From c69ccdd30724615d115c4e0a38d3be98f93f08f2 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Thu, 5 Oct 2017 14:47:30 +0200 Subject: [PATCH] CC: dnsmasq: bump to v2.78 Fixes CVE-2017-14491, CVE-2017-14492, CVE-2017-14493, CVE-2017-14494, 2017-CVE-14495, 2017-CVE-14496 Signed-off-by: Kevin Darbyshire-Bryant --- package/network/services/dnsmasq/Makefile | 4 +-- .../dnsmasq/patches/025-fix-CVE-2017-13704.patch | 37 ---------------------- .../230-fix-poll-h-include-warning-on-musl.patch | 2 +- 3 files changed, 3 insertions(+), 40 deletions(-) delete mode 100644 package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile index 80ac42a5dc..9f38de1831 100644 --- a/package/network/services/dnsmasq/Makefile +++ b/package/network/services/dnsmasq/Makefile @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=dnsmasq -PKG_VERSION:=2.77 +PKG_VERSION:=2.78 PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/ -PKG_MD5SUM:=5b973fea8e66e76a0e6bb44adefc6f9b +PKG_MD5SUM:=6d0241b72c79d2b510776ccc4ed69ca4 PKG_LICENSE:=GPL-2.0 PKG_LICENSE_FILES:=COPYING diff --git a/package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch b/package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch deleted file mode 100644 index 8848131dac..0000000000 --- a/package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 38af9b1ac3242a4128e88069c495024caa565f0e Mon Sep 17 00:00:00 2001 -From: Kevin Darbyshire-Bryant -Date: Tue, 29 Aug 2017 12:35:40 +0100 -Subject: [PATCH] forward.c: fix CVE-2017-13704 - -Fix SIGSEGV in rfc1035.c answer_request() line 1228 where memset() -is called with header & limit pointing at the same address and thus -tries to clear memory from before the buffer begins. - -answer_request() is called with an invalid edns packet size provided by -the client. Ensure the udp_size provided by the client is bounded by -512 and configured maximum as per RFC 6891 6.2.3 "Values lower than 512 -MUST be treated as equal to 512" - -The client that exposed the problem provided a payload udp size of 0. - -Signed-off-by: Kevin Darbyshire-Bryant ---- - src/forward.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/src/forward.c b/src/forward.c -index f22556a..62c5a5a 100644 ---- a/src/forward.c -+++ b/src/forward.c -@@ -1408,6 +1408,8 @@ void receive_query(struct listener *listen, time_t now) - defaults to 512 */ - if (udp_size > daemon->edns_pktsz) - udp_size = daemon->edns_pktsz; -+ if (udp_size < 512) -+ udp_size = 512; /* RFC 6891 6.2.3 */ - } - - #ifdef HAVE_AUTH --- -2.7.4 - diff --git a/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch b/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch index 19300f7d66..37b11abc1d 100644 --- a/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch +++ b/package/network/services/dnsmasq/patches/230-fix-poll-h-include-warning-on-musl.patch @@ -7,7 +7,7 @@ Signed-off-by: Kevin Darbyshire-Bryant --- a/src/dnsmasq.h +++ b/src/dnsmasq.h -@@ -82,7 +82,7 @@ typedef unsigned long long u64; +@@ -88,7 +88,7 @@ typedef unsigned long long u64; #if defined(HAVE_SOLARIS_NETWORK) # include #endif -- 2.11.0