diff options
Diffstat (limited to 'meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14494.patch')
-rw-r--r-- | meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14494.patch | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14494.patch b/meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14494.patch new file mode 100644 index 000000000..a6f0e2abe --- /dev/null +++ b/meta-networking/recipes-support/dnsmasq/dnsmasq/dnsmasq-CVE-2017-14494.patch | |||
@@ -0,0 +1,37 @@ | |||
1 | From aba3f8df87d104d599920ea44e96191601638961 Mon Sep 17 00:00:00 2001 | ||
2 | From: Simon Kelley <simon@thekelleys.org.uk> | ||
3 | Date: Mon, 25 Sep 2017 20:05:11 +0100 | ||
4 | Subject: [PATCH 4/7] Security fix, CVE-2017-14494, Infoleak handling DHCPv6 | ||
5 | forwarded requests. | ||
6 | |||
7 | commit 33e3f1029c9ec6c63e430ff51063a6301d4b2262 upstream | ||
8 | git://thekelleys.org.uk/dnsmasq | ||
9 | |||
10 | Fix information leak in DHCPv6. A crafted DHCPv6 packet can | ||
11 | cause dnsmasq to forward memory from outside the packet | ||
12 | buffer to a DHCPv6 server when acting as a relay. | ||
13 | |||
14 | Upstream-Status: Backport | ||
15 | |||
16 | Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> | ||
17 | --- | ||
18 | src/rfc3315.c | 3 +++ | ||
19 | 1 file changed, 3 insertions(+) | ||
20 | |||
21 | diff --git a/src/rfc3315.c b/src/rfc3315.c | ||
22 | index 8d18a28..03b3f84 100644 | ||
23 | --- a/src/rfc3315.c | ||
24 | +++ b/src/rfc3315.c | ||
25 | @@ -216,6 +216,9 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz, | ||
26 | |||
27 | for (opt = opts; opt; opt = opt6_next(opt, end)) | ||
28 | { | ||
29 | + if (opt6_ptr(opt, 0) + opt6_len(opt) >= end) { | ||
30 | + return 0; | ||
31 | + } | ||
32 | int o = new_opt6(opt6_type(opt)); | ||
33 | if (opt6_type(opt) == OPTION6_RELAY_MSG) | ||
34 | { | ||
35 | -- | ||
36 | 2.11.0 | ||
37 | |||