diff --git a/network/analyzer/openslp/files/openslp-2.0.0-CVE-2016-7567.patch b/network/analyzer/openslp/files/openslp-2.0.0-CVE-2016-7567.patch
new file mode 100644
index 0000000000..197b13c448
--- /dev/null
+++ b/network/analyzer/openslp/files/openslp-2.0.0-CVE-2016-7567.patch
@@ -0,0 +1,89 @@
+--- openslp/common/slp_compare.c
++++ openslp/common/slp_compare.c
+@@ -194,7 +194,8 @@
+ * @return The new (shorter) length of @p str.
+ *
+ * @note This routine assumes that leading and trailing white space have
+- * already been removed from @p str.
++ * already been removed from @p str. It also assumes that @p str may
++ * not be null-terminated.
+ */
+ static int SLPFoldWhiteSpace(size_t len, char * str)
+ {
+@@ -203,11 +204,11 @@
+ {
+ if (isspace(*p))
+ {
+- char * ws2p = ++p; /* Point ws2p to the second ws char. */
+- while (isspace(*p)) /* Scan till we hit a non-ws char. */
++ char * ws2p = ++p; /* Point ws2p to the second ws char. */
++ while (p < ep && isspace(*p)) /* Scan till we hit a non-ws char. */
+ p++;
+- len -= p - ws2p; /* Reduce the length by extra ws. */
+- memmove(ws2p, p, ep - p); /* Overwrite the extra white space. */
++ len -= p - ws2p; /* Reduce the length by extra ws. */
++ memmove(ws2p, p, ep - p); /* Overwrite the extra white space. */
+ }
+ p++;
+ }
+@@ -821,6 +822,50 @@
+
+ #ifdef SLP_COMPARE_TEST
+
++/* Test boundary conditions of SLPFoldWhiteSpace. */
++static int test_SLPFoldWhiteSpace(void)
++{
++ static char test_str0[] = " ";
++ static char test_str1[] = "Blah";
++ static char test_str3[] = "Blah blah";
++ static char test_str4[] = "Blah blah";
++ static char test_str5[] = "Blah blah blah";
++ static char test_str8[] = " Blah blah";
++ static char test_str9[] = " Blah blah";
++ static char test_strC[] = "Blah blah ";
++ static char test_strD[] = "Blah blah xxxx";
++
++ static char * test_strs[] =
++ {
++ test_str0, test_str0, test_str0, test_str1, test_strC,
++ test_str3, test_str4, test_str5, test_strC, test_strC,
++ test_str8, test_str9, test_strC, test_strD,
++ };
++
++ static int test_lens[] =
++ {
++ 0, 1, 2, 4, 9, 10, 11, 15, 10, 11, 10, 11, 11, 11,
++ };
++
++ static int test_fins[] =
++ {
++ 0, 1, 1, 4, 9, 9, 9, 14, 10, 10, 10, 10, 10, 10,
++ };
++
++#define MAX_BUFSZ 32
++
++ int i;
++ for (i = 0; i < sizeof(test_strs) / sizeof(*test_strs); ++i)
++ {
++ char test_buf[MAX_BUFSZ];
++ memmove(test_buf, test_strs[i], test_lens[i]);
++ int len = SLPFoldWhiteSpace(test_lens[i], test_buf);
++ if (len != test_fins[i])
++ return -1;
++ }
++ return 0;
++}
++
+ /* ---------------- Test main for the slp_compare.c module ----------------
+ *
+ * Compile with:
+@@ -840,6 +885,9 @@
+
+ int count;
+
++ if (test_SLPFoldWhiteSpace() != 0)
++ return -1;
++
+ /* *** SLPContainsStringList ***
+ */
+ count = SLPContainsStringList(sizeof lst1 - 1, lst1, sizeof str1 - 1, str1);
diff --git a/network/analyzer/openslp/files/openslp-2.0.0-CVE-2017-17833.patch b/network/analyzer/openslp/files/openslp-2.0.0-CVE-2017-17833.patch
new file mode 100644
index 0000000000..eefce40242
--- /dev/null
+++ b/network/analyzer/openslp/files/openslp-2.0.0-CVE-2017-17833.patch
@@ -0,0 +1,19 @@
+diff -up openslp-2.0.0/slpd/slpd_process.c.orig openslp-2.0.0/slpd/slpd_process.c
+--- openslp-2.0.0/slpd/slpd_process.c.orig 2018-05-09 13:08:06.185104375 +0200
++++ openslp-2.0.0/slpd/slpd_process.c 2018-05-09 13:07:21.017095089 +0200
+@@ -462,6 +462,15 @@ static int ProcessSrvRqst(SLPMessage * m
+ message->body.srvrqst.srvtype, 23, SLP_DA_SERVICE_TYPE) == 0)
+ {
+ errorcode = ProcessDASrvRqst(message, sendbuf, errorcode);
++
++ if (result != *sendbuf)
++ {
++ // The pointer stored at *sendbuf can be modified by a realloc
++ // operation in ProcessDASrvRqst(). Fix up the local copy of
++ // that pointer if necessary.
++ result = *sendbuf;
++ }
++
+ if (errorcode == 0)
+ {
+ /* Since we have an errorcode of 0, we were successful,
diff --git a/network/analyzer/openslp/files/openslp-2.0.0-fdr-CVE-2019-5544.patch b/network/analyzer/openslp/files/openslp-2.0.0-fdr-CVE-2019-5544.patch
new file mode 100644
index 0000000000..2afc0aed33
--- /dev/null
+++ b/network/analyzer/openslp/files/openslp-2.0.0-fdr-CVE-2019-5544.patch
@@ -0,0 +1,165 @@
+diff -ur openslp-2.0.0.orig/common/slp_buffer.c openslp-2.0.0/common/slp_buffer.c
+--- openslp-2.0.0.orig/common/slp_buffer.c 2012-12-10 15:31:53.000000000 -0800
++++ openslp-2.0.0/common/slp_buffer.c 2019-11-26 21:54:20.000000000 -0800
+@@ -30,6 +30,13 @@
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *-------------------------------------------------------------------------*/
+
++/* Copyright (c) 2019 VMware, Inc.
++ * SPDX-License-Identifier: BSD-3-Clause
++ * This file is provided under the BSD-3-Clause license.
++ * See COPYING file for more details and other copyrights
++ * that may apply.
++ */
++
+ /** Functions for managing SLP message buffers.
+ *
+ * This file provides a higher level abstraction over malloc and free that
+@@ -153,4 +160,20 @@
+ xfree(buf);
+ }
+
++/** Report remaining free buffer size in bytes.
++ *
++ * Check if buffer is allocated and if so return bytes left in a
++ * @c SLPBuffer object.
++ *
++ * @param[in] buf The SLPBuffer to be freed.
++ */
++size_t
++RemainingBufferSpace(SLPBuffer buf)
++{
++ if (buf->allocated == 0) {
++ return 0;
++ }
++ return buf->end - buf->curpos;
++}
++
+ /*=========================================================================*/
+diff -ur openslp-2.0.0.orig/common/slp_buffer.h openslp-2.0.0/common/slp_buffer.h
+--- openslp-2.0.0.orig/common/slp_buffer.h 2012-11-28 09:07:04.000000000 -0800
++++ openslp-2.0.0/common/slp_buffer.h 2019-11-26 21:54:32.000000000 -0800
+@@ -30,6 +30,13 @@
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *-------------------------------------------------------------------------*/
+
++/* Copyright (c) 2019 VMware, Inc.
++ * SPDX-License-Identifier: BSD-3-Clause
++ * This file is provided under the BSD-3-Clause license.
++ * See COPYING file for more details and other copyrights
++ * that may apply.
++ */
++
+ /** Header file that defines SLP message buffer management routines.
+ *
+ * Includes structures, constants and functions that used to handle memory
+@@ -78,6 +85,8 @@
+
+ SLPBuffer SLPBufferListAdd(SLPBuffer * list, SLPBuffer buf);
+
++size_t RemainingBufferSpace(SLPBuffer buf);
++
+ /*! @} */
+
+ #endif /* SLP_BUFFER_H_INCLUDED */
+diff -ur openslp-2.0.0.orig/slpd/slpd_process.c openslp-2.0.0/slpd/slpd_process.c
+--- openslp-2.0.0.orig/slpd/slpd_process.c 2012-12-12 09:38:54.000000000 -0800
++++ openslp-2.0.0/slpd/slpd_process.c 2019-11-26 21:55:10.000000000 -0800
+@@ -30,6 +30,13 @@
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *-------------------------------------------------------------------------*/
+
++/* Copyright (c) 2019 VMware, Inc.
++ * SPDX-License-Identifier: BSD-3-Clause
++ * This file is provided under the BSD-3-Clause license.
++ * See COPYING file for more details and other copyrights
++ * that may apply.
++ */
++
+ /** Processes incoming SLP messages.
+ *
+ * @file slpd_process.c
+@@ -514,13 +521,27 @@
+ {
+ for (i = 0; i < db->urlcount; i++)
+ {
+- /* urlentry is the url from the db result */
+ urlentry = db->urlarray[i];
++ if (urlentry->opaque != NULL) {
++ const int64_t newsize = size + urlentry->opaquelen;
++ if (urlentry->opaquelen <= 0 || newsize > INT_MAX)
++ {
++ SLPDLog("Invalid opaquelen %d or sizeo of opaque url is too big, size=%d\n",
++ urlentry->opaquelen, size);
++ errorcode = SLP_ERROR_PARSE_ERROR;
++ goto FINISHED;
++ }
++ size += urlentry->opaquelen;
++ }
++ else
++ {
++ /* urlentry is the url from the db result */
++ size += urlentry->urllen + 6; /* 1 byte for reserved */
++ /* 2 bytes for lifetime */
++ /* 2 bytes for urllen */
++ /* 1 byte for authcount */
++ }
+
+- size += urlentry->urllen + 6; /* 1 byte for reserved */
+- /* 2 bytes for lifetime */
+- /* 2 bytes for urllen */
+- /* 1 byte for authcount */
+ #ifdef ENABLE_SLPv2_SECURITY
+ /* make room to include the authblock that was asked for */
+ if (G_SlpdProperty.securityEnabled
+@@ -594,7 +615,7 @@
+ urlentry = db->urlarray[i];
+
+ #ifdef ENABLE_SLPv1
+- if (urlentry->opaque == 0)
++ if (urlentry->opaque == NULL)
+ {
+ /* url-entry reserved */
+ *result->curpos++ = 0;
+@@ -606,8 +627,18 @@
+ PutUINT16(&result->curpos, urlentry->urllen);
+
+ /* url-entry url */
+- memcpy(result->curpos, urlentry->url, urlentry->urllen);
+- result->curpos += urlentry->urllen;
++ if (RemainingBufferSpace(result) >= urlentry->urllen)
++ {
++ memcpy(result->curpos, urlentry->url, urlentry->urllen);
++ result->curpos = result->curpos + urlentry->urllen;
++ }
++ else
++ {
++ SLPDLog("Url too big (ask: %d have %" PRId64 "), failing request\n",
++ urlentry->opaquelen, (int64_t) RemainingBufferSpace(result));
++ errorcode = SLP_ERROR_PARSE_ERROR;
++ goto FINISHED;
++ }
+
+ /* url-entry auths */
+ *result->curpos++ = 0;
+@@ -621,8 +652,18 @@
+
+ /* TRICKY: Fix up the lifetime. */
+ TO_UINT16(urlentry->opaque + 1, urlentry->lifetime);
+- memcpy(result->curpos, urlentry->opaque, urlentry->opaquelen);
+- result->curpos += urlentry->opaquelen;
++ if (RemainingBufferSpace(result) >= urlentry->opaquelen)
++ {
++ memcpy(result->curpos, urlentry->opaque, urlentry->opaquelen);
++ result->curpos = result->curpos + urlentry->opaquelen;
++ }
++ else
++ {
++ SLPDLog("Opaque Url too big (ask: %d have %" PRId64 "), failing request\n",
++ urlentry->opaquelen, (int64_t) RemainingBufferSpace(result));
++ errorcode = SLP_ERROR_PARSE_ERROR;
++ goto FINISHED;
++ }
+ }
+ }
+ }
diff --git a/network/analyzer/openslp/files/openslp-2.0.0-null-pointer-deref.patch b/network/analyzer/openslp/files/openslp-2.0.0-null-pointer-deref.patch
new file mode 100644
index 0000000000..3c07d6efb4
--- /dev/null
+++ b/network/analyzer/openslp/files/openslp-2.0.0-null-pointer-deref.patch
@@ -0,0 +1,12 @@
+diff -up openslp-2.0.0/common/slp_xmalloc.c.orig openslp-2.0.0/common/slp_xmalloc.c
+--- openslp-2.0.0/common/slp_xmalloc.c.orig 2012-12-07 01:52:08.000000000 +0100
++++ openslp-2.0.0/common/slp_xmalloc.c 2016-05-23 12:58:57.953532979 +0200
+@@ -203,6 +203,8 @@ void * _xrealloc(const char * file, int
+ if (x->size != size)
+ {
+ newptr = _xmalloc(file, line, size);
++ if (newptr == 0)
++ return 0;
+ memcpy(newptr, ptr, x->size);
+ _xfree(file, line, x);
+ }
diff --git a/network/analyzer/openslp/files/openslp-2.0.0-openssl-1.1-fix.patch b/network/analyzer/openslp/files/openslp-2.0.0-openssl-1.1-fix.patch
new file mode 100644
index 0000000000..78dc6c5de7
--- /dev/null
+++ b/network/analyzer/openslp/files/openslp-2.0.0-openssl-1.1-fix.patch
@@ -0,0 +1,25 @@
+diff -up openslp-2.0.0/common/slp_crypto.c.orig openslp-2.0.0/common/slp_crypto.c
+--- openslp-2.0.0/common/slp_crypto.c.orig 2012-12-07 21:13:28.000000000 +0100
++++ openslp-2.0.0/common/slp_crypto.c 2017-02-22 11:16:11.620835724 +0100
+@@ -88,11 +88,16 @@ SLPCryptoDSAKey * SLPCryptoDSAKeyDup(SLP
+ result = DSA_new();
+ if (result)
+ {
+- result->p = BN_dup(dsa->p);
+- result->q = BN_dup(dsa->q);
+- result->g = BN_dup(dsa->g);
+- result->priv_key = BN_dup(dsa->priv_key);
+- result->pub_key = BN_dup(dsa->pub_key);
++ const BIGNUM *p, *q, *g;
++ const BIGNUM *priv_key, *pub_key;
++
++ DSA_get0_pqg(dsa, &p, &q, &g);
++ DSA_get0_key(dsa, &pub_key, &priv_key);
++
++ /* would be nice to check return values,
++ * but original code didn't do that either... */
++ DSA_set0_pqg(result, BN_dup(p), BN_dup(q), BN_dup(g));
++ DSA_set0_key(result, BN_dup(pub_key), BN_dup(priv_key));
+ }
+ return result;
+ }
diff --git a/network/analyzer/openslp/pspec.xml b/network/analyzer/openslp/pspec.xml
index 04cdcca8b2..f556128f76 100644
--- a/network/analyzer/openslp/pspec.xml
+++ b/network/analyzer/openslp/pspec.xml
@@ -19,6 +19,13 @@
doxygen
docbook-xsl
+
+ openslp-2.0.0-CVE-2016-7567.patch
+ openslp-2.0.0-CVE-2017-17833.patch
+ openslp-2.0.0-fdr-CVE-2019-5544.patch
+ openslp-2.0.0-null-pointer-deref.patch
+ openslp-2.0.0-openssl-1.1-fix.patch
+
@@ -68,6 +75,13 @@
+
+ 2020-02-07
+ 2.0.0
+ Rebuild.
+ Pisi Linux Community
+ admin@pisilinux.org
+
2018-08-15
2.0.0