Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openslp rebuild

Browse Source
This commit is contained in:
idriskalp
2020-02-07 16:23:42 +03:00
parent c5936727ae
commit 3c66556a60
6 changed files with 324 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
network/analyzer/openslp/files/openslp-2.0.0-CVE-2016-7567.patch
+89
View File
@@ -0,0 +1,89 @@
--- openslp/common/slp_compare.c
+++ openslp/common/slp_compare.c
@@ -194,7 +194,8 @@
* @return The new (shorter) length of @p str.
*
* @note This routine assumes that leading and trailing white space have
- * already been removed from @p str.
+ * already been removed from @p str. It also assumes that @p str may
+ * not be null-terminated.
*/
static int SLPFoldWhiteSpace(size_t len, char * str)
{
@@ -203,11 +204,11 @@
{
if (isspace(*p))
{
- char * ws2p = ++p; /* Point ws2p to the second ws char. */
- while (isspace(*p)) /* Scan till we hit a non-ws char. */
+ char * ws2p = ++p; /* Point ws2p to the second ws char. */
+ while (p < ep && isspace(*p)) /* Scan till we hit a non-ws char. */
p++;
- len -= p - ws2p; /* Reduce the length by extra ws. */
- memmove(ws2p, p, ep - p); /* Overwrite the extra white space. */
+ len -= p - ws2p; /* Reduce the length by extra ws. */
+ memmove(ws2p, p, ep - p); /* Overwrite the extra white space. */
}
p++;
}
@@ -821,6 +822,50 @@
#ifdef SLP_COMPARE_TEST
+/* Test boundary conditions of SLPFoldWhiteSpace. */
+static int test_SLPFoldWhiteSpace(void)
+{
+ static char test_str0[] = " ";
+ static char test_str1[] = "Blah";
+ static char test_str3[] = "Blah blah";
+ static char test_str4[] = "Blah blah";
+ static char test_str5[] = "Blah blah blah";
+ static char test_str8[] = " Blah blah";
+ static char test_str9[] = " Blah blah";
+ static char test_strC[] = "Blah blah ";
+ static char test_strD[] = "Blah blah xxxx";
+
+ static char * test_strs[] =
+ {
+ test_str0, test_str0, test_str0, test_str1, test_strC,
+ test_str3, test_str4, test_str5, test_strC, test_strC,
+ test_str8, test_str9, test_strC, test_strD,
+ };
+
+ static int test_lens[] =
+ {
+ 0, 1, 2, 4, 9, 10, 11, 15, 10, 11, 10, 11, 11, 11,
+ };
+
+ static int test_fins[] =
+ {
+ 0, 1, 1, 4, 9, 9, 9, 14, 10, 10, 10, 10, 10, 10,
+ };
+
+#define MAX_BUFSZ 32
+
+ int i;
+ for (i = 0; i < sizeof(test_strs) / sizeof(*test_strs); ++i)
+ {
+ char test_buf[MAX_BUFSZ];
+ memmove(test_buf, test_strs[i], test_lens[i]);
+ int len = SLPFoldWhiteSpace(test_lens[i], test_buf);
+ if (len != test_fins[i])
+ return -1;
+ }
+ return 0;
+}
+
/* ---------------- Test main for the slp_compare.c module ----------------
*
* Compile with:
@@ -840,6 +885,9 @@
int count;
+ if (test_SLPFoldWhiteSpace() != 0)
+ return -1;
+
/* *** SLPContainsStringList ***
*/
count = SLPContainsStringList(sizeof lst1 - 1, lst1, sizeof str1 - 1, str1);
network/analyzer/openslp/files/openslp-2.0.0-CVE-2017-17833.patch
+19
View File
@@ -0,0 +1,19 @@
diff -up openslp-2.0.0/slpd/slpd_process.c.orig openslp-2.0.0/slpd/slpd_process.c
--- openslp-2.0.0/slpd/slpd_process.c.orig 2018-05-09 13:08:06.185104375 +0200
+++ openslp-2.0.0/slpd/slpd_process.c 2018-05-09 13:07:21.017095089 +0200
@@ -462,6 +462,15 @@ static int ProcessSrvRqst(SLPMessage * m
message->body.srvrqst.srvtype, 23, SLP_DA_SERVICE_TYPE) == 0)
{
errorcode = ProcessDASrvRqst(message, sendbuf, errorcode);
+
+ if (result != *sendbuf)
+ {
+ // The pointer stored at *sendbuf can be modified by a realloc
+ // operation in ProcessDASrvRqst(). Fix up the local copy of
+ // that pointer if necessary.
+ result = *sendbuf;
+ }
+
if (errorcode == 0)
{
/* Since we have an errorcode of 0, we were successful,
network/analyzer/openslp/files/openslp-2.0.0-fdr-CVE-2019-5544.patch
+165
View File
@@ -0,0 +1,165 @@
diff -ur openslp-2.0.0.orig/common/slp_buffer.c openslp-2.0.0/common/slp_buffer.c
--- openslp-2.0.0.orig/common/slp_buffer.c 2012-12-10 15:31:53.000000000 -0800
+++ openslp-2.0.0/common/slp_buffer.c 2019-11-26 21:54:20.000000000 -0800
@@ -30,6 +30,13 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*-------------------------------------------------------------------------*/
+/* Copyright (c) 2019 VMware, Inc.
+ * SPDX-License-Identifier: BSD-3-Clause
+ * This file is provided under the BSD-3-Clause license.
+ * See COPYING file for more details and other copyrights
+ * that may apply.
+ */
+
/** Functions for managing SLP message buffers.
*
* This file provides a higher level abstraction over malloc and free that
@@ -153,4 +160,20 @@
xfree(buf);
}
+/** Report remaining free buffer size in bytes.
+ *
+ * Check if buffer is allocated and if so return bytes left in a
+ * @c SLPBuffer object.
+ *
+ * @param[in] buf The SLPBuffer to be freed.
+ */
+size_t
+RemainingBufferSpace(SLPBuffer buf)
+{
+ if (buf->allocated == 0) {
+ return 0;
+ }
+ return buf->end - buf->curpos;
+}
+
/*=========================================================================*/
diff -ur openslp-2.0.0.orig/common/slp_buffer.h openslp-2.0.0/common/slp_buffer.h
--- openslp-2.0.0.orig/common/slp_buffer.h 2012-11-28 09:07:04.000000000 -0800
+++ openslp-2.0.0/common/slp_buffer.h 2019-11-26 21:54:32.000000000 -0800
@@ -30,6 +30,13 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*-------------------------------------------------------------------------*/
+/* Copyright (c) 2019 VMware, Inc.
+ * SPDX-License-Identifier: BSD-3-Clause
+ * This file is provided under the BSD-3-Clause license.
+ * See COPYING file for more details and other copyrights
+ * that may apply.
+ */
+
/** Header file that defines SLP message buffer management routines.
*
* Includes structures, constants and functions that used to handle memory
@@ -78,6 +85,8 @@
SLPBuffer SLPBufferListAdd(SLPBuffer * list, SLPBuffer buf);
+size_t RemainingBufferSpace(SLPBuffer buf);
+
/*! @} */
#endif /* SLP_BUFFER_H_INCLUDED */
diff -ur openslp-2.0.0.orig/slpd/slpd_process.c openslp-2.0.0/slpd/slpd_process.c
--- openslp-2.0.0.orig/slpd/slpd_process.c 2012-12-12 09:38:54.000000000 -0800
+++ openslp-2.0.0/slpd/slpd_process.c 2019-11-26 21:55:10.000000000 -0800
@@ -30,6 +30,13 @@
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*-------------------------------------------------------------------------*/
+/* Copyright (c) 2019 VMware, Inc.
+ * SPDX-License-Identifier: BSD-3-Clause
+ * This file is provided under the BSD-3-Clause license.
+ * See COPYING file for more details and other copyrights
+ * that may apply.
+ */
+
/** Processes incoming SLP messages.
*
* @file slpd_process.c
@@ -514,13 +521,27 @@
{
for (i = 0; i < db->urlcount; i++)
{
- /* urlentry is the url from the db result */
urlentry = db->urlarray[i];
+ if (urlentry->opaque != NULL) {
+ const int64_t newsize = size + urlentry->opaquelen;
+ if (urlentry->opaquelen <= 0 || newsize > INT_MAX)
+ {
+ SLPDLog("Invalid opaquelen %d or sizeo of opaque url is too big, size=%d\n",
+ urlentry->opaquelen, size);
+ errorcode = SLP_ERROR_PARSE_ERROR;
+ goto FINISHED;
+ }
+ size += urlentry->opaquelen;
+ }
+ else
+ {
+ /* urlentry is the url from the db result */
+ size += urlentry->urllen + 6; /* 1 byte for reserved */
+ /* 2 bytes for lifetime */
+ /* 2 bytes for urllen */
+ /* 1 byte for authcount */
+ }
- size += urlentry->urllen + 6; /* 1 byte for reserved */
- /* 2 bytes for lifetime */
- /* 2 bytes for urllen */
- /* 1 byte for authcount */
#ifdef ENABLE_SLPv2_SECURITY
/* make room to include the authblock that was asked for */
if (G_SlpdProperty.securityEnabled
@@ -594,7 +615,7 @@
urlentry = db->urlarray[i];
#ifdef ENABLE_SLPv1
- if (urlentry->opaque == 0)
+ if (urlentry->opaque == NULL)
{
/* url-entry reserved */
*result->curpos++ = 0;
@@ -606,8 +627,18 @@
PutUINT16(&result->curpos, urlentry->urllen);
/* url-entry url */
- memcpy(result->curpos, urlentry->url, urlentry->urllen);
- result->curpos += urlentry->urllen;
+ if (RemainingBufferSpace(result) >= urlentry->urllen)
+ {
+ memcpy(result->curpos, urlentry->url, urlentry->urllen);
+ result->curpos = result->curpos + urlentry->urllen;
+ }
+ else
+ {
+ SLPDLog("Url too big (ask: %d have %" PRId64 "), failing request\n",
+ urlentry->opaquelen, (int64_t) RemainingBufferSpace(result));
+ errorcode = SLP_ERROR_PARSE_ERROR;
+ goto FINISHED;
+ }
/* url-entry auths */
*result->curpos++ = 0;
@@ -621,8 +652,18 @@
/* TRICKY: Fix up the lifetime. */
TO_UINT16(urlentry->opaque + 1, urlentry->lifetime);
- memcpy(result->curpos, urlentry->opaque, urlentry->opaquelen);
- result->curpos += urlentry->opaquelen;
+ if (RemainingBufferSpace(result) >= urlentry->opaquelen)
+ {
+ memcpy(result->curpos, urlentry->opaque, urlentry->opaquelen);
+ result->curpos = result->curpos + urlentry->opaquelen;
+ }
+ else
+ {
+ SLPDLog("Opaque Url too big (ask: %d have %" PRId64 "), failing request\n",
+ urlentry->opaquelen, (int64_t) RemainingBufferSpace(result));
+ errorcode = SLP_ERROR_PARSE_ERROR;
+ goto FINISHED;
+ }
}
}
}
network/analyzer/openslp/files/openslp-2.0.0-null-pointer-deref.patch
+12
View File
@@ -0,0 +1,12 @@
diff -up openslp-2.0.0/common/slp_xmalloc.c.orig openslp-2.0.0/common/slp_xmalloc.c
--- openslp-2.0.0/common/slp_xmalloc.c.orig 2012-12-07 01:52:08.000000000 +0100
+++ openslp-2.0.0/common/slp_xmalloc.c 2016-05-23 12:58:57.953532979 +0200
@@ -203,6 +203,8 @@ void * _xrealloc(const char * file, int
if (x->size != size)
{
newptr = _xmalloc(file, line, size);
+ if (newptr == 0)
+ return 0;
memcpy(newptr, ptr, x->size);
_xfree(file, line, x);
}
network/analyzer/openslp/files/openslp-2.0.0-openssl-1.1-fix.patch
+25
View File
@@ -0,0 +1,25 @@
diff -up openslp-2.0.0/common/slp_crypto.c.orig openslp-2.0.0/common/slp_crypto.c
--- openslp-2.0.0/common/slp_crypto.c.orig 2012-12-07 21:13:28.000000000 +0100
+++ openslp-2.0.0/common/slp_crypto.c 2017-02-22 11:16:11.620835724 +0100
@@ -88,11 +88,16 @@ SLPCryptoDSAKey * SLPCryptoDSAKeyDup(SLP
result = DSA_new();
if (result)
{
- result->p = BN_dup(dsa->p);
- result->q = BN_dup(dsa->q);
- result->g = BN_dup(dsa->g);
- result->priv_key = BN_dup(dsa->priv_key);
- result->pub_key = BN_dup(dsa->pub_key);
+ const BIGNUM *p, *q, *g;
+ const BIGNUM *priv_key, *pub_key;
+
+ DSA_get0_pqg(dsa, &p, &q, &g);
+ DSA_get0_key(dsa, &pub_key, &priv_key);
+
+ /* would be nice to check return values,
+ * but original code didn't do that either... */
+ DSA_set0_pqg(result, BN_dup(p), BN_dup(q), BN_dup(g));
+ DSA_set0_key(result, BN_dup(pub_key), BN_dup(priv_key));
}
return result;
}
network/analyzer/openslp/pspec.xml
+14
View File
@@ -19,6 +19,13 @@
<Dependency>doxygen</Dependency>
<Dependency>docbook-xsl</Dependency>
</BuildDependencies>
<Patches>
<Patch level="1">openslp-2.0.0-CVE-2016-7567.patch</Patch>
<Patch level="1">openslp-2.0.0-CVE-2017-17833.patch</Patch>
<Patch level="1">openslp-2.0.0-fdr-CVE-2019-5544.patch</Patch>
<Patch level="1">openslp-2.0.0-null-pointer-deref.patch</Patch>
<Patch level="1">openslp-2.0.0-openssl-1.1-fix.patch</Patch>
</Patches>
</Source>
<Package>
@@ -68,6 +75,13 @@
</Package>
<History>
<Update release="5">
<Date>2020-02-07</Date>
<Version>2.0.0</Version>
<Comment>Rebuild.</Comment>
<Name>Pisi Linux Community</Name>
<Email>admin@pisilinux.org</Email>
</Update>
<Update release="4">
<Date>2018-08-15</Date>
<Version>2.0.0</Version>