Djam/ppp
1
0
Fork 0
mirror of https://abf.rosa.ru/djam/ppp.git synced 2025-02-23 06:03:01 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix CVE-2020-8597

Browse source
This commit is contained in:
Alexander Stefanov 2020-03-07 16:57:52 +00:00
parent 41aeafe1af
commit da7df9d309
2 changed files with 41 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
8d7970b8f3db727fe798b65f3377fe6787575426.patch Normal file
View file

@ -0,0 +1,37 @@
From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001
From: Paul Mackerras <paulus@ozlabs.org>
Date: Mon, 3 Feb 2020 15:53:28 +1100
Subject: [PATCH] pppd: Fix bounds check in EAP code
Given that we have just checked vallen < len, it can never be the case
that vallen >= len + sizeof(rhostname). This fixes the check so we
actually avoid overflowing the rhostname array.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
---
pppd/eap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/pppd/eap.c b/pppd/eap.c
index 94407f56..1b93db01 100644
--- a/pppd/eap.c
+++ b/pppd/eap.c
@@ -1420,7 +1420,7 @@ int len;
}
/* Not so likely to happen. */
- if (vallen >= len + sizeof (rhostname)) {
+ if (len - vallen >= sizeof (rhostname)) {
dbglog("EAP: trimming really long peer name down");
BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
rhostname[sizeof (rhostname) - 1] = '\0';
@@ -1846,7 +1846,7 @@ int len;
}
/* Not so likely to happen. */
- if (vallen >= len + sizeof (rhostname)) {
+ if (len - vallen >= sizeof (rhostname)) {
dbglog("EAP: trimming really long peer name down");
BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
rhostname[sizeof (rhostname) - 1] = '\0';

4
ppp.spec
View file

@ -41,6 +41,9 @@ Patch13: ppp-2.4.7-nostrip.patch
Patch14: ppp-2.4.7-linux48.patch
Patch15: ppp-2.4.7-eaptls-mppe-1.101_CVE-2018-11574.patch
Patch16: FEDORA-glibc-2.28.patch
# CVE-2020-8597
# remote code execution
Patch17: 8d7970b8f3db727fe798b65f3377fe6787575426.patch
BuildRequires: libtool
BuildRequires: atm-devel
BuildRequires: pcap-devel
@ -211,6 +214,7 @@ popd
%patch13 -p1 -b .nostrip
%patch14 -p1 -b .linux48
%patch15 -p1
%patch17 -p1
patch -p1 < %{PATCH16}
tar -xJf %{SOURCE112}