[Pkg-net-snmp-commits] [pkg-net-snmp] 01/01: add debian/patches/Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch

[Hideki Yamane]

This is an automated email from the git hooks/post-receive script.

henrich pushed a commit to branch jessie
in repository pkg-net-snmp.

commit 2e5e46f8ad4e59fd6bd5bbddc20a686595e44099
Author: Hideki Yamane <henrich at debian.org>
Date:   Thu Jan 28 21:36:33 2016 +0900

    add debian/patches/Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch
---
 debian/changelog                                   |   8 ++
 .../Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch   | 125 +++++++++++++++++++++
 debian/patches/series                              |   1 +
 3 files changed, 134 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 3662047..879eb46 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+net-snmp (5.7.2.1+dfsg-1+deb8u1) stable-proposed-updates; urgency=medium
+
+  * debian/patches
+    - add Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch to fix DoS (and maybe
+      code execution) issue (Closes: #788964)
+
+ -- Hideki Yamane <henrich at debian.org>  Fri, 19 Jun 2015 22:37:43 +0900
+
 net-snmp (5.7.2.1+dfsg-1) unstable; urgency=medium
 
   * re-generate upstream source due to accidentally include non-free MIB files.
diff --git a/debian/patches/Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch b/debian/patches/Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch
new file mode 100644
index 0000000..0a113f3
--- /dev/null
+++ b/debian/patches/Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch
@@ -0,0 +1,125 @@
+Description: fix net-snmp snmp_pdu_parse() DoS
+Origin: upstream
+Bug-Debian: http://bugs.debian.org/788964
+
+taken patch from https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/
+---
+ snmplib/snmp_api.c | 55 +++++++++++++++++++++++++++---------------------------
+ 1 file changed, 28 insertions(+), 27 deletions(-)
+
+--- a/snmplib/snmp_api.c
++++ b/snmplib/snmp_api.c
+@@ -4345,10 +4345,9 @@
+     u_char          type;
+     u_char          msg_type;
+     u_char         *var_val;
+-    int             badtype = 0;
+     size_t          len;
+     size_t          four;
+-    netsnmp_variable_list *vp = NULL;
++    netsnmp_variable_list *vp = NULL, *vplast = NULL;
+     oid             objid[MAX_OID_LEN];
+ 
+     /*
+@@ -4487,38 +4486,24 @@
+                               (ASN_SEQUENCE | ASN_CONSTRUCTOR),
+                               "varbinds");
+     if (data == NULL)
+-        return -1;
++        goto fail;
+ 
+     /*
+      * get each varBind sequence 
+      */
+     while ((int) *length > 0) {
+-        netsnmp_variable_list *vptemp;
+-        vptemp = (netsnmp_variable_list *) malloc(sizeof(*vptemp));
+-        if (NULL == vptemp) {
+-            return -1;
+-        }
+-        if (NULL == vp) {
+-            pdu->variables = vptemp;
+-        } else {
+-            vp->next_variable = vptemp;
+-        }
+-        vp = vptemp;
++        vp = SNMP_MALLOC_TYPEDEF(netsnmp_variable_list);
++        if (NULL == vp)
++            goto fail;
+ 
+-        vp->next_variable = NULL;
+-        vp->val.string = NULL;
+         vp->name_length = MAX_OID_LEN;
+-        vp->name = NULL;
+-        vp->index = 0;
+-        vp->data = NULL;
+-        vp->dataFreeHook = NULL;
+         DEBUGDUMPSECTION("recv", "VarBind");
+         data = snmp_parse_var_op(data, objid, &vp->name_length, &vp->type,
+                                  &vp->val_len, &var_val, length);
+         if (data == NULL)
+-            return -1;
++            goto fail;
+         if (snmp_set_var_objid(vp, objid, vp->name_length))
+-            return -1;
++            goto fail;
+ 
+         len = MAX_PACKET_LENGTH;
+         DEBUGDUMPHEADER("recv", "Value");
+@@ -4583,7 +4568,7 @@
+                 vp->val.string = (u_char *) malloc(vp->val_len);
+             }
+             if (vp->val.string == NULL) {
+-                return -1;
++                goto fail;
+             }
+             asn_parse_string(var_val, &len, &vp->type, vp->val.string,
+                              &vp->val_len);
+@@ -4594,7 +4579,7 @@
+             vp->val_len *= sizeof(oid);
+             vp->val.objid = (oid *) malloc(vp->val_len);
+             if (vp->val.objid == NULL) {
+-                return -1;
++                goto fail;
+             }
+             memmove(vp->val.objid, objid, vp->val_len);
+             break;
+@@ -4606,19 +4591,35 @@
+         case ASN_BIT_STR:
+             vp->val.bitstring = (u_char *) malloc(vp->val_len);
+             if (vp->val.bitstring == NULL) {
+-                return -1;
++                goto fail;
+             }
+             asn_parse_bitstring(var_val, &len, &vp->type,
+                                 vp->val.bitstring, &vp->val_len);
+             break;
+         default:
+             snmp_log(LOG_ERR, "bad type returned (%x)\n", vp->type);
+-            badtype = -1;
++            goto fail;
+             break;
+         }
+         DEBUGINDENTADD(-4);
++
++        if (NULL == vplast) {
++            pdu->variables = vp;
++        } else {
++            vplast->next_variable = vp;
++        }
++        vplast = vp;
++        vp = NULL;
+     }
+-    return badtype;
++    return 0;
++
++  fail:
++    DEBUGMSGTL(("recv", "error while parsing VarBindList\n"));
++    /** if we were parsing a var, remove it from the pdu and free it */
++    if (vp)
++        snmp_free_var(vp);
++
++    return -1;
+ }
+ 
+ /*
diff --git a/debian/patches/series b/debian/patches/series
index 851d31c..35c58a7 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -27,3 +27,4 @@ ifmib.patch
 Fix-kfreebsd-builds-with-kernel-headers-10.patch
 fix-request-id-0.patch
 CVE-2014-3565.patch
+Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-net-snmp/pkg-net-snmp.git