diff options
Diffstat (limited to 'internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch')
| -rw-r--r-- | internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch b/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch new file mode 100644 index 00000000..c000a826 --- /dev/null +++ b/internal/rosa/package/net-tools/GHSA-h667-qrp8-gj58.patch @@ -0,0 +1,53 @@ +From a7926399a04ee8e629a02a2aeb6de1952d42d559 Mon Sep 17 00:00:00 2001 +From: Bernd Eckenfels <net-tools@lina.inka.de> +Date: Sat, 17 May 2025 21:11:07 +0200 +Subject: [PATCH] ipmaddr.c: Stack-based buffer Overflow in parse_hex() + +Coordinated as GHSA-h667-qrp8-gj58. +--- + ipmaddr.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/ipmaddr.c b/ipmaddr.c +index 64b7564..623fadd 100644 +--- a/ipmaddr.c ++++ b/ipmaddr.c +@@ -91,17 +91,17 @@ static int parse_lla(char *str, char *addr) + return len; + } + +-static int parse_hex(char *str, unsigned char *addr) ++static int parse_hex(char *str, unsigned char *dst, size_t dstlen) + { + int len=0; + +- while (*str) { ++ while (len < dstlen && *str) { + int tmp; + if (str[1] == 0) + return -1; + if (sscanf(str, "%02x", &tmp) != 1) + return -1; +- addr[len] = tmp; ++ dst[len] = tmp; + len++; + str += 2; + } +@@ -152,7 +152,7 @@ void read_dev_mcast(struct ma_info **result_p) + + m.addr.family = AF_PACKET; + +- len = parse_hex(hexa, (unsigned char*)&m.addr.data); ++ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data)); + if (len >= 0) { + struct ma_info *ma = xmalloc(sizeof(m)); + memcpy(ma, &m, sizeof(m)); +@@ -222,7 +222,7 @@ void read_igmp6(struct ma_info **result_p) + + m.addr.family = AF_INET6; + +- len = parse_hex(hexa, (unsigned char*)&m.addr.data); ++ len = parse_hex(hexa, (unsigned char*)&m.addr.data, sizeof(m.addr.data)); + if (len >= 0) { + struct ma_info *ma = xmalloc(sizeof(m)); + memcpy(ma, &m, sizeof(m)); |