Hello community, here is the log from the commit of package wpa_supplicant for openSUSE:Factory checked in at 2015-04-27 12:58:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wpa_supplicant (Old) and /work/SRC/openSUSE:Factory/.wpa_supplicant.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wpa_supplicant" Changes: -------- --- /work/SRC/openSUSE:Factory/wpa_supplicant/wpa_supplicant.changes 2015-04-22 01:12:08.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.wpa_supplicant.new/wpa_supplicant.changes 2015-04-27 12:58:30.000000000 +0200 @@ -1,0 +2,9 @@ +Thu Apr 23 19:49:28 UTC 2015 - [email protected] + +- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch + Fix CVE-2015-1863, memcpy overflow. +- wpa_supplicant-alloc_size.patch: annotate two wrappers + with attribute alloc_size, which may help warning us of + bugs such as the above. + +------------------------------------------------------------------- New: ---- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch wpa_supplicant-alloc_size.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wpa_supplicant.spec ++++++ --- /var/tmp/diff_new_pack.Q8sCwr/_old 2015-04-27 12:58:31.000000000 +0200 +++ /var/tmp/diff_new_pack.Q8sCwr/_new 2015-04-27 12:58:31.000000000 +0200 @@ -47,6 +47,8 @@ # wpa_supplicant-sigusr1-changes-debuglevel.patch won't go upstream as it # is not portable Patch2: wpa_supplicant-sigusr1-changes-debuglevel.patch +Patch3: 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch +Patch4: wpa_supplicant-alloc_size.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build Requires: logrotate %if ! %{defined _rundir} @@ -84,7 +86,8 @@ cp %{SOURCE1} wpa_supplicant/.config %patch1 -p0 %patch2 -p1 - +%patch3 -p1 +%patch4 -p1 %build cd wpa_supplicant CFLAGS="$RPM_OPT_FLAGS" make V=1 %{?_smp_mflags} ++++++ 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch ++++++ >From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001 From: Jouni Malinen <[email protected]> Date: Tue, 7 Apr 2015 11:32:11 +0300 Subject: [PATCH] P2P: Validate SSID element length before copying it (CVE-2015-1863) This fixes a possible memcpy overflow for P2P dev->oper_ssid in p2p_add_device(). The length provided by the peer device (0..255 bytes) was used without proper bounds checking and that could have resulted in arbitrary data of up to 223 bytes being written beyond the end of the dev->oper_ssid[] array (of which about 150 bytes would be beyond the heap allocation) when processing a corrupted management frame for P2P peer discovery purposes. This could result in corrupted state in heap, unexpected program behavior due to corrupted P2P peer device information, denial of service due to process crash, exposure of memory contents during GO Negotiation, and potentially arbitrary code execution. Thanks to Google security team for reporting this issue and smart hardware research group of Alibaba security team for discovering it. Signed-off-by: Jouni Malinen <[email protected]> --- src/p2p/p2p.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c index f584fae..a45fe73 100644 --- a/src/p2p/p2p.c +++ b/src/p2p/p2p.c @@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq, if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0) os_memcpy(dev->interface_addr, addr, ETH_ALEN); if (msg.ssid && + msg.ssid[1] <= sizeof(dev->oper_ssid) && (msg.ssid[1] != P2P_WILDCARD_SSID_LEN || os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) != 0)) { -- 1.9.1 ++++++ wpa_supplicant-alloc_size.patch ++++++ --- wpa_supplicant-2.4.orig/src/utils/os.h +++ wpa_supplicant-2.4/src/utils/os.h @@ -253,7 +253,7 @@ int os_file_exists(const char *fname); * * Caller is responsible for freeing the returned buffer with os_free(). */ -void * os_zalloc(size_t size); +void * os_zalloc(size_t size) __attribute((malloc, alloc_size(1))); /** * os_calloc - Allocate and zero memory for an array @@ -267,6 +267,8 @@ void * os_zalloc(size_t size); * * Caller is responsible for freeing the returned buffer with os_free(). */ + +__attribute((malloc, alloc_size(1,2))) static inline void * os_calloc(size_t nmemb, size_t size) { if (size && nmemb > (~(size_t) 0) / size)
