summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-networking/recipes-support/wireshark/files/CVE-2026-0962.patch131
-rw-r--r--meta-networking/recipes-support/wireshark/wireshark_4.2.14.bb1
2 files changed, 132 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/wireshark/files/CVE-2026-0962.patch b/meta-networking/recipes-support/wireshark/files/CVE-2026-0962.patch
new file mode 100644
index 0000000000..615b11eb7f
--- /dev/null
+++ b/meta-networking/recipes-support/wireshark/files/CVE-2026-0962.patch
@@ -0,0 +1,131 @@
1From 4b1c045a4639b54a0aea717667a30c01c683001c Mon Sep 17 00:00:00 2001
2From: Gerald Combs <gerald@wireshark.org>
3Date: Mon, 12 Jan 2026 17:01:48 -0800
4Subject: [PATCH] SOME/IP-SD: Fix a buffer overflow
5
6Make sure we don't write past the end of our option port array. Make our
7option count unsigned.
8
9Fixes #20945
10
11(cherry picked from commit 55ec8b3db4968c97115f014fb5974206cdf57454)
12
13Conflicts:
14 epan/dissectors/packet-someip-sd.c
15
16CVE: CVE-2026-0962
17Upstream-Status: Backport [https://gitlab.com/wireshark/wireshark/-/commit/825b83e1ed146f6c8fa8f1d7ad2794061b82c895]
18Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
19---
20 epan/dissectors/packet-someip-sd.c | 25 +++++++++++++++----------
21 1 file changed, 15 insertions(+), 10 deletions(-)
22
23diff --git a/epan/dissectors/packet-someip-sd.c b/epan/dissectors/packet-someip-sd.c
24index 85144d5..79935bb 100644
25--- a/epan/dissectors/packet-someip-sd.c
26+++ b/epan/dissectors/packet-someip-sd.c
27@@ -242,6 +242,7 @@ static expert_field ef_someipsd_option_unknown = EI_INIT;
28 static expert_field ef_someipsd_option_wrong_length = EI_INIT;
29 static expert_field ef_someipsd_L4_protocol_unsupported = EI_INIT;
30 static expert_field ef_someipsd_config_string_malformed = EI_INIT;
31+static expert_field ef_someipsd_too_many_options = EI_INIT;
32
33 /*** prototypes ***/
34 void proto_register_someip_sd(void);
35@@ -274,7 +275,7 @@ someip_sd_register_ports(guint32 opt_index, guint32 opt_num, guint32 option_coun
36 }
37
38 static void
39-dissect_someip_sd_pdu_option_configuration(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 offset, guint32 length, int optionnum) {
40+dissect_someip_sd_pdu_option_configuration(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 offset, guint32 length, unsigned optionnum) {
41 guint32 offset_orig = offset;
42 const guint8 *config_string;
43 proto_item *ti;
44@@ -317,7 +318,7 @@ dissect_someip_sd_pdu_option_configuration(tvbuff_t *tvb, packet_info *pinfo, pr
45 }
46
47 static void
48-dissect_someip_sd_pdu_option_loadbalancing(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, guint32 offset, guint32 length, int optionnum) {
49+dissect_someip_sd_pdu_option_loadbalancing(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, guint32 offset, guint32 length, unsigned optionnum) {
50 tree = proto_tree_add_subtree_format(tree, tvb, offset, length, ett_someip_sd_option, NULL, "%d: Load Balancing Option", optionnum);
51
52 /* Add common fields */
53@@ -337,7 +338,7 @@ dissect_someip_sd_pdu_option_loadbalancing(tvbuff_t *tvb, packet_info *pinfo _U_
54 }
55
56 static void
57-dissect_someip_sd_pdu_option_ipv4(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 offset, guint32 length, int optionnum, guint32 option_ports[]) {
58+dissect_someip_sd_pdu_option_ipv4(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 offset, guint32 length, unsigned optionnum, guint32 option_ports[]) {
59 guint8 type = 255;
60 const gchar *description = NULL;
61 guint32 l4port = 0;
62@@ -350,7 +351,7 @@ dissect_someip_sd_pdu_option_ipv4(tvbuff_t *tvb, packet_info *pinfo, proto_tree
63
64 type = tvb_get_guint8(tvb, offset + 2);
65 description = val_to_str(type, sd_option_type, "(Unknown Option: %d)");
66- tree = proto_tree_add_subtree_format(tree, tvb, offset, length, ett_someip_sd_option, &ti_top, "%d: %s Option", optionnum, description);
67+ tree = proto_tree_add_subtree_format(tree, tvb, offset, length, ett_someip_sd_option, &ti_top, "%u: %s Option", optionnum, description);
68
69 if (length != SD_OPTION_IPV4_LENGTH) {
70 expert_add_info(pinfo, ti_top, &ef_someipsd_option_wrong_length);
71@@ -391,7 +392,7 @@ dissect_someip_sd_pdu_option_ipv4(tvbuff_t *tvb, packet_info *pinfo, proto_tree
72 }
73
74 static void
75-dissect_someip_sd_pdu_option_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 offset, guint32 length, int optionnum, guint32 option_ports[]) {
76+dissect_someip_sd_pdu_option_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 offset, guint32 length, unsigned optionnum, guint32 option_ports[]) {
77 guint8 type = 255;
78 const gchar *description = NULL;
79 guint32 l4port = 0;
80@@ -404,7 +405,7 @@ dissect_someip_sd_pdu_option_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree
81 type = tvb_get_guint8(tvb, offset + 2);
82 description = val_to_str(type, sd_option_type, "(Unknown Option: %d)");
83
84- tree = proto_tree_add_subtree_format(tree, tvb, offset, length, ett_someip_sd_option, &ti_top, "%d: %s Option", optionnum, description);
85+ tree = proto_tree_add_subtree_format(tree, tvb, offset, length, ett_someip_sd_option, &ti_top, "%u: %s Option", optionnum, description);
86
87 if (length != SD_OPTION_IPV6_LENGTH) {
88 expert_add_info(pinfo, ti_top, &ef_someipsd_option_wrong_length);
89@@ -444,11 +445,11 @@ dissect_someip_sd_pdu_option_ipv6(tvbuff_t *tvb, packet_info *pinfo, proto_tree
90 }
91
92 static void
93-dissect_someip_sd_pdu_option_unknown(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 offset, guint32 length, int optionnum) {
94+dissect_someip_sd_pdu_option_unknown(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint32 offset, guint32 length, unsigned optionnum) {
95 guint32 len = 0;
96 proto_item *ti;
97
98- tree = proto_tree_add_subtree_format(tree, tvb, offset, length, ett_someip_sd_option, &ti, "%d: %s Option", optionnum,
99+ tree = proto_tree_add_subtree_format(tree, tvb, offset, length, ett_someip_sd_option, &ti, "%u: %s Option", optionnum,
100 val_to_str_const(tvb_get_guint8(tvb, offset + 2), sd_option_type, "Unknown"));
101
102 expert_add_info(pinfo, ti, &ef_someipsd_option_unknown);
103@@ -473,7 +474,7 @@ static int
104 dissect_someip_sd_pdu_options(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, proto_item *ti, guint32 offset_orig, guint32 length, guint32 option_ports[], guint *option_count) {
105 guint16 real_length = 0;
106 guint8 option_type = 0;
107- int optionnum = 0;
108+ unsigned optionnum = 0;
109 tvbuff_t *subtvb = NULL;
110
111 guint32 offset = offset_orig;
112@@ -484,7 +485,10 @@ dissect_someip_sd_pdu_options(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tre
113 }
114
115 while (tvb_bytes_exist(tvb, offset, SD_OPTION_MINLENGTH)) {
116- ws_assert(optionnum >= 0 && optionnum < SD_MAX_NUM_OPTIONS);
117+ if (optionnum >= SD_MAX_NUM_OPTIONS) {
118+ expert_add_info(pinfo, ti, &ef_someipsd_too_many_options);
119+ return offset;
120+ }
121 option_ports[optionnum] = 0;
122
123 real_length = tvb_get_ntohs(tvb, offset) + 3;
124@@ -1195,6 +1199,7 @@ proto_register_someip_sd(void) {
125 { &ef_someipsd_option_wrong_length,{ "someipsd.option_wrong_length", PI_MALFORMED, PI_ERROR, "SOME/IP-SD Option length is incorrect!", EXPFILL } },
126 { &ef_someipsd_L4_protocol_unsupported,{ "someipsd.L4_protocol_unsupported", PI_MALFORMED, PI_ERROR, "SOME/IP-SD Unsupported Layer 4 Protocol!", EXPFILL } },
127 { &ef_someipsd_config_string_malformed,{ "someipsd.config_string_malformed", PI_MALFORMED, PI_ERROR, "SOME/IP-SD Configuration String malformed!", EXPFILL } },
128+ { &ef_someipsd_too_many_options,{ "someipsd.too_many_options", PI_MALFORMED, PI_ERROR, "SOME/IP-SD Too many options!", EXPFILL } },
129 };
130
131 /* Register Protocol, Fields, ETTs, Expert Info, Taps, Dissector */
diff --git a/meta-networking/recipes-support/wireshark/wireshark_4.2.14.bb b/meta-networking/recipes-support/wireshark/wireshark_4.2.14.bb
index bd014055a9..fbe57e7d79 100644
--- a/meta-networking/recipes-support/wireshark/wireshark_4.2.14.bb
+++ b/meta-networking/recipes-support/wireshark/wireshark_4.2.14.bb
@@ -14,6 +14,7 @@ SRC_URI = "https://1.eu.dl.wireshark.org/src/all-versions/wireshark-${PV}.tar.xz
14 file://0004-lemon-Remove-line-directives.patch \ 14 file://0004-lemon-Remove-line-directives.patch \
15 file://0001-UseLemon.cmake-do-not-use-lemon-data-from-the-host.patch \ 15 file://0001-UseLemon.cmake-do-not-use-lemon-data-from-the-host.patch \
16 file://CVE-2025-9817.patch \ 16 file://CVE-2025-9817.patch \
17 file://CVE-2026-0962.patch \
17 " 18 "
18 19
19UPSTREAM_CHECK_URI = "https://1.as.dl.wireshark.org/src/all-versions" 20UPSTREAM_CHECK_URI = "https://1.as.dl.wireshark.org/src/all-versions"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 08:04:52 +0000