7 files changed, 0 insertions, 672 deletions

diff --git a/recipes-networking/dnsmasq/dnsmasq/0001-CVE-2017-14491.patch b/recipes-networking/dnsmasq/dnsmasq/0001-CVE-2017-14491.patch
deleted file mode 100644
index 1eda591..0000000
--- a/recipes-networking/dnsmasq/dnsmasq/0001-CVE-2017-14491.patch
+++ /dev/null
@@ -1,269 +0,0 @@
-From 0549c73b7ea6b22a3c49beb4d432f185a81efcbc Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 25 Sep 2017 18:17:11 +0100
-Subject: [PATCH] Security fix, CVE-2017-14491 DNS heap buffer overflow.
-
-Fix heap overflow in DNS code. This is a potentially serious
-security hole. It allows an attacker who can make DNS
-requests to dnsmasq, and who controls the contents of
-a domain, which is thereby queried, to overflow
-(by 2 bytes) a heap buffer and either crash, or
-even take control of, dnsmasq.
-
-CVE: CVE-2017-14491
-Upstream-Status: Backport [src/dnsmasq.h patch failed, modified manually]
-
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
-
-diff -Nurp a/CHANGELOG b/CHANGELOG
---- a/CHANGELOG 2016-05-18 16:51:54.000000000 +0200
-+++ b/CHANGELOG 2017-10-04 09:38:20.445498463 +0200
-@@ -123,6 +123,18 @@ version 2.75
-            dhcp-script is configured. Thanks to Adrian Davey for
-            reporting the bug and testing the fix.
- 
-+       Fix heap overflow in DNS code. This is a potentially serious
-+       security hole. It allows an attacker who can make DNS
-+       requests to dnsmasq, and who controls the contents of
-+       a domain, which is thereby queried, to overflow
-+       (by 2 bytes) a heap buffer and either crash, or
-+       even take control of, dnsmasq.
-+       CVE-2017-14491 applies.
-+       Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-+       and Kevin Hamacher of the Google Security Team for
-+       finding this.
-+
-+
-        
- version 2.74
-             Fix reversion in 2.73 where --conf-file would attempt to
-diff -Nurp a/src/dnsmasq.h b/src/dnsmasq.h
---- a/src/dnsmasq.h     2016-05-18 16:51:54.000000000 +0200
-+++ b/src/dnsmasq.h     2017-10-04 09:39:39.366156718 +0200
-@@ -1161,7 +1161,7 @@ u32 rand32(void);
- u64 rand64(void);
- int legal_hostname(char *c);
- char *canonicalise(char *s, int *nomem);
--unsigned char *do_rfc1035_name(unsigned char *p, char *sval);
-+unsigned char *do_rfc1035_name(unsigned char *p, char *sval, char *limit);
- void *safe_malloc(size_t size);
- void safe_pipe(int *fd, int read_noblock);
- void *whine_malloc(size_t size);
-diff -Nurp a/src/dnssec.c b/src/dnssec.c
---- a/src/dnssec.c      2016-05-18 16:51:54.000000000 +0200
-+++ b/src/dnssec.c      2017-10-04 09:38:20.445498463 +0200
-@@ -2227,7 +2227,7 @@ size_t dnssec_generate_query(struct dns_
- 
-   p = (unsigned char *)(header+1);
-        
--  p = do_rfc1035_name(p, name);
-+  p = do_rfc1035_name(p, name, NULL);
-   *p++ = 0;
-   PUTSHORT(type, p);
-   PUTSHORT(class, p);
-diff -Nurp a/src/option.c b/src/option.c
---- a/src/option.c      2016-05-18 16:51:54.000000000 +0200
-+++ b/src/option.c      2017-10-04 09:38:20.449498294 +0200
-@@ -1378,7 +1378,7 @@ static int parse_dhcp_opt(char *errstr,
-                    }
-                  
-                  p = newp;
--                 end = do_rfc1035_name(p + len, dom);
-+                 end = do_rfc1035_name(p + len, dom, NULL);
-                  *end++ = 0;
-                  len = end - p;
-                  free(dom);
-diff -Nurp a/src/rfc1035.c b/src/rfc1035.c
---- a/src/rfc1035.c     2016-05-18 16:51:54.000000000 +0200
-+++ b/src/rfc1035.c     2017-10-04 09:38:20.449498294 +0200
-@@ -1049,6 +1049,7 @@ int check_for_ignored_address(struct dns
-   return 0;
- }
- 
-+
- int add_resource_record(struct dns_header *header, char *limit, int *truncp, int nameoffset, unsigned char **pp, 
-                        unsigned long ttl, int *offset, unsigned short type, unsigned short class, char *format, ...)
- {
-@@ -1058,12 +1059,21 @@ int add_resource_record(struct dns_heade
-   unsigned short usval;
-   long lval;
-   char *sval;
-+#define CHECK_LIMIT(size) \
-+  if (limit && p + (size) > (unsigned char*)limit) \
-+    { \
-+      va_end(ap); \
-+      goto truncated; \
-+    }
- 
-   if (truncp && *truncp)
-     return 0;
-- 
-+
-   va_start(ap, format);   /* make ap point to 1st unamed argument */
--  
-+
-+  /* nameoffset (1 or 2) + type (2) + class (2) + ttl (4) + 0 (2) */
-+  CHECK_LIMIT(12);
-+
-   if (nameoffset > 0)
-     {
-       PUTSHORT(nameoffset | 0xc000, p);
-@@ -1072,7 +1082,13 @@ int add_resource_record(struct dns_heade
-     {
-       char *name = va_arg(ap, char *);
-       if (name)
--       p = do_rfc1035_name(p, name);
-+       p = do_rfc1035_name(p, name, limit);
-+        if (!p)
-+          {
-+            va_end(ap);
-+            goto truncated;
-+          }
-+
-       if (nameoffset < 0)
-        {
-          PUTSHORT(-nameoffset | 0xc000, p);
-@@ -1093,6 +1109,7 @@ int add_resource_record(struct dns_heade
-       {
- #ifdef HAVE_IPV6
-       case '6':
-+        CHECK_LIMIT(IN6ADDRSZ);
-        sval = va_arg(ap, char *); 
-        memcpy(p, sval, IN6ADDRSZ);
-        p += IN6ADDRSZ;
-@@ -1100,36 +1117,47 @@ int add_resource_record(struct dns_heade
- #endif
-        
-       case '4':
-+        CHECK_LIMIT(INADDRSZ);
-        sval = va_arg(ap, char *); 
-        memcpy(p, sval, INADDRSZ);
-        p += INADDRSZ;
-        break;
-        
-       case 'b':
-+        CHECK_LIMIT(1);
-        usval = va_arg(ap, int);
-        *p++ = usval;
-        break;
-        
-       case 's':
-+        CHECK_LIMIT(2);
-        usval = va_arg(ap, int);
-        PUTSHORT(usval, p);
-        break;
-        
-       case 'l':
-+        CHECK_LIMIT(4);
-        lval = va_arg(ap, long);
-        PUTLONG(lval, p);
-        break;
-        
-       case 'd':
--       /* get domain-name answer arg and store it in RDATA field */
--       if (offset)
--         *offset = p - (unsigned char *)header;
--       p = do_rfc1035_name(p, va_arg(ap, char *));
--       *p++ = 0;
-+        /* get domain-name answer arg and store it in RDATA field */
-+        if (offset)
-+          *offset = p - (unsigned char *)header;
-+        p = do_rfc1035_name(p, va_arg(ap, char *), limit);
-+        if (!p)
-+          {
-+            va_end(ap);
-+            goto truncated;
-+          }
-+        CHECK_LIMIT(1);
-+        *p++ = 0;
-        break;
-        
-       case 't':
-        usval = va_arg(ap, int);
-+        CHECK_LIMIT(usval);
-        sval = va_arg(ap, char *);
-        if (usval != 0)
-          memcpy(p, sval, usval);
-@@ -1141,20 +1169,24 @@ int add_resource_record(struct dns_heade
-        usval = sval ? strlen(sval) : 0;
-        if (usval > 255)
-          usval = 255;
-+        CHECK_LIMIT(usval + 1);
-        *p++ = (unsigned char)usval;
-        memcpy(p, sval, usval);
-        p += usval;
-        break;
-       }
- 
-+#undef CHECK_LIMIT
-   va_end(ap);  /* clean up variable argument pointer */
-   
-   j = p - sav - 2;
--  PUTSHORT(j, sav);     /* Now, store real RDLength */
-+ /* this has already been checked against limit before */
-+ PUTSHORT(j, sav);     /* Now, store real RDLength */
-   
-   /* check for overflow of buffer */
-   if (limit && ((unsigned char *)limit - p) < 0)
-     {
-+truncated:
-       if (truncp)
-        *truncp = 1;
-       return 0;
-diff -Nurp a/src/rfc2131.c b/src/rfc2131.c
---- a/src/rfc2131.c     2016-05-18 16:51:54.000000000 +0200
-+++ b/src/rfc2131.c     2017-10-04 09:38:20.449498294 +0200
-@@ -2419,10 +2419,10 @@ static void do_options(struct dhcp_conte
- 
-              if (fqdn_flags & 0x04)
-                {
--                 p = do_rfc1035_name(p, hostname);
-+                 p = do_rfc1035_name(p, hostname, NULL);
-                  if (domain)
-                    {
--                     p = do_rfc1035_name(p, domain);
-+                     p = do_rfc1035_name(p, domain, NULL);
-                      *p++ = 0;
-                    }
-                }
-diff -Nurp a/src/rfc3315.c b/src/rfc3315.c
---- a/src/rfc3315.c     2016-05-18 16:51:54.000000000 +0200
-+++ b/src/rfc3315.c     2017-10-04 09:38:20.449498294 +0200
-@@ -1472,10 +1472,10 @@ static struct dhcp_netid *add_options(st
-       if ((p = expand(len + 2)))
-        {
-          *(p++) = state->fqdn_flags;
--         p = do_rfc1035_name(p, state->hostname);
-+         p = do_rfc1035_name(p, state->hostname, NULL);
-          if (state->send_domain)
-            {
--             p = do_rfc1035_name(p, state->send_domain);
-+             p = do_rfc1035_name(p, state->send_domain, NULL);
-              *p = 0;
-            }
-        }
-diff -Nurp a/src/util.c b/src/util.c
---- a/src/util.c        2016-05-18 16:51:54.000000000 +0200
-+++ b/src/util.c        2017-10-04 09:38:20.453498124 +0200
-@@ -218,15 +218,20 @@ char *canonicalise(char *in, int *nomem)
-   return ret;
- }
- 
--unsigned char *do_rfc1035_name(unsigned char *p, char *sval)
-+unsigned char *do_rfc1035_name(unsigned char *p, char *sval, char *limit)
- {
-   int j;
-   
-   while (sval && *sval)
-     {
-+      if (limit && p + 1 > (unsigned char*)limit)
-+        return p;
-+
-       unsigned char *cp = p++;
-       for (j = 0; *sval && (*sval != '.'); sval++, j++)
-        {
-+          if (limit && p + 1 > (unsigned char*)limit)
-+            return p;
- #ifdef HAVE_DNSSEC
-          if (option_bool(OPT_DNSSEC_VALID) && *sval == NAME_ESCAPE)
-            *p++ = (*(++sval))-1;
diff --git a/recipes-networking/dnsmasq/dnsmasq/0002-CVE-2017-14491.patch b/recipes-networking/dnsmasq/dnsmasq/0002-CVE-2017-14491.patch
deleted file mode 100644
index 6f27667..0000000
--- a/recipes-networking/dnsmasq/dnsmasq/0002-CVE-2017-14491.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 62cb936cb7ad5f219715515ae7d32dd281a5aa1f Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Tue, 26 Sep 2017 22:00:11 +0100
-Subject: [PATCH] Security fix, CVE-2017-14491, DNS heap buffer overflow.
-
-Further fix to 0549c73b7ea6b22a3c49beb4d432f185a81efcbc
-Handles case when RR name is not a pointer to the question,
-only occurs for some auth-mode replies, therefore not
-detected by fuzzing (?)
-
-CVE: CVE-2017-14491
-Upstream-Status: Backport 
-
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
----
- src/rfc1035.c |   27 +++++++++++++++------------
- 1 file changed, 15 insertions(+), 12 deletions(-)
-
-diff --git a/src/rfc1035.c b/src/rfc1035.c
-index 27af023..56ab88b 100644
---- a/src/rfc1035.c
-+++ b/src/rfc1035.c
-@@ -1086,32 +1086,35 @@ int add_resource_record(struct dns_header *header, char *limit, int *truncp, int
- 
-   va_start(ap, format);   /* make ap point to 1st unamed argument */
- 
--  /* nameoffset (1 or 2) + type (2) + class (2) + ttl (4) + 0 (2) */
--  CHECK_LIMIT(12);
--
-   if (nameoffset > 0)
-     {
-+      CHECK_LIMIT(2);
-       PUTSHORT(nameoffset | 0xc000, p);
-     }
-   else
-     {
-       char *name = va_arg(ap, char *);
--      if (name)
--       p = do_rfc1035_name(p, name, limit);
--        if (!p)
--          {
--            va_end(ap);
--            goto truncated;
--          }
--
-+      if (name && !(p = do_rfc1035_name(p, name, limit)))
-+       {
-+         va_end(ap);
-+         goto truncated;
-+       }
-+      
-       if (nameoffset < 0)
-        {
-+         CHECK_LIMIT(2);
-          PUTSHORT(-nameoffset | 0xc000, p);
-        }
-       else
--       *p++ = 0;
-+       {
-+         CHECK_LIMIT(1);
-+         *p++ = 0;
-+       }
-     }
- 
-+  /* type (2) + class (2) + ttl (4) + rdlen (2) */
-+  CHECK_LIMIT(10);
-+  
-   PUTSHORT(type, p);
-   PUTSHORT(class, p);
-   PUTLONG(ttl, p);      /* TTL */
--- 
-1.7.10.4
-
diff --git a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14492.patch b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14492.patch
deleted file mode 100644
index 5b66944..0000000
--- a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14492.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 24036ea507862c7b7898b68289c8130f85599c10 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 25 Sep 2017 18:47:15 +0100
-Subject: [PATCH] Security fix, CVE-2017-14492, DHCPv6 RA heap overflow.
-
-Fix heap overflow in IPv6 router advertisement code.
-This is a potentially serious security hole, as a
-crafted RA request can overflow a buffer and crash or
-control dnsmasq. Attacker must be on the local network.
-
-CVE: CVE-2017-14492
-Upstream-Status: Backport
-
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
----
- CHANGELOG  |   10 +++++++++-
- src/radv.c |    3 +++
- 2 files changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index a7c2f35..df6c157 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -35,7 +35,15 @@ version 2.78
-        and Kevin Hamacher of the Google Security Team for
-        finding this.
- 
--
-+       Fix heap overflow in IPv6 router advertisement code.
-+       This is a potentially serious security hole, as a
-+       crafted RA request can overflow a buffer and crash or
-+       control dnsmasq. Attacker must be on the local network.
-+       CVE-2017-14492 applies.
-+        Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-+       and Kevin Hamacher of the Google Security Team for
-+       finding this.
-+       
-        
- version 2.77
-        Generate an error when configured with a CNAME loop,
-diff --git a/src/radv.c b/src/radv.c
-index 1032189..9b7e52c 100644
---- a/src/radv.c
-+++ b/src/radv.c
-@@ -198,6 +198,9 @@ void icmp6_packet(time_t now)
-       /* look for link-layer address option for logging */
-       if (sz >= 16 && packet[8] == ICMP6_OPT_SOURCE_MAC && (packet[9] * 8) + 8 <= sz)
-        {
-+         if ((packet[9] * 8 - 2) * 3 - 1 >= MAXDNAME) {
-+           return;
-+         }
-          print_mac(daemon->namebuff, &packet[10], (packet[9] * 8) - 2);
-          mac = daemon->namebuff;
-        }
--- 
-1.7.10.4
-
diff --git a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14493.patch b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14493.patch
deleted file mode 100644
index fedb825..0000000
--- a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14493.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 3d4ff1ba8419546490b464418223132529514033 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 25 Sep 2017 18:52:50 +0100
-Subject: [PATCH] Security fix, CVE-2017-14493, DHCPv6 - Stack buffer
- overflow.
-
-Fix stack overflow in DHCPv6 code. An attacker who can send
-a DHCPv6 request to dnsmasq can overflow the stack frame and
-crash or control dnsmasq.
-
-CVE: CVE-2017-14493
-Upstream-Status: Backport
-
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
----
- CHANGELOG     |    8 ++++++++
- src/rfc3315.c |    3 +++
- 2 files changed, 11 insertions(+)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index df6c157..c48378f 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -43,6 +43,14 @@ version 2.78
-         Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-        and Kevin Hamacher of the Google Security Team for
-        finding this.
-+
-+       Fix stack overflow in DHCPv6 code. An attacker who can send
-+       a DHCPv6 request to dnsmasq can overflow the stack frame and
-+       crash or control dnsmasq.
-+       CVE-2017-14493 applies.
-+       Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-+       and Kevin Hamacher of the Google Security Team for
-+       finding this.
-        
-        
- version 2.77
-diff --git a/src/rfc3315.c b/src/rfc3315.c
-index 1687931..920907c 100644
---- a/src/rfc3315.c
-+++ b/src/rfc3315.c
-@@ -206,6 +206,9 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
-   /* RFC-6939 */
-   if ((opt = opt6_find(opts, end, OPTION6_CLIENT_MAC, 3)))
-     {
-+      if (opt6_len(opt) - 2 > DHCP_CHADDR_MAX) {
-+        return 0;
-+      }
-       state->mac_type = opt6_uint(opt, 0, 2);
-       state->mac_len = opt6_len(opt) - 2;
-       memcpy(&state->mac[0], opt6_ptr(opt, 2), state->mac_len);
--- 
-1.7.10.4
-
diff --git a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14494.patch b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14494.patch
deleted file mode 100644
index d32f713..0000000
--- a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14494.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 33e3f1029c9ec6c63e430ff51063a6301d4b2262 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 25 Sep 2017 20:05:11 +0100
-Subject: [PATCH] Security fix, CVE-2017-14494, Infoleak handling DHCPv6
- forwarded requests.
-
-Fix information leak in DHCPv6. A crafted DHCPv6 packet can
-cause dnsmasq to forward memory from outside the packet
-buffer to a DHCPv6 server when acting as a relay.
-
-CVE: CVE-2017-14494
-Upstream-Status: Backport
-
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
----
- CHANGELOG     |    8 ++++++++
- src/rfc3315.c |    3 +++
- 2 files changed, 11 insertions(+)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index c48378f..d1cc074 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -51,6 +51,14 @@ version 2.78
-        Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-        and Kevin Hamacher of the Google Security Team for
-        finding this.
-+
-+       Fix information leak in DHCPv6. A crafted DHCPv6 packet can
-+       cause dnsmasq to forward memory from outside the packet
-+       buffer to a DHCPv6 server when acting as a relay.
-+       CVE-2017-14494 applies.
-+       Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-+       and Kevin Hamacher of the Google Security Team for
-+       finding this.
-        
-        
- version 2.77
-diff --git a/src/rfc3315.c b/src/rfc3315.c
-index 920907c..4ca43e0 100644
---- a/src/rfc3315.c
-+++ b/src/rfc3315.c
-@@ -216,6 +216,9 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
-   
-   for (opt = opts; opt; opt = opt6_next(opt, end))
-     {
-+      if (opt6_ptr(opt, 0) + opt6_len(opt) >= end) {
-+        return 0;
-+      }
-       int o = new_opt6(opt6_type(opt));
-       if (opt6_type(opt) == OPTION6_RELAY_MSG)
-        {
--- 
-1.7.10.4
-
diff --git a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14495.patch b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14495.patch
deleted file mode 100644
index ba176a8..0000000
--- a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14495.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 51eadb692a5123b9838e5a68ecace3ac579a3a45 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 25 Sep 2017 20:16:50 +0100
-Subject: [PATCH] Security fix, CVE-2017-14495, OOM in DNS response creation.
-
-Fix out-of-memory Dos vulnerability. An attacker which can
-send malicious DNS queries to dnsmasq can trigger memory
-allocations in the add_pseudoheader function
-The allocated memory is never freed which leads to a DoS
-through memory exhaustion. dnsmasq is vulnerable only
-if one of the following option is specified:
---add-mac, --add-cpe-id or --add-subnet.
-
-CVE: CVE-2017-14495
-Upstream-Status: Backport
-
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
----
- CHANGELOG   |   12 ++++++++++++
- src/edns0.c |    8 +++++++-
- 2 files changed, 19 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 8fe00ed..9523329 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -70,6 +70,18 @@ version 2.78
-        Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-        and Kevin Hamacher of the Google Security Team for
-        finding this.
-+
-+       Fix out-of-memory Dos vulnerability. An attacker which can
-+       send malicious DNS queries to dnsmasq can trigger memory
-+       allocations in the add_pseudoheader function
-+       The allocated memory is never freed which leads to a DoS
-+       through memory exhaustion. dnsmasq is vulnerable only
-+       if one of the following option is specified:
-+       --add-mac, --add-cpe-id or --add-subnet.
-+       CVE-2017-14495 applies.
-+       Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-+       and Kevin Hamacher of the Google Security Team for
-+       finding this.
-        
-        
- version 2.77
-diff --git a/src/edns0.c b/src/edns0.c
-index 95b74ee..89b2692 100644
---- a/src/edns0.c
-+++ b/src/edns0.c
-@@ -192,9 +192,15 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
-          !(p = skip_section(p, 
-                             ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount), 
-                             header, plen)))
-+      {
-+       free(buff);
-        return plen;
-+      }
-       if (p + 11 > limit)
--       return plen; /* Too big */
-+      {
-+        free(buff);
-+        return plen; /* Too big */
-+      }
-       *p++ = 0; /* empty name */
-       PUTSHORT(T_OPT, p);
-       PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
--- 
-1.7.10.4
-
diff --git a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch b/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch
deleted file mode 100644
index 333a890..0000000
--- a/recipes-networking/dnsmasq/dnsmasq/CVE-2017-14496.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 897c113fda0886a28a986cc6ba17bb93bd6cb1c7 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Mon, 25 Sep 2017 20:11:58 +0100
-Subject: [PATCH] Security fix, CVE-2017-14496, Integer underflow in DNS
- response creation.
-
-Fix DoS in DNS. Invalid boundary checks in the
-add_pseudoheader function allows a memcpy call with negative
-size An attacker which can send malicious DNS queries
-to dnsmasq can trigger a DoS remotely.
-dnsmasq is vulnerable only if one of the following option is
-specified: --add-mac, --add-cpe-id or --add-subnet.
-
-CVE: CVE-2017-14496
-Upstream-Status: Backport
-
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
----
- CHANGELOG   |   11 +++++++++++
- src/edns0.c |   13 ++++++++++++-
- 2 files changed, 23 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index d1cc074..8fe00ed 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -60,6 +60,17 @@ version 2.78
-        and Kevin Hamacher of the Google Security Team for
-        finding this.
-        
-+       Fix DoS in DNS. Invalid boundary checks in the
-+       add_pseudoheader function allows a memcpy call with negative
-+       size An attacker which can send malicious DNS queries
-+       to dnsmasq can trigger a DoS remotely.
-+       dnsmasq is vulnerable only if one of the following option is
-+       specified: --add-mac, --add-cpe-id or --add-subnet.
-+       CVE-2017-14496 applies.
-+       Credit to Felix Wilhelm, Fermin J. Serna, Gabriel Campana
-+       and Kevin Hamacher of the Google Security Team for
-+       finding this.
-+       
-        
- version 2.77
-        Generate an error when configured with a CNAME loop,
-diff --git a/src/edns0.c b/src/edns0.c
-index f5b798c..95b74ee 100644
---- a/src/edns0.c
-+++ b/src/edns0.c
-@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
-          GETSHORT(len, p);
-          
-          /* malformed option, delete the whole OPT RR and start again. */
--         if (i + len > rdlen)
-+         if (i + 4 + len > rdlen)
-            {
-              rdlen = 0;
-              is_last = 0;
-@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
-                             ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount), 
-                             header, plen)))
-        return plen;
-+      if (p + 11 > limit)
-+       return plen; /* Too big */
-       *p++ = 0; /* empty name */
-       PUTSHORT(T_OPT, p);
-       PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
-@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
-       /* Copy back any options */
-       if (buff)
-        {
-+          if (p + rdlen > limit)
-+          {
-+            free(buff);
-+            return plen; /* Too big */
-+          }
-          memcpy(p, buff, rdlen);
-          free(buff);
-          p += rdlen;
-@@ -220,8 +227,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
-   /* Add new option */
-   if (optno != 0 && replace != 2)
-     {
-+      if (p + 4 > limit)
-+       return plen; /* Too big */
-       PUTSHORT(optno, p);
-       PUTSHORT(optlen, p);
-+      if (p + optlen > limit)
-+       return plen; /* Too big */
-       memcpy(p, opt, optlen);
-       p += optlen;  
-       PUTSHORT(p - datap, lenp);
--- 
-1.7.10.4
-