aboutsummaryrefslogtreecommitdiffstats
path: root/main/dnsmasq/CVE-2022-0934.patch
diff options
context:
space:
mode:
Diffstat (limited to 'main/dnsmasq/CVE-2022-0934.patch')
-rw-r--r--main/dnsmasq/CVE-2022-0934.patch189
1 files changed, 0 insertions, 189 deletions
diff --git a/main/dnsmasq/CVE-2022-0934.patch b/main/dnsmasq/CVE-2022-0934.patch
deleted file mode 100644
index 13816267ab9..00000000000
--- a/main/dnsmasq/CVE-2022-0934.patch
+++ /dev/null
@@ -1,189 +0,0 @@
-Patch-Source: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=03345ecefeb0d82e3c3a4c28f27c3554f0611b39 (upstream)
---
-From 03345ecefeb0d82e3c3a4c28f27c3554f0611b39 Mon Sep 17 00:00:00 2001
-From: Simon Kelley <simon@thekelleys.org.uk>
-Date: Thu, 31 Mar 2022 21:35:20 +0100
-Subject: [PATCH] Fix write-after-free error in DHCPv6 code. CVE-2022-0934
- refers.
-
----
- CHANGELOG | 3 +++
- src/rfc3315.c | 48 +++++++++++++++++++++++++++---------------------
- 2 files changed, 30 insertions(+), 21 deletions(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 87d6c2b..4bc7fb1 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -55,6 +55,9 @@ version 2.87
- doesn't require hard-coding addresses. Thanks to Sten Spans for
- the idea.
-
-+ Fix write-after-free error in DHCPv6 server code.
-+ CVE-2022-0934 refers.
-+
-
- version 2.86
- Handle DHCPREBIND requests in the DHCPv6 server code.
-diff --git a/src/rfc3315.c b/src/rfc3315.c
-index cee8382..e218d26 100644
---- a/src/rfc3315.c
-+++ b/src/rfc3315.c
-@@ -33,9 +33,9 @@ struct state {
- unsigned int mac_len, mac_type;
- };
-
--static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
-+static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
- struct in6_addr *client_addr, int is_unicast, time_t now);
--static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now);
-+static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);
- static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
- static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
- static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
-@@ -104,12 +104,12 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int interface, char *if
- }
-
- /* This cost me blood to write, it will probably cost you blood to understand - srk. */
--static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
-+static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz,
- struct in6_addr *client_addr, int is_unicast, time_t now)
- {
- void *end = inbuff + sz;
- void *opts = inbuff + 34;
-- int msg_type = *((unsigned char *)inbuff);
-+ int msg_type = *inbuff;
- unsigned char *outmsgtypep;
- void *opt;
- struct dhcp_vendor *vendor;
-@@ -259,15 +259,15 @@ static int dhcp6_maybe_relay(struct state *state, void *inbuff, size_t sz,
- return 1;
- }
-
--static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_t sz, int is_unicast, time_t now)
-+static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)
- {
- void *opt;
-- int i, o, o1, start_opts;
-+ int i, o, o1, start_opts, start_msg;
- struct dhcp_opt *opt_cfg;
- struct dhcp_netid *tagif;
- struct dhcp_config *config = NULL;
- struct dhcp_netid known_id, iface_id, v6_id;
-- unsigned char *outmsgtypep;
-+ unsigned char outmsgtype;
- struct dhcp_vendor *vendor;
- struct dhcp_context *context_tmp;
- struct dhcp_mac *mac_opt;
-@@ -296,12 +296,13 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- v6_id.next = state->tags;
- state->tags = &v6_id;
-
-- /* copy over transaction-id, and save pointer to message type */
-- if (!(outmsgtypep = put_opt6(inbuff, 4)))
-+ start_msg = save_counter(-1);
-+ /* copy over transaction-id */
-+ if (!put_opt6(inbuff, 4))
- return 0;
- start_opts = save_counter(-1);
-- state->xid = outmsgtypep[3] | outmsgtypep[2] << 8 | outmsgtypep[1] << 16;
--
-+ state->xid = inbuff[3] | inbuff[2] << 8 | inbuff[1] << 16;
-+
- /* We're going to be linking tags from all context we use.
- mark them as unused so we don't link one twice and break the list */
- for (context_tmp = state->context; context_tmp; context_tmp = context_tmp->current)
-@@ -347,7 +348,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))
-
- {
-- *outmsgtypep = DHCP6REPLY;
-+ outmsgtype = DHCP6REPLY;
- o1 = new_opt6(OPTION6_STATUS_CODE);
- put_opt6_short(DHCP6USEMULTI);
- put_opt6_string("Use multicast");
-@@ -619,11 +620,11 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- struct dhcp_netid *solicit_tags;
- struct dhcp_context *c;
-
-- *outmsgtypep = DHCP6ADVERTISE;
-+ outmsgtype = DHCP6ADVERTISE;
-
- if (opt6_find(state->packet_options, state->end, OPTION6_RAPID_COMMIT, 0))
- {
-- *outmsgtypep = DHCP6REPLY;
-+ outmsgtype = DHCP6REPLY;
- state->lease_allocate = 1;
- o = new_opt6(OPTION6_RAPID_COMMIT);
- end_opt6(o);
-@@ -809,7 +810,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- int start = save_counter(-1);
-
- /* set reply message type */
-- *outmsgtypep = DHCP6REPLY;
-+ outmsgtype = DHCP6REPLY;
- state->lease_allocate = 1;
-
- log6_quiet(state, "DHCPREQUEST", NULL, ignore ? _("ignored") : NULL);
-@@ -924,7 +925,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- int address_assigned = 0;
-
- /* set reply message type */
-- *outmsgtypep = DHCP6REPLY;
-+ outmsgtype = DHCP6REPLY;
-
- log6_quiet(state, msg_type == DHCP6RENEW ? "DHCPRENEW" : "DHCPREBIND", NULL, NULL);
-
-@@ -1057,7 +1058,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- int good_addr = 0;
-
- /* set reply message type */
-- *outmsgtypep = DHCP6REPLY;
-+ outmsgtype = DHCP6REPLY;
-
- log6_quiet(state, "DHCPCONFIRM", NULL, NULL);
-
-@@ -1121,7 +1122,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- log6_quiet(state, "DHCPINFORMATION-REQUEST", NULL, ignore ? _("ignored") : state->hostname);
- if (ignore)
- return 0;
-- *outmsgtypep = DHCP6REPLY;
-+ outmsgtype = DHCP6REPLY;
- tagif = add_options(state, 1);
- break;
- }
-@@ -1130,7 +1131,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- case DHCP6RELEASE:
- {
- /* set reply message type */
-- *outmsgtypep = DHCP6REPLY;
-+ outmsgtype = DHCP6REPLY;
-
- log6_quiet(state, "DHCPRELEASE", NULL, NULL);
-
-@@ -1195,7 +1196,7 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- case DHCP6DECLINE:
- {
- /* set reply message type */
-- *outmsgtypep = DHCP6REPLY;
-+ outmsgtype = DHCP6REPLY;
-
- log6_quiet(state, "DHCPDECLINE", NULL, NULL);
-
-@@ -1275,7 +1276,12 @@ static int dhcp6_no_relay(struct state *state, int msg_type, void *inbuff, size_
- }
-
- }
--
-+
-+ /* Fill in the message type. Note that we store the offset,
-+ not a direct pointer, since the packet memory may have been
-+ reallocated. */
-+ ((unsigned char *)(daemon->outpacket.iov_base))[start_msg] = outmsgtype;
-+
- log_tags(tagif, state->xid);
- log6_opts(0, state->xid, daemon->outpacket.iov_base + start_opts, daemon->outpacket.iov_base + save_counter(-1));
-
---
-2.20.1
-
generated by cgit v1.2.3 (git 2.41.0) at 2024-04-19 02:42:44 +0000