* [Buildroot] [PATCH] libminiupnpc: add upstream security fix for CVE-2017-8798
@ 2017-05-19 13:48 Peter Korsgaard
2017-05-21 22:00 ` Peter Korsgaard
2017-06-01 14:07 ` Peter Korsgaard
0 siblings, 2 replies; 3+ messages in thread
From: Peter Korsgaard @ 2017-05-19 13:48 UTC (permalink / raw)
To: buildroot
CVE-2017-8798: Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221
through v2.0 allows remote attackers to cause a denial of service or
possibly have unspecified other impact.
For more details including a PoC, see:
https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
.../0001-miniupnpc-Fix-CVE-2017-8798.patch | 59 ++++++++++++++++++++++
1 file changed, 59 insertions(+)
create mode 100644 package/libminiupnpc/0001-miniupnpc-Fix-CVE-2017-8798.patch
diff --git a/package/libminiupnpc/0001-miniupnpc-Fix-CVE-2017-8798.patch b/package/libminiupnpc/0001-miniupnpc-Fix-CVE-2017-8798.patch
new file mode 100644
index 000000000..25591fc4a
--- /dev/null
+++ b/package/libminiupnpc/0001-miniupnpc-Fix-CVE-2017-8798.patch
@@ -0,0 +1,59 @@
+From f0f1f4b22d6a98536377a1bb07e7c20e4703d229 Mon Sep 17 00:00:00 2001
+From: Thomas Bernard <miniupnp@free.fr>
+Date: Tue, 9 May 2017 12:00:47 +0200
+Subject: [PATCH] miniupnpc: Fix CVE-2017-8798
+
+Thanks to tin/Team OSTStrom
+
+[Peter: drop Changelog.txt modification, convert to -p1 format]
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ miniupnpc/miniwget.c | 12 +++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/miniwget.c b/miniwget.c
+index 37cb47b7..1eda57c5 100644
+--- a/miniwget.c
++++ b/miniwget.c
+@@ -284,11 +284,12 @@ getHTTPResponse(int s, int * size, int * status_code)
+ goto end_of_stream;
+ }
+ }
+- bytestocopy = ((int)chunksize < (n - i))?chunksize:(unsigned int)(n - i);
++ /* it is guaranteed that (n >= i) */
++ bytestocopy = (chunksize < (unsigned int)(n - i))?chunksize:(unsigned int)(n - i);
+ if((content_buf_used + bytestocopy) > content_buf_len)
+ {
+ char * tmp;
+- if(content_length >= (int)(content_buf_used + bytestocopy)) {
++ if((content_length >= 0) && ((unsigned int)content_length >= (content_buf_used + bytestocopy))) {
+ content_buf_len = content_length;
+ } else {
+ content_buf_len = content_buf_used + bytestocopy;
+@@ -313,14 +314,15 @@ getHTTPResponse(int s, int * size, int * status_code)
+ {
+ /* not chunked */
+ if(content_length > 0
+- && (int)(content_buf_used + n) > content_length) {
++ && (content_buf_used + n) > (unsigned int)content_length) {
+ /* skipping additional bytes */
+ n = content_length - content_buf_used;
+ }
+ if(content_buf_used + n > content_buf_len)
+ {
+ char * tmp;
+- if(content_length >= (int)(content_buf_used + n)) {
++ if(content_length >= 0
++ && (unsigned int)content_length >= (content_buf_used + n)) {
+ content_buf_len = content_length;
+ } else {
+ content_buf_len = content_buf_used + n;
+@@ -340,7 +342,7 @@ getHTTPResponse(int s, int * size, int * status_code)
+ }
+ }
+ /* use the Content-Length header value if available */
+- if(content_length > 0 && (int)content_buf_used >= content_length)
++ if(content_length > 0 && content_buf_used >= (unsigned int)content_length)
+ {
+ #ifdef DEBUG
+ printf("End of HTTP content\n");
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH] libminiupnpc: add upstream security fix for CVE-2017-8798
2017-05-19 13:48 [Buildroot] [PATCH] libminiupnpc: add upstream security fix for CVE-2017-8798 Peter Korsgaard
@ 2017-05-21 22:00 ` Peter Korsgaard
2017-06-01 14:07 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2017-05-21 22:00 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> CVE-2017-8798: Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221
> through v2.0 allows remote attackers to cause a denial of service or
> possibly have unspecified other impact.
> For more details including a PoC, see:
> https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH] libminiupnpc: add upstream security fix for CVE-2017-8798
2017-05-19 13:48 [Buildroot] [PATCH] libminiupnpc: add upstream security fix for CVE-2017-8798 Peter Korsgaard
2017-05-21 22:00 ` Peter Korsgaard
@ 2017-06-01 14:07 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2017-06-01 14:07 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> CVE-2017-8798: Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221
> through v2.0 allows remote attackers to cause a denial of service or
> possibly have unspecified other impact.
> For more details including a PoC, see:
> https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed to 2017.02.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-06-01 14:07 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-19 13:48 [Buildroot] [PATCH] libminiupnpc: add upstream security fix for CVE-2017-8798 Peter Korsgaard
2017-05-21 22:00 ` Peter Korsgaard
2017-06-01 14:07 ` Peter Korsgaard
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.