Commit d310e6a3 authored by Natanael Copa's avatar Natanael Copa

main/busybox: backport fix for CVE-2019-5747

parent c3dbe0ca
......@@ -3,7 +3,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=busybox
pkgver=1.30.1
pkgrel=1
pkgrel=2
pkgdesc="Size optimized toolbox of many common UNIX utilities"
url="https://busybox.net/"
arch="all"
......@@ -36,6 +36,7 @@ source="https://busybox.net/downloads/$pkgname-$pkgver.tar.bz2
0013-testsuite-fix-cpio-tests.patch
0014-miscutils-microcom-Fixed-segfault.patch
0015-ip-print-dadfailed-flag.patch
CVE-2019-5747.patch
acpid.logrotate
busyboxconfig
......@@ -46,6 +47,8 @@ source="https://busybox.net/downloads/$pkgname-$pkgver.tar.bz2
"
# secfixes:
# 1.30.1-r2:
# - CVE-2019-5747
# 1.29.3-r10:
# - CVE-2018-20679
# - CVE-2019-5747
......@@ -217,6 +220,7 @@ f96d66ce5a0295a2459a2c49c281b64e016de675ebd31a49af18cb06f3498fe27dfbc8667324b439
d8926f0e4ed7d2fe5af89ff2a944d781b45b109c9edf1ef2591e7bce2a8bbadd7c8ca814cb3c928ae09027d9603434fe70496f308d701f3d42260ebd1e9e9b29 0013-testsuite-fix-cpio-tests.patch
8cb91903f2be3620b5500a4e8f4190537c93601282510b82303c3b516141b36ab872aeff5a7f5ae00f270439abab862ceabda531bdf180643da165b2f3b35d9f 0014-miscutils-microcom-Fixed-segfault.patch
2fdf01e4bb26a3b6fd7ff73649f15eff599d38db1bc61a699576ec9caae2fb37c49d689baca8b1a3a7b2999fbe04751da897518c2fb42d6f21756b468aa7599d 0015-ip-print-dadfailed-flag.patch
6952770be92a980174691ac65fda778eaafd23bf8da63ad62149f2cb0f289bef216bb512ae5e013328b3bd5289a351124d22dd819b1e3116cc2244b435eb7287 CVE-2019-5747.patch
aa93095e20de88730f526c6f463cef711b290b9582cdbd8c1ba2bd290019150cbeaa7007c2e15f0362d5b9315dd63f60511878f0ea05e893f4fdfb4a54af3fb1 acpid.logrotate
fc1f4e44e3f7874a8036d48e039c45e08761007a0f4f9b6f242b63f57b641b7609f47cffc620e08ab6384885a0bec822f840e79567c304dc1944124f27a9f4ad busyboxconfig
c6f0fc8e6f5a166309d8548bd1a7e11a2bc71b67c1222567485329602b55fbd4e12b627fa092fff3c269ebc01f20eb55ae7fca12f7c655afe0e563af4fd2c873 busyboxconfig-extras
......
From 74d9f1ba37010face4bd1449df4d60dd84450b06 Mon Sep 17 00:00:00 2001
From: Denys Vlasenko <vda.linux@googlemail.com>
Date: Mon, 7 Jan 2019 15:33:42 +0100
Subject: udhcpc: when decoding DHCP_SUBNET, ensure it is 4 bytes long
function old new delta
udhcp_run_script 795 801 +6
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
---
networking/udhcp/common.c | 2 +-
networking/udhcp/common.h | 2 +-
networking/udhcp/dhcpc.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/networking/udhcp/common.c b/networking/udhcp/common.c
index 4c2221b77..fc4de5716 100644
--- a/networking/udhcp/common.c
+++ b/networking/udhcp/common.c
@@ -302,7 +302,7 @@ uint8_t* FAST_FUNC udhcp_get_option32(struct dhcp_packet *packet, int code)
{
uint8_t *r = udhcp_get_option(packet, code);
if (r) {
- if (r[-1] != 4)
+ if (r[-OPT_DATA + OPT_LEN] != 4)
r = NULL;
}
return r;
diff --git a/networking/udhcp/common.h b/networking/udhcp/common.h
index 9511152ff..62f9a2a4a 100644
--- a/networking/udhcp/common.h
+++ b/networking/udhcp/common.h
@@ -119,7 +119,7 @@ enum {
//#define DHCP_TIME_SERVER 0x04 /* RFC 868 time server (32-bit, 0 = 1.1.1900) */
//#define DHCP_NAME_SERVER 0x05 /* IEN 116 _really_ ancient kind of NS */
//#define DHCP_DNS_SERVER 0x06
-//#define DHCP_LOG_SERVER 0x07 /* port 704 UDP log (not syslog)
+//#define DHCP_LOG_SERVER 0x07 /* port 704 UDP log (not syslog) */
//#define DHCP_COOKIE_SERVER 0x08 /* "quote of the day" server */
//#define DHCP_LPR_SERVER 0x09
#define DHCP_HOST_NAME 0x0c /* 12: either client informs server or server gives name to client */
diff --git a/networking/udhcp/dhcpc.c b/networking/udhcp/dhcpc.c
index 5b3fd531c..dcec8cdfd 100644
--- a/networking/udhcp/dhcpc.c
+++ b/networking/udhcp/dhcpc.c
@@ -531,7 +531,7 @@ static char **fill_envp(struct dhcp_packet *packet)
temp = udhcp_get_option(packet, code);
*curr = xmalloc_optname_optval(temp, &dhcp_optflags[i], opt_name);
putenv(*curr++);
- if (code == DHCP_SUBNET) {
+ if (code == DHCP_SUBNET && temp[-OPT_DATA + OPT_LEN] == 4) {
/* Subnet option: make things like "$ip/$mask" possible */
uint32_t subnet;
move_from_unaligned32(subnet, temp);
--
cgit v1.2.1
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment