diff options
| author | Jo-Philipp Wich <jo@mein.io> | 2020-02-26 16:40:21 +0100 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2020-02-26 16:40:25 +0100 |
| commit | 0e9e5b15538e530a88572bc58c689afeba91c0fe (patch) | |
| tree | 30a893d5daa69d2ac3587e8dd3012f816b2587a0 /package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch | |
| parent | 9e2a1af62f9ad68c16c2c58a73b4ae998b674b18 (diff) | |
| download | upstream-0e9e5b15538e530a88572bc58c689afeba91c0fe.tar.gz upstream-0e9e5b15538e530a88572bc58c689afeba91c0fe.tar.bz2 upstream-0e9e5b15538e530a88572bc58c689afeba91c0fe.zip | |
Revert "ppp: backport security fixes"
This reverts commit 6b7eeb74dbf8b491b6426820bfa230fca60047dc since it
didn't contain a reference to the CVE it addresses. The next commit
will re-add the commit including a CVE reference in its commit message.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch')
| -rw-r--r-- | package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch | 37 |
1 files changed, 0 insertions, 37 deletions
diff --git a/package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch b/package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch deleted file mode 100644 index c2ca9729ec..0000000000 --- a/package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001 -From: Paul Mackerras <paulus@ozlabs.org> -Date: Mon, 3 Feb 2020 15:53:28 +1100 -Subject: [PATCH] pppd: Fix bounds check in EAP code - -Given that we have just checked vallen < len, it can never be the case -that vallen >= len + sizeof(rhostname). This fixes the check so we -actually avoid overflowing the rhostname array. - -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Paul Mackerras <paulus@ozlabs.org> ---- - pppd/eap.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pppd/eap.c b/pppd/eap.c -index 94407f56a336..1b93db01aebd 100644 ---- a/pppd/eap.c -+++ b/pppd/eap.c -@@ -1420,7 +1420,7 @@ int len; - } - - /* Not so likely to happen. */ -- if (vallen >= len + sizeof (rhostname)) { -+ if (len - vallen >= sizeof (rhostname)) { - dbglog("EAP: trimming really long peer name down"); - BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); - rhostname[sizeof (rhostname) - 1] = '\0'; -@@ -1846,7 +1846,7 @@ int len; - } - - /* Not so likely to happen. */ -- if (vallen >= len + sizeof (rhostname)) { -+ if (len - vallen >= sizeof (rhostname)) { - dbglog("EAP: trimming really long peer name down"); - BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1); - rhostname[sizeof (rhostname) - 1] = '\0'; |