fixes: Applying patch CVE-2020-11080.patch patching file doc/CMakeLists.txt patching file doc/Makefile.am Hunk #1 FAILED at 69. 1 out of 1 hunk FAILED -- rejects in file doc/Makefile.am patching file lib/includes/nghttp2/nghttp2.h patching file lib/nghttp2_helper.c patching file lib/nghttp2_option.c patching file lib/nghttp2_option.h patching file lib/nghttp2_session.c Hunk #3 succeeded at 5694 (offset 31 lines). Hunk #4 succeeded at 7470 (offset 29 lines). patching file lib/nghttp2_session.h patching file tests/main.c Hunk #1 succeeded at 315 (offset -2 lines). patching file tests/nghttp2_session_test.c Hunk #1 succeeded at 10558 (offset -56 lines). patching file tests/nghttp2_session_test.h Patch CVE-2020-11080.patch does not apply (enforce with -f)
Signed-off-by: Martin Jansa <[email protected]> --- .../nghttp2/nghttp2/CVE-2020-11080.patch | 66 +++++++++---------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/meta-networking/recipes-support/nghttp2/nghttp2/CVE-2020-11080.patch b/meta-networking/recipes-support/nghttp2/nghttp2/CVE-2020-11080.patch index 5cf2e872f4..83a1074191 100644 --- a/meta-networking/recipes-support/nghttp2/nghttp2/CVE-2020-11080.patch +++ b/meta-networking/recipes-support/nghttp2/nghttp2/CVE-2020-11080.patch @@ -1,11 +1,11 @@ -From 336a98feb0d56b9ac54e12736b18785c27f75090 Mon Sep 17 00:00:00 2001 +From 0e3ddf72a648c5909eef3486432f70ba15089f13 Mon Sep 17 00:00:00 2001 From: James M Snell <[email protected]> Date: Fri, 17 Apr 2020 16:53:51 -0700 Subject: [PATCH] Implement max settings option CVE: CVE-2020-11080 Upstream-Status: Backport [https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090] -Comment: No hunks refreshed +Signed-off-by: Martin Jansa <[email protected]> --- doc/CMakeLists.txt | 1 + doc/Makefile.am | 1 + @@ -21,7 +21,7 @@ Comment: No hunks refreshed 11 files changed, 124 insertions(+) diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt -index 34c027929..f3aec84da 100644 +index 34c02792..f3aec84d 100644 --- a/doc/CMakeLists.txt +++ b/doc/CMakeLists.txt @@ -42,6 +42,7 @@ set(APIDOCS @@ -33,25 +33,25 @@ index 34c027929..f3aec84da 100644 nghttp2_priority_spec_check_default.rst nghttp2_priority_spec_default_init.rst diff --git a/doc/Makefile.am b/doc/Makefile.am -index 4d73cef50..f073bfa4c 100644 +index 4d73cef5..f073bfa4 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -69,6 +69,7 @@ APIDOCS= \ - nghttp2_option_set_peer_max_concurrent_streams.rst \ - nghttp2_option_set_user_recv_extension_type.rst \ - nghttp2_option_set_max_outbound_ack.rst \ -+ nghttp2_option_set_max_settings.rst \ - nghttp2_pack_settings_payload.rst \ - nghttp2_priority_spec_check_default.rst \ - nghttp2_priority_spec_default_init.rst \ + nghttp2_option_set_peer_max_concurrent_streams.rst \ + nghttp2_option_set_user_recv_extension_type.rst \ + nghttp2_option_set_max_outbound_ack.rst \ ++ nghttp2_option_set_max_settings.rst \ + nghttp2_pack_settings_payload.rst \ + nghttp2_priority_spec_check_default.rst \ + nghttp2_priority_spec_default_init.rst \ diff --git a/lib/includes/nghttp2/nghttp2.h b/lib/includes/nghttp2/nghttp2.h -index e3aeb9fed..9be6eea5c 100644 +index e3aeb9fe..9be6eea5 100644 --- a/lib/includes/nghttp2/nghttp2.h +++ b/lib/includes/nghttp2/nghttp2.h @@ -228,6 +228,13 @@ typedef struct { */ #define NGHTTP2_CLIENT_MAGIC_LEN 24 - + +/** + * @macro + * @@ -77,7 +77,7 @@ index e3aeb9fed..9be6eea5c 100644 @@ -2659,6 +2671,17 @@ NGHTTP2_EXTERN void nghttp2_option_set_no_closed_streams(nghttp2_option *option, NGHTTP2_EXTERN void nghttp2_option_set_max_outbound_ack(nghttp2_option *option, size_t val); - + +/** + * @function + * @@ -93,7 +93,7 @@ index e3aeb9fed..9be6eea5c 100644 * @function * diff --git a/lib/nghttp2_helper.c b/lib/nghttp2_helper.c -index 91136a619..0bd541472 100644 +index 91136a61..0bd54147 100644 --- a/lib/nghttp2_helper.c +++ b/lib/nghttp2_helper.c @@ -334,6 +334,8 @@ const char *nghttp2_strerror(int error_code) { @@ -106,7 +106,7 @@ index 91136a619..0bd541472 100644 return "Unknown error code"; } diff --git a/lib/nghttp2_option.c b/lib/nghttp2_option.c -index e53f22d36..34348e660 100644 +index e53f22d3..34348e66 100644 --- a/lib/nghttp2_option.c +++ b/lib/nghttp2_option.c @@ -121,3 +121,8 @@ void nghttp2_option_set_max_outbound_ack(nghttp2_option *option, size_t val) { @@ -119,7 +119,7 @@ index e53f22d36..34348e660 100644 + option->max_settings = val; +} diff --git a/lib/nghttp2_option.h b/lib/nghttp2_option.h -index 1f740aaa6..939729fdc 100644 +index 1f740aaa..939729fd 100644 --- a/lib/nghttp2_option.h +++ b/lib/nghttp2_option.h @@ -67,6 +67,7 @@ typedef enum { @@ -128,7 +128,7 @@ index 1f740aaa6..939729fdc 100644 NGHTTP2_OPT_MAX_OUTBOUND_ACK = 1 << 11, + NGHTTP2_OPT_MAX_SETTINGS = 1 << 12, } nghttp2_option_flag; - + /** @@ -85,6 +86,10 @@ struct nghttp2_option { * NGHTTP2_OPT_MAX_OUTBOUND_ACK @@ -142,15 +142,15 @@ index 1f740aaa6..939729fdc 100644 * Bitwise OR of nghttp2_option_flag to determine that which fields * are specified. diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c -index 563ccd7de..415e34776 100644 +index 9df3d6f3..470576da 100644 --- a/lib/nghttp2_session.c +++ b/lib/nghttp2_session.c @@ -458,6 +458,7 @@ static int session_new(nghttp2_session **session_ptr, - + (*session_ptr)->max_send_header_block_length = NGHTTP2_MAX_HEADERSLEN; (*session_ptr)->max_outbound_ack = NGHTTP2_DEFAULT_MAX_OBQ_FLOOD_ITEM; + (*session_ptr)->max_settings = NGHTTP2_DEFAULT_MAX_SETTINGS; - + if (option) { if ((option->opt_set_mask & NGHTTP2_OPT_NO_AUTO_WINDOW_UPDATE) && @@ -521,6 +522,11 @@ static int session_new(nghttp2_session **session_ptr, @@ -163,12 +163,12 @@ index 563ccd7de..415e34776 100644 + (*session_ptr)->max_settings = option->max_settings; + } } - + rv = nghttp2_hd_deflate_init2(&(*session_ptr)->hd_deflater, -@@ -5657,6 +5663,16 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in, +@@ -5688,6 +5694,16 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in, iframe->max_niv = iframe->frame.hd.length / NGHTTP2_FRAME_SETTINGS_ENTRY_LENGTH + 1; - + + if (iframe->max_niv - 1 > session->max_settings) { + rv = nghttp2_session_terminate_session_with_reason( + session, NGHTTP2_ENHANCE_YOUR_CALM, @@ -181,8 +181,8 @@ index 563ccd7de..415e34776 100644 + iframe->iv = nghttp2_mem_malloc(mem, sizeof(nghttp2_settings_entry) * iframe->max_niv); - -@@ -7425,6 +7441,11 @@ static int nghttp2_session_upgrade_internal(nghttp2_session *session, + +@@ -7454,6 +7470,11 @@ static int nghttp2_session_upgrade_internal(nghttp2_session *session, if (settings_payloadlen % NGHTTP2_FRAME_SETTINGS_ENTRY_LENGTH) { return NGHTTP2_ERR_INVALID_ARGUMENT; } @@ -195,7 +195,7 @@ index 563ccd7de..415e34776 100644 settings_payloadlen, mem); if (rv != 0) { diff --git a/lib/nghttp2_session.h b/lib/nghttp2_session.h -index d20827315..07bfbb6c9 100644 +index 90ead9c0..0cd51815 100644 --- a/lib/nghttp2_session.h +++ b/lib/nghttp2_session.h @@ -267,6 +267,8 @@ struct nghttp2_session { @@ -208,10 +208,10 @@ index d20827315..07bfbb6c9 100644 uint32_t next_stream_id; /* The last stream ID this session initiated. For client session, diff --git a/tests/main.c b/tests/main.c -index 41e0b03eb..67eb4a1c2 100644 +index 46e9b1cb..e1e75689 100644 --- a/tests/main.c +++ b/tests/main.c -@@ -317,6 +317,8 @@ int main() { +@@ -315,6 +315,8 @@ int main() { test_nghttp2_session_set_local_window_size) || !CU_add_test(pSuite, "session_cancel_from_before_frame_send", test_nghttp2_session_cancel_from_before_frame_send) || @@ -221,13 +221,13 @@ index 41e0b03eb..67eb4a1c2 100644 test_nghttp2_session_removed_closed_stream) || !CU_add_test(pSuite, "session_pause_data", diff --git a/tests/nghttp2_session_test.c b/tests/nghttp2_session_test.c -index 6eb8e244d..33ee3ad84 100644 +index b366a6aa..cefe27a6 100644 --- a/tests/nghttp2_session_test.c +++ b/tests/nghttp2_session_test.c -@@ -10614,6 +10614,67 @@ void test_nghttp2_session_cancel_from_before_frame_send(void) { +@@ -10558,6 +10558,67 @@ void test_nghttp2_session_cancel_from_before_frame_send(void) { nghttp2_session_del(session); } - + +void test_nghttp2_session_too_many_settings(void) { + nghttp2_session *session; + nghttp2_option *option; @@ -293,7 +293,7 @@ index 6eb8e244d..33ee3ad84 100644 prepare_session_removed_closed_stream(nghttp2_session *session, nghttp2_hd_deflater *deflater) { diff --git a/tests/nghttp2_session_test.h b/tests/nghttp2_session_test.h -index e872c5d0b..818c808d0 100644 +index e872c5d0..818c808d 100644 --- a/tests/nghttp2_session_test.h +++ b/tests/nghttp2_session_test.h @@ -156,6 +156,7 @@ void test_nghttp2_session_repeated_priority_change(void); -- 2.27.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#89628): https://lists.openembedded.org/g/openembedded-devel/message/89628 Mute This Topic: https://lists.openembedded.org/mt/80791600/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
