Accepting request 303615 from hardware

1

OBS-URL: https://build.opensuse.org/request/show/303615
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/wpa_supplicant?expand=0&rev=61

0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch

@@ -0,0 +1,42 @@
+From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Tue, 7 Apr 2015 11:32:11 +0300
+Subject: [PATCH] P2P: Validate SSID element length before copying it
+ (CVE-2015-1863)
+
+This fixes a possible memcpy overflow for P2P dev->oper_ssid in
+p2p_add_device(). The length provided by the peer device (0..255 bytes)
+was used without proper bounds checking and that could have resulted in
+arbitrary data of up to 223 bytes being written beyond the end of the
+dev->oper_ssid[] array (of which about 150 bytes would be beyond the
+heap allocation) when processing a corrupted management frame for P2P
+peer discovery purposes.
+
+This could result in corrupted state in heap, unexpected program
+behavior due to corrupted P2P peer device information, denial of service
+due to process crash, exposure of memory contents during GO Negotiation,
+and potentially arbitrary code execution.
+
+Thanks to Google security team for reporting this issue and smart
+hardware research group of Alibaba security team for discovering it.
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+---
+ src/p2p/p2p.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
+index f584fae..a45fe73 100644
+--- a/src/p2p/p2p.c
++++ b/src/p2p/p2p.c
+@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
+ 	if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
+ 		os_memcpy(dev->interface_addr, addr, ETH_ALEN);
+ 	if (msg.ssid &&
++	    msg.ssid[1] <= sizeof(dev->oper_ssid) &&
+ 	    (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
+ 	     os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
+ 	     != 0)) {
+-- 
+1.9.1
+

wpa_supplicant-alloc_size.patch

@@ -0,0 +1,20 @@
+--- wpa_supplicant-2.4.orig/src/utils/os.h
++++ wpa_supplicant-2.4/src/utils/os.h
+@@ -253,7 +253,7 @@ int os_file_exists(const char *fname);
+  *
+  * Caller is responsible for freeing the returned buffer with os_free().
+  */
+-void * os_zalloc(size_t size);
++void * os_zalloc(size_t size) __attribute((malloc, alloc_size(1)));
+ 
+ /**
+  * os_calloc - Allocate and zero memory for an array
+@@ -267,6 +267,8 @@ void * os_zalloc(size_t size);
+  *
+  * Caller is responsible for freeing the returned buffer with os_free().
+  */
++
++__attribute((malloc, alloc_size(1,2)))
+ static inline void * os_calloc(size_t nmemb, size_t size)
+ {
+ 	if (size && nmemb > (~(size_t) 0) / size)

wpa_supplicant.changes

@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Thu Apr 23 19:49:28 UTC 2015 - crrodriguez@opensuse.org
+
+- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch 
+  Fix CVE-2015-1863, memcpy overflow.
+- wpa_supplicant-alloc_size.patch: annotate two wrappers
+  with attribute alloc_size, which may help warning us of
+  bugs such as the above.
+
 -------------------------------------------------------------------
 Fri Apr 10 23:05:28 UTC 2015 - stefan.bruens@rwth-aachen.de
 

wpa_supplicant.spec

@@ -47,6 +47,8 @@ Patch1:         wpa_supplicant-flush-debug-output.patch
 # wpa_supplicant-sigusr1-changes-debuglevel.patch won't go upstream as it
 # is not portable
 Patch2:         wpa_supplicant-sigusr1-changes-debuglevel.patch
+Patch3:         0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
+Patch4:         wpa_supplicant-alloc_size.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 Requires:       logrotate
 %if ! %{defined _rundir}
@@ -84,7 +86,8 @@ rm -rf wpa_supplicant-%{version}/patches
 cp %{SOURCE1} wpa_supplicant/.config
 %patch1 -p0
 %patch2 -p1
-
+%patch3 -p1
+%patch4 -p1
 %build
 cd wpa_supplicant
 CFLAGS="$RPM_OPT_FLAGS" make V=1 %{?_smp_mflags}