
+    ./ping/ping: Warning: time of day goes back (-4243165695442945 s), taking countermeasures
+    24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
+    64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.111 ms
+
+    --- 127.0.0.1 ping statistics ---
+    2 packets transmitted, 2 received, +2 duplicates, 0% packet loss, time 101ms
+    rtt min/avg/max/mdev = 0.000/0.042/0.111/0.046 ms
+
+Fixes: https://github.com/iputils/iputils/issues/584
+Fixes: CVE-2025-472
+Link: https://github.com/Zephkek/ping-rtt-overflow/
+Co-developed-by: Cyril Hrubis <chrubis@suse.cz>
+Reported-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Reviewed-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
+Reviewed-by: Noah Meyerhans <noahm@debian.org>
+[ pvorel: backport of upstream 070cfacd7348386173231fb16fad4983d4e6ae40 to 20221126 ]
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+---
+ iputils_common.h   |  3 +++
+ ping/ping_common.c | 22 +++++++++++++++++++---
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+Index: iputils-20240905/iputils_common.h
+===================================================================
+--- iputils-20240905.orig/iputils_common.h
++++ iputils-20240905/iputils_common.h
+@@ -10,6 +10,9 @@
+ 	  !!__builtin_types_compatible_p(__typeof__(arr), \
+ 					 __typeof__(&arr[0]))])) * 0)
+ 
++/* 1000001 = 1000000 tv_sec + 1 tv_usec */
++#define TV_SEC_MAX_VAL (LONG_MAX/1000001)
++
+ #ifdef __GNUC__
+ # define iputils_attribute_format(t, n, m) __attribute__((__format__ (t, n, m)))
+ #else
+Index: iputils-20240905/ping/ping_common.c
+===================================================================
+--- iputils-20240905.orig/ping/ping_common.c
++++ iputils-20240905/ping/ping_common.c
+@@ -754,16 +754,32 @@ int gather_statistics(struct ping_rts *r
+ 
+ restamp:
+ 		tvsub(tv, &tmp_tv);
+-		triptime = tv->tv_sec * 1000000 + tv->tv_usec;
+-		if (triptime < 0) {
+-			error(0, 0, _("Warning: time of day goes back (%ldus), taking countermeasures"), triptime);
++
++		if (tv->tv_usec >= 1000000) {
++			error(0, 0, _("Warning: invalid tv_usec %ld us"), tv->tv_usec);
++			tv->tv_usec = 999999;
++		}
++
++		if (tv->tv_usec < 0) {
++			error(0, 0, _("Warning: invalid tv_usec %ld us"), tv->tv_usec);
++			tv->tv_usec = 0;
++		}
++
++		if (tv->tv_sec > TV_SEC_MAX_VAL) {
++			error(0, 0, _("Warning: invalid tv_sec %ld s"), tv->tv_sec);
++			triptime = 0;
++		} else if (tv->tv_sec < 0) {
++			error(0, 0, _("Warning: time of day goes back (%ld s), taking countermeasures"), tv->tv_sec);
+ 			triptime = 0;
+ 			if (!rts->opt_latency) {
+ 				gettimeofday(tv, NULL);
+ 				rts->opt_latency = 1;
+ 				goto restamp;
+ 			}
++		} else {
++			triptime = tv->tv_sec * 1000000 + tv->tv_usec;
+ 		}
++
+ 		if (!csfailed) {
+ 			rts->tsum += triptime;
+ 			rts->tsum2 += (double)((long long)triptime * (long long)triptime);

iputils-CVE-2025-48964_01.patch

@@ -0,0 +1,67 @@
+From f4f57679b736367716389d05187bab40666b521d Mon Sep 17 00:00:00 2001
+From: Petr Vorel <pvorel@suse.cz>
+Date: Fri, 9 May 2025 11:07:02 +0200
+Subject: [PATCH 1/4] ping: Fix integer overflow in large -s and -l values
+
+Maximum of preload value (-l) is 65536, but due multiplication with
+packat size (-s) there can be integer overflow:
+
+    $ export CFLAGS="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer"
+    $ meson setup ..
+    $ ninja && sudo ./ping/ping -c1 -l 65536 -s 30000 ::1
+    ../ping/ping_common.c:451:24: runtime error: signed integer overflow: 65536 * 46528 cannot be represented in type 'int'
+    PING ::1 (::1) 30000 data bytes
+    30008 bytes from ::1: icmp_seq=1 ttl=64 time=0.052 ms
+
+Because setsockopt() requires int, instead of making hold and rcvbuf
+variables bigger (long int) limit them to INT_MAX. This will often lead
+to warning about rcvbuf is not enough to hold preload, because on
+current kernel 6.14 and ICMP datagram socket is the max. socket buffer
+size 425984, but probably better not to depend on this value.
+
+After fix:
+
+    $ sudo ./ping/ping -c1 -l 65536 -s 30000 127.0.0.1
+    ./ping/ping: WARNING: buffer size overflow, reduce packet size or preload
+    ./ping/ping: WARNING: probably, rcvbuf is not enough to hold preload
+    PING 127.0.0.1 (127.0.0.1) 30000(30028) bytes of data.
+    30008 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.053 ms
+
+Link: https://github.com/iputils/iputils/pull/585#pullrequestreview-2820034501
+Closes: https://github.com/iputils/iputils/pull/586
+Reported-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Suggested-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
+[ pvorel: backport of upstream f30f0e5397542a6ebf6bf1d5f6cd785637293393 to 20221126 ]
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+---
+ ping/ping_common.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/ping/ping_common.c b/ping/ping_common.c
+index 687613a..0d0da76 100644
+--- a/ping/ping_common.c
++++ b/ping/ping_common.c
+@@ -443,9 +443,18 @@ void sock_setbufs(struct ping_rts *rts, socket_st *sock, int alloc)
+ 		rts->sndbuf = alloc;
+ 	setsockopt(sock->fd, SOL_SOCKET, SO_SNDBUF, (char *)&rts->sndbuf, sizeof(rts->sndbuf));
+ 
+-	rcvbuf = hold = alloc * rts->preload;
++	if (alloc > INT_MAX / rts->preload) {
++		error(0, 0, _("WARNING: buffer size overflow, reduce packet size or preload"));
++		hold = INT_MAX;
++	} else {
++		hold = alloc * rts->preload;
++	}
++
++	rcvbuf = hold;
++
+ 	if (hold < 65536)
+ 		hold = 65536;
++
+ 	setsockopt(sock->fd, SOL_SOCKET, SO_RCVBUF, (char *)&hold, sizeof(hold));
+ 	if (getsockopt(sock->fd, SOL_SOCKET, SO_RCVBUF, (char *)&hold, &tmplen) == 0) {
+ 		if (hold < rcvbuf)
+-- 
+2.49.0
+

iputils-CVE-2025-48964_02.patch

@@ -0,0 +1,112 @@
+From 88b9a8ff19ac55c43b714fefc28d718fb4dcd611 Mon Sep 17 00:00:00 2001
+From: Petr Vorel <pvorel@suse.cz>
+Date: Fri, 9 May 2025 17:18:09 +0200
+Subject: [PATCH 2/4] ping: Fix integer overflow in large -W value
+
+918e824 changed probably as a side effect max -W (time to wait for a
+response in sec) value from INT_MAX / 1000000 (i.e. 2147 s => ~ 35 min)
+to INT_MAX / 1000 (i.e. 2147483 s => ~ 586 h).  This allows int overflow
+with -W > 2148 s (value which was not previously allowed):
+
+    $ export CFLAGS="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer"
+    $ meson setup ..
+    $ ninja && ./ping/ping -c1 -W 2148 8.8.8.8
+    ../ping/ping_common.c:269:37: runtime error: signed integer overflow: 2148000 * 1000 cannot be represented in type 'int'
+
+It could be fixed by simple casting global_rts->lingertime in:
+waittime = (unsigned long)global_rts->lingertime * 1000;
+
+But because max -W value is unreasonably large anyway fix the problem by:
+1) storing lingertime as uint32_t (fixed 32bit unsigned int, requires C99)
+instead of previous int (first contribution to
+https://github.com/iputils/iputils/issues/410).
+
+2) Converting lingertime to us during getopts parsing (ping since ever -
+git era was converting lingertime during getopts only to ms, converting
+to us was done for some reason later in __schedule_exit()).
+
+New -W max value is now 71 min (over 1 hour) which should be enough
+(-W also allows -W0 for an infinite timeout, see 3b43f90):
+
+    $ ./ping/ping -c1 -W 4294 8.8.8.8
+    PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
+    64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=13.4 ms
+
+    --- 8.8.8.8 ping statistics ---
+    1 packets transmitted, 1 received, 0% packet loss, time 0ms
+    rtt min/avg/max/mdev = 13.422/13.422/13.422/0.000 ms
+
+Fixes: 918e824 ("ping: add support for sub-second timeouts")
+Closes: https://github.com/iputils/iputils/pull/588
+Reported-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Reviewed-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Tested-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Suggested-by: Cyril Hrubis <chrubis@suse.cz>
+Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
+[ pvorel: backport of upstream f7d19893aed9188de758b6be940be01501b5315b to 20221126 ]
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+---
+ ping/ping.c        | 6 +++---
+ ping/ping.h        | 2 +-
+ ping/ping_common.c | 7 ++++---
+ 3 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/ping/ping.c b/ping/ping.c
+index 02d358e..814ee71 100644
+--- a/ping/ping.c
++++ b/ping/ping.c
+@@ -543,10 +543,10 @@ main(int argc, char **argv)
+ 			double optval;
+ 
+ 			optval = ping_strtod(optarg, _("bad linger time"));
+-			if (isless(optval, 0) || isgreater(optval, (double)INT_MAX / 1000))
++			if (isless(optval, 0) || isgreater(optval, (double)UINT_MAX / 1000000))
+ 				error(2, 0, _("bad linger time: %s"), optarg);
+-			/* lingertime will be converted to usec later */
+-			rts.lingertime = (int)(optval * 1000);
++
++			rts.lingertime = (uint32_t)(optval * 1000000);
+ 		}
+ 			break;
+ 		default:
+diff --git a/ping/ping.h b/ping/ping.h
+index 46cfbe7..f667c62 100644
+--- a/ping/ping.h
++++ b/ping/ping.h
+@@ -163,7 +163,7 @@ struct ping_rts {
+ 	int interval;			/* interval between packets (msec) */
+ 	int preload;
+ 	int deadline;			/* time to die */
+-	int lingertime;
++	uint32_t lingertime;
+ 	struct timespec start_time, cur_time;
+ 	volatile int exiting;
+ 	volatile int status_snapshot;
+diff --git a/ping/ping_common.c b/ping/ping_common.c
+index 0d0da76..0fbb825 100644
+--- a/ping/ping_common.c
++++ b/ping/ping_common.c
+@@ -264,8 +264,9 @@ int __schedule_exit(int next)
+ 		waittime = 2 * global_rts->tmax;
+ 		if (waittime < 1000 * (unsigned long)global_rts->interval)
+ 			waittime = 1000 * global_rts->interval;
+-	} else
+-		waittime = global_rts->lingertime * 1000;
++	} else {
++		waittime = global_rts->lingertime;
++	}
+ 
+ 	if (next < 0 || (unsigned long)next < waittime / 1000)
+ 		next = waittime / 1000;
+@@ -387,7 +388,7 @@ resend:
+ 		if (nores_interval > 500)
+ 			nores_interval = 500;
+ 		oom_count++;
+-		if (oom_count * nores_interval < rts->lingertime)
++		if ((uint32_t)(oom_count * nores_interval) < rts->lingertime)
+ 			return nores_interval;
+ 		i = 0;
+ 		/* Fall to hard error. It is to avoid complete deadlock
+-- 
+2.49.0
+

iputils-CVE-2025-48964_03.patch

@@ -0,0 +1,97 @@
+From 73315cde2e2edd9b0afafe93f96ee5db738ef129 Mon Sep 17 00:00:00 2001
+From: Cyril Hrubis <chrubis@suse.cz>
+Date: Fri, 16 May 2025 17:57:10 +0200
+Subject: [PATCH 4/4] ping: Fix moving average rtt calculation
+
+The rts->rtt counts an exponential weight moving average in a fixed
+point, that means that even if we limit the triptime to fit into a 32bit
+number the average will overflow because because fixed point needs eight
+more bits.
+
+We also have to limit the triptime to 32bit number because otherwise the
+moving average may stil overflow if we manage to produce a large enough
+triptime.
+
+Fixes: CVE-2025-48964
+Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1243772
+Closes: https://github.com/iputils/iputils-ghsa-25fr-jw29-74f9/pull/1
+Reported-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Tested-by: Petr Vorel <pvorel@suse.cz>
+Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
+Reviewed-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+[ pvorel: backport of upstream afa36390394a6e0cceba03b52b59b6d41710608c to 20221126 ]
+Signed-off-by: Cyril Hrubis <chrubis@suse.cz>
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+---
+ iputils_common.h   | 2 +-
+ ping/ping.h        | 2 +-
+ ping/ping_common.c | 8 ++++----
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+Index: iputils-20240905/iputils_common.h
+===================================================================
+--- iputils-20240905.orig/iputils_common.h
++++ iputils-20240905/iputils_common.h
+@@ -11,7 +11,7 @@
+ 					 __typeof__(&arr[0]))])) * 0)
+ 
+ /* 1000001 = 1000000 tv_sec + 1 tv_usec */
+-#define TV_SEC_MAX_VAL (LONG_MAX/1000001)
++#define TV_SEC_MAX_VAL (INT32_MAX/1000001)
+ 
+ #ifdef __GNUC__
+ # define iputils_attribute_format(t, n, m) __attribute__((__format__ (t, n, m)))
+Index: iputils-20240905/ping/ping.h
+===================================================================
+--- iputils-20240905.orig/ping/ping.h
++++ iputils-20240905/ping/ping.h
+@@ -194,7 +194,7 @@ struct ping_rts {
+ 	long tmax;			/* maximum round trip time */
+ 	double tsum;			/* sum of all times, for doing average */
+ 	double tsum2;
+-	int rtt;
++	uint64_t rtt;                   /* Exponential weight moving average calculated in fixed point */
+ 	int rtt_addend;
+ 	uint16_t acked;
+ 	int pipesize;
+Index: iputils-20240905/ping/ping_common.c
+===================================================================
+--- iputils-20240905.orig/ping/ping_common.c
++++ iputils-20240905/ping/ping_common.c
+@@ -282,7 +282,7 @@ int __schedule_exit(int next)
+ 
+ static inline void update_interval(struct ping_rts *rts)
+ {
+-	int est = rts->rtt ? rts->rtt / 8 : rts->interval * 1000;
++	int est = rts->rtt ? (int)(rts->rtt / 8) : rts->interval * 1000;
+ 
+ 	rts->interval = (est + rts->rtt_addend + 500) / 1000;
+ 	if (rts->uid && rts->interval < MIN_USER_INTERVAL_MS)
+@@ -798,7 +798,7 @@ restamp:
+ 			if (triptime > rts->tmax)
+ 				rts->tmax = triptime;
+ 			if (!rts->rtt)
+-				rts->rtt = triptime * 8;
++				rts->rtt = ((uint64_t)triptime) * 8;
+ 			else
+ 				rts->rtt += triptime - rts->rtt / 8;
+ 			if (rts->opt_adaptive)
+@@ -970,7 +970,7 @@ int finish(struct ping_rts *rts)
+ 		int ipg = (1000000 * (long long)tv.tv_sec + tv.tv_nsec / 1000) / (rts->ntransmitted - 1);
+ 
+ 		printf(_("%sipg/ewma %d.%03d/%d.%03d ms"),
+-		       comma, ipg / 1000, ipg % 1000, rts->rtt / 8000, (rts->rtt / 8) % 1000);
++		       comma, ipg / 1000, ipg % 1000, (int)(rts->rtt / 8000), (int)((rts->rtt / 8) % 1000));
+ 	}
+ 	putchar('\n');
+ 	return (!rts->nreceived || (rts->deadline && rts->nreceived < rts->npackets));
+@@ -995,7 +995,7 @@ void status(struct ping_rts *rts)
+ 		fprintf(stderr, _(", min/avg/ewma/max = %ld.%03ld/%lu.%03ld/%d.%03d/%ld.%03ld ms"),
+ 			(long)rts->tmin / 1000, (long)rts->tmin % 1000,
+ 			tavg / 1000, tavg % 1000,
+-			rts->rtt / 8000, (rts->rtt / 8) % 1000, (long)rts->tmax / 1000, (long)rts->tmax % 1000);
++			(int)(rts->rtt / 8000), (int)((rts->rtt / 8) % 1000), (long)rts->tmax / 1000, (long)rts->tmax % 1000);
+ 	}
+ 	fprintf(stderr, "\n");
+ }

iputils-CVE-2025-48964_regression.patch

@@ -0,0 +1,55 @@
+From a41fbf36f331e1b0945c8e30581381e2f2fdff6e Mon Sep 17 00:00:00 2001
+From: Cyril Hrubis <chrubis@suse.cz>
+Date: Thu, 5 Jun 2025 15:39:00 +0200
+Subject: [PATCH] ping: Fix regression in -c1
+
+We change the rts->lingertime to be stored directly in us instead of ms
+in order to simplify the overflow checks, however we missed two places
+where the value was not properly converted.
+
+The initialization of the lingertime has to be converted to us as well
+since the MAXWAIT is in seconds it has to be multiplied by 1000000 now.
+
+The check againts the nores_interval has to be updated too since the
+nores_interval is initialized from rts->interval that is stored in ms
+and the oom_count is a counter, hence the product of the multiplication
+is still in ms and the rts->lingertime has to be divided by 1000 in this
+case to be converted back to ms.
+
+Fixes: f7d1989 ("ping: Fix integer overflow in large -W value")
+Fixes: https://github.com/iputils/iputils/issues/596
+Closes: https://github.com/iputils/iputils/pull/597
+Reported-by: Alberto Salvia Novella <es20490446e.wordpress.com>
+Co-developed-by: Petr Vorel <pvorel@suse.cz>
+Signed-off-by: Cyril Hrubis <chrubis@suse.cz>
+---
+ ping/ping.c        | 2 +-
+ ping/ping_common.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ping/ping.c b/ping/ping.c
+index 63b943e0..1e976a90 100644
+--- a/ping/ping.c
++++ b/ping/ping.c
+@@ -335,7 +335,7 @@ main(int argc, char **argv)
+ 	static struct ping_rts rts = {
+ 		.interval = 1000,
+ 		.preload = 1,
+-		.lingertime = MAXWAIT * 1000,
++		.lingertime = MAXWAIT * 1000000,
+ 		.confirm_flag = MSG_CONFIRM,
+ 		.tmin = LONG_MAX,
+ 		.pipesize = -1,
+diff --git a/ping/ping_common.c b/ping/ping_common.c
+index fad52280..9a0c1248 100644
+--- a/ping/ping_common.c
++++ b/ping/ping_common.c
+@@ -389,7 +389,7 @@ int pinger(struct ping_rts *rts, ping_func_set_st *fset, socket_st *sock)
+ 		if (nores_interval > 500)
+ 			nores_interval = 500;
+ 		oom_count++;
+-		if ((uint32_t)(oom_count * nores_interval) < rts->lingertime)
++		if ((uint32_t)(oom_count * nores_interval) < rts->lingertime/1000)
+ 			return nores_interval;
+ 		i = 0;
+ 		/* Fall to hard error. It is to avoid complete deadlock

iputils-invalid-ttl-s390x.patch

@@ -0,0 +1,46 @@
+From c9c82b4576f0b616793ffbdc815c02e2e4da1f5c Mon Sep 17 00:00:00 2001
+From: Radoslav Kolev <radoslav.kolev@suse.com>
+Date: Thu, 15 May 2025 17:56:52 +0300
+Subject: [PATCH] ping: Fix ipv4 ttl value when using SOCK_DGRAM on big endian
+ systems
+
+7e7ffff attempted to fix a GCC warning about strict aliasing (which
+it seems may have been an erroneous one in the first place), but
+caused the ttl value when pinging an ipv4 address using SOCK_DGRAM
+on a big endian system (for ex. IBM S390) to always appear as 0.
+
+Using memcpy() instead of directly casting the value should be the
+safest option, fixing the issue and also avoiding the possibility
+of unaligned access to the value returned by CMSG_DATA.
+
+Fixes: 7e7ffff ("ping: Silence GCC warnings when building with -fstrict-aliasing")
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
+Signed-off-by: Radoslav Kolev <radoslav.kolev@suse.com>
+---
+ ping/ping.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/ping/ping.c b/ping/ping.c
+index 0faa8704..63b943e0 100644
+--- a/ping/ping.c
++++ b/ping/ping.c
+@@ -1642,7 +1642,7 @@ int ping4_parse_reply(struct ping_rts *rts, struct socket_st *sock,
+ 	int csfailed;
+ 	struct cmsghdr *cmsgh;
+ 	int reply_ttl;
+-	uint8_t *opts, *tmp_ttl;
++	uint8_t *opts;
+ 	int olen;
+ 	int wrong_source = 0;
+ 
+@@ -1670,8 +1670,7 @@ int ping4_parse_reply(struct ping_rts *rts, struct socket_st *sock,
+ 			if (cmsgh->cmsg_type == IP_TTL) {
+ 				if (cmsgh->cmsg_len < sizeof(int))
+ 					continue;
+-				tmp_ttl = (uint8_t *)CMSG_DATA(cmsgh);
+-				reply_ttl = (int)*tmp_ttl;
++				memcpy(&reply_ttl, CMSG_DATA(cmsgh), sizeof(reply_ttl));
+ 			} else if (cmsgh->cmsg_type == IP_RETOPTS) {
+ 				opts = (uint8_t *)CMSG_DATA(cmsgh);
+ 				olen = cmsgh->cmsg_len;

iputils.changes

@@ -1,3 +1,28 @@
+-------------------------------------------------------------------
+Tue Jun 10 07:18:36 UTC 2025 - Angel Yankov <angel.yankov@suse.com>
+
+- Security fix [bsc#1243772, CVE-2025-48964]
+  * Fix  integer overflow in ping statistics via zero timestamp
+  * Add iputils-CVE-2025-48964_01.patch 
+  * Add iputils-CVE-2025-48964_02.patch
+  * Add iputils-CVE-2025-48964_03.patch
+  * Add iputils-CVE-2025-48964_regression.patch
+
+-------------------------------------------------------------------
+Fri May 16 12:25:35 UTC 2025 - Angel Yankov <angel.yankov@suse.com>
+
+- Fix bsc#1243284 - ping on s390x prints invalid ttl 
+  * Add iputils-invalid-ttl-s390x.patch
+  * Fix ipv4 ttl value when using SOCK_DGRAM on big endian systems
+- Enable test suite
+
+-------------------------------------------------------------------
+Tue May 13 06:13:26 UTC 2025 - Angel Yankov <angel.yankov@suse.com>
+
+- Security fix [bsc#1242300, CVE-2025-47268] 
+  * integer overflow in RTT calculation can lead to undefined behavior 
+  * Add iputils-CVE-2025-47268.patch
+
 -------------------------------------------------------------------
 Thu Sep  5 10:47:27 UTC 2024 - Petr Vorel <pvorel@suse.cz>
 

iputils.spec

@@ -24,6 +24,17 @@ License:        BSD-3-Clause AND GPL-2.0-or-later
 Group:          Productivity/Networking/Other
 URL:            https://github.com/iputils/iputils
 Source0:        https://github.com/iputils/iputils/releases/download/%{version}/iputils-%{version}.tar.xz
+# PATCH-FIX-UPSTREAM: bcs#1242300 CVE-2025-47268  integer overflow in RTT calculation can lead to undefine    d behavior
+Patch1:         iputils-CVE-2025-47268.patch
+#PATCH-FIX-UPSTREAM: bsc#1243284 ping on s390x prints invalid ttl
+Patch2:         iputils-invalid-ttl-s390x.patch
+#PATCH-FIX-UPSTREAM: bsc#1243772 CVE-2025-48964 integer overflow in ping statistics via zero timestamp
+Patch3:		iputils-CVE-2025-48964_01.patch
+Patch4:		iputils-CVE-2025-48964_02.patch
+Patch5:		iputils-CVE-2025-48964_03.patch
+#PATCH-FIX-UPSTREAM: Fix regression in -c1
+Patch6:		iputils-CVE-2025-48964_regression.patch
+
 BuildRequires:  docbook5-xsl-stylesheets
 BuildRequires:  docbook_5
 BuildRequires:  iproute2
@@ -34,6 +45,7 @@ BuildRequires:  meson
 BuildRequires:  opensp
 BuildRequires:  perl-SGMLS
 BuildRequires:  pkgconfig
+BuildRequires:  netcfg
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  pkgconfig(libidn2)
 BuildRequires:  pkgconfig(systemd)
@@ -83,6 +95,9 @@ ln -sf %{_bindir}/tracepath6    %{buildroot}/bin
 
 %find_lang %{name}
 
+%check
+%meson_test
+
 %post
 %set_permissions %{_bindir}/clockdiff