Author: gordon
Date: Tue May 12 16:54:39 2020
New Revision: 360974
URL: https://svnweb.freebsd.org/changeset/base/360974
Log:
Fix memory disclosure vulnerability in libalias.
Approved by: so
Approved by: re (implicit)
Security: FreeBSD-SA-20:13.libalias
Security: CVE-2020-7455
Modified:
releng/11.3/sys/netinet/libalias/alias_ftp.c
releng/11.4/sys/netinet/libalias/alias_ftp.c
releng/12.1/sys/netinet/libalias/alias_ftp.c
Modified: releng/11.3/sys/netinet/libalias/alias_ftp.c
==============================================================================
--- releng/11.3/sys/netinet/libalias/alias_ftp.c Tue May 12 16:52:08
2020 (r360973)
+++ releng/11.3/sys/netinet/libalias/alias_ftp.c Tue May 12 16:54:39
2020 (r360974)
@@ -752,7 +752,8 @@ NewFtpMessage(struct libalias *la, struct ip *pip,
{
u_short new_len;
- new_len = htons(hlen + slen);
+ new_len = htons(hlen +
+ MIN(slen, maxpacketsize - hlen));
DifferentialChecksum(&pip->ip_sum,
&new_len,
&pip->ip_len,
Modified: releng/11.4/sys/netinet/libalias/alias_ftp.c
==============================================================================
--- releng/11.4/sys/netinet/libalias/alias_ftp.c Tue May 12 16:52:08
2020 (r360973)
+++ releng/11.4/sys/netinet/libalias/alias_ftp.c Tue May 12 16:54:39
2020 (r360974)
@@ -752,7 +752,8 @@ NewFtpMessage(struct libalias *la, struct ip *pip,
{
u_short new_len;
- new_len = htons(hlen + slen);
+ new_len = htons(hlen +
+ MIN(slen, maxpacketsize - hlen));
DifferentialChecksum(&pip->ip_sum,
&new_len,
&pip->ip_len,
Modified: releng/12.1/sys/netinet/libalias/alias_ftp.c
==============================================================================
--- releng/12.1/sys/netinet/libalias/alias_ftp.c Tue May 12 16:52:08
2020 (r360973)
+++ releng/12.1/sys/netinet/libalias/alias_ftp.c Tue May 12 16:54:39
2020 (r360974)
@@ -754,7 +754,8 @@ NewFtpMessage(struct libalias *la, struct ip *pip,
{
u_short new_len;
- new_len = htons(hlen + slen);
+ new_len = htons(hlen +
+ MIN(slen, maxpacketsize - hlen));
DifferentialChecksum(&pip->ip_sum,
&new_len,
&pip->ip_len,
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
