unbound: patch CVE-2024-43168

Details https://nvd.nist.gov/vuln/detail/CVE-2024-43168

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

3 files changed, 88 insertions, 0 deletions

diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_1.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_1.patch
new file mode 100644
index 0000000000..27bb01e596
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_1.patch
@@ -0,0 +1,29 @@
+From ae1788088e0db0d7a31e9ef4edced212395089c1 Mon Sep 17 00:00:00 2001
+From: zhailiangliang <zhailiangliang@loongson.cn>
+Date: Wed, 3 Apr 2024 15:40:58 +0800
+Subject: [PATCH] fix heap-buffer-overflow issue in function cfg_mark_ports of
+ file util/config_file.c
+
+CVE: CVE-2024-43168
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/193401e7543a1e561dd634a3eaae932fa462a2b9]
+(cherry picked from commit 193401e7543a1e561dd634a3eaae932fa462a2b9)
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ util/config_file.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/util/config_file.c b/util/config_file.c
+index 147f41e8..724b174c 100644
+--- a/util/config_file.c
++++ b/util/config_file.c
+@@ -1776,6 +1776,10 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
+ #endif
+        if(!mid) {
+                int port = atoi(str);
++               if(port < 0) {
++                       log_err("Prevent out-of-bounds access to array avail");
++                       return 0;
++               }
+                if(port == 0 && strcmp(str, "0") != 0) {
+                        log_err("cannot parse port number '%s'", str);
+                        return 0;
diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_2.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_2.patch
new file mode 100644
index 0000000000..a85200a8c2
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2024-43168_2.patch
@@ -0,0 +1,57 @@
+From c9c49b5f3244bde6f4300fc19e56d5944fb25c0c Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 3 Apr 2024 10:16:18 +0200
+Subject: [PATCH] - For #1040: adjust error text and disallow negative ports in
+ other   parts of cfg_mark_ports.
+
+CVE: CVE-2024-43168
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/dfff8d23cf4145c58e5c1e99d4159d3a91a70ab7]
+(cherry picked from commit dfff8d23cf4145c58e5c1e99d4159d3a91a70ab7)
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ util/config_file.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/util/config_file.c b/util/config_file.c
+index 724b174c..c403d745 100644
+--- a/util/config_file.c
++++ b/util/config_file.c
+@@ -1777,7 +1777,7 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
+        if(!mid) {
+                int port = atoi(str);
+                if(port < 0) {
+-                       log_err("Prevent out-of-bounds access to array avail");
++                       log_err("port number is negative: %d", port);
+                        return 0;
+                }
+                if(port == 0 && strcmp(str, "0") != 0) {
+@@ -1789,6 +1789,10 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
+        } else {
+                int i, low, high = atoi(mid+1);
+                char buf[16];
++               if(high < 0) {
++                       log_err("port number is negative: %d", high);
++                       return 0;
++               }
+                if(high == 0 && strcmp(mid+1, "0") != 0) {
+                        log_err("cannot parse port number '%s'", mid+1);
+                        return 0;
+@@ -1801,10 +1805,18 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
+                        memcpy(buf, str, (size_t)(mid-str));
+                buf[mid-str] = 0;
+                low = atoi(buf);
++               if(low < 0) {
++                       log_err("port number is negative: %d", low);
++                       return 0;
++               }
+                if(low == 0 && strcmp(buf, "0") != 0) {
+                        log_err("cannot parse port number '%s'", buf);
+                        return 0;
+                }
++               if(high > num) {
++                       /* Stop very high values from taking a long time. */
++                       high = num;
++               }
+                for(i=low; i<=high; i++) {
+                        if(i < num)
+                                avail[i] = (allow?i:0);
diff --git a/meta-networking/recipes-support/unbound/unbound_1.19.3.bb b/meta-networking/recipes-support/unbound/unbound_1.19.3.bb
index 9a537c2dc2..076f03f2ae 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.19.3.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.19.3.bb
@@ -14,6 +14,8 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;nobranch=1 \
            file://CVE-2024-33655.patch \
            file://CVE-2025-11411.patch \
            file://CVE-2024-43167.patch \
+           file://CVE-2024-43168_1.patch \
+           file://CVE-2024-43168_2.patch \
            "
 SRCREV = "48b6c60a24e9a5d6d369a7a37c9fe2a767f26abd"