diff options
Diffstat (limited to 'meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14493.patch')
-rw-r--r-- | meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14493.patch | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14493.patch b/meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14493.patch new file mode 100644 index 000000000..ae99cf49a --- /dev/null +++ b/meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14493.patch | |||
@@ -0,0 +1,37 @@ | |||
1 | From f23f4be3cb72d307806e3d3ca14779f69ac5494c Mon Sep 17 00:00:00 2001 | ||
2 | From: Simon Kelley <simon@thekelleys.org.uk> | ||
3 | Date: Mon, 25 Sep 2017 18:52:50 +0100 | ||
4 | Subject: [PATCH 3/7] Security fix, CVE-2017-14493, DHCPv6 - Stack buffer | ||
5 | overflow. | ||
6 | |||
7 | commit 3d4ff1ba8419546490b464418223132529514033 upstream | ||
8 | git://thekelleys.org.uk/dnsmasq | ||
9 | |||
10 | Fix stack overflow in DHCPv6 code. An attacker who can send | ||
11 | a DHCPv6 request to dnsmasq can overflow the stack frame and | ||
12 | crash or control dnsmasq. | ||
13 | |||
14 | Upstream-Status: Backport | ||
15 | |||
16 | Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> | ||
17 | --- | ||
18 | src/rfc3315.c | 3 +++ | ||
19 | 1 file changed, 3 insertions(+) | ||
20 | |||
21 | diff --git a/src/rfc3315.c b/src/rfc3315.c | ||
22 | index 73bdee4..8d18a28 100644 | ||
23 | --- a/src/rfc3315.c | ||
24 | +++ b/src/rfc3315.c | ||
25 | @@ -206,6 +206,9 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, | ||
26 | /* RFC-6939 */ | ||
27 | if ((opt = opt6_find(opts, end, OPTION6_CLIENT_MAC, 3))) | ||
28 | { | ||
29 | + if (opt6_len(opt) - 2 > DHCP_CHADDR_MAX) { | ||
30 | + return 0; | ||
31 | + } | ||
32 | state->mac_type = opt6_uint(opt, 0, 2); | ||
33 | state->mac_len = opt6_len(opt) - 2; | ||
34 | memcpy(&state->mac[0], opt6_ptr(opt, 2), state->mac_len); | ||
35 | -- | ||
36 | 2.11.0 | ||
37 | |||