From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Peter Korsgaard <peter@korsgaard.com>
Cc: Luca Ceresoli <luca.ceresoli@bootlin.com>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/libpjsip: security bump to version 2.13.1
Date: Sun, 24 Sep 2023 11:02:26 +0200 [thread overview]
Message-ID: <20230924090226.GF1469982@scaer> (raw)
In-Reply-To: <20230923092414.4075194-1-peter@korsgaard.com>
Peter, All,
On 2023-09-23 11:24 +0200, Peter Korsgaard spake thusly:
> Fixes the following security vulnerability:
>
> - CVE-2023-27585: Heap buffer overflow when parsing DNS packet
> https://github.com/pjsip/pjproject/security/advisories/GHSA-q9cp-8wcq-7pfr
>
> Drop now upstreamed security fixes for CVE-2022-23537 and CVE-2022-23547.
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> ---
> ...ull-request-from-GHSA-9pfh-r8x4-w26w.patch | 99 -------------------
> ...ull-request-from-GHSA-cxwq-5g9x-x7fr.patch | 54 ----------
$ make check-package
.checkpackageignore:743: ignored file package/libpjsip/0001-Merge-pull-request-from-GHSA-9pfh-r8x4-w26w.patch is missing
.checkpackageignore:744: ignored file package/libpjsip/0002-Merge-pull-request-from-GHSA-cxwq-5g9x-x7fr.patch is missing
Applied to master with the above fixed, thanks.
Regards,
Yann E. MORIN.
> package/libpjsip/libpjsip.hash | 2 +-
> package/libpjsip/libpjsip.mk | 8 +-
> 4 files changed, 2 insertions(+), 161 deletions(-)
> delete mode 100644 package/libpjsip/0001-Merge-pull-request-from-GHSA-9pfh-r8x4-w26w.patch
> delete mode 100644 package/libpjsip/0002-Merge-pull-request-from-GHSA-cxwq-5g9x-x7fr.patch
>
> diff --git a/package/libpjsip/0001-Merge-pull-request-from-GHSA-9pfh-r8x4-w26w.patch b/package/libpjsip/0001-Merge-pull-request-from-GHSA-9pfh-r8x4-w26w.patch
> deleted file mode 100644
> index 01e1878189..0000000000
> --- a/package/libpjsip/0001-Merge-pull-request-from-GHSA-9pfh-r8x4-w26w.patch
> +++ /dev/null
> @@ -1,99 +0,0 @@
> -From d8440f4d711a654b511f50f79c0445b26f9dd1e1 Mon Sep 17 00:00:00 2001
> -From: Nanang Izzuddin <nanang@teluu.com>
> -Date: Tue, 20 Dec 2022 11:39:12 +0700
> -Subject: [PATCH] Merge pull request from GHSA-9pfh-r8x4-w26w
> -
> -* Fix buffer overread in STUN message decoder
> -
> -* Updates based on comments
> -
> -[Retrieved from:
> -https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1]
> -Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ----
> - pjnath/include/pjnath/stun_msg.h | 4 ++++
> - pjnath/src/pjnath/stun_msg.c | 14 +++++++++++---
> - 2 files changed, 15 insertions(+), 3 deletions(-)
> -
> -diff --git a/pjnath/include/pjnath/stun_msg.h b/pjnath/include/pjnath/stun_msg.h
> -index b52f95c586..e49f096f3a 100644
> ---- a/pjnath/include/pjnath/stun_msg.h
> -+++ b/pjnath/include/pjnath/stun_msg.h
> -@@ -442,6 +442,7 @@ typedef enum pj_stun_status
> -
> - \endverbatim
> - */
> -+#pragma pack(1)
> - typedef struct pj_stun_msg_hdr
> - {
> - /**
> -@@ -473,6 +474,7 @@ typedef struct pj_stun_msg_hdr
> - pj_uint8_t tsx_id[12];
> -
> - } pj_stun_msg_hdr;
> -+#pragma pack()
> -
> -
> - /**
> -@@ -490,6 +492,7 @@ typedef struct pj_stun_msg_hdr
> -
> - \endverbatim
> - */
> -+#pragma pack(1)
> - typedef struct pj_stun_attr_hdr
> - {
> - /**
> -@@ -506,6 +509,7 @@ typedef struct pj_stun_attr_hdr
> - pj_uint16_t length;
> -
> - } pj_stun_attr_hdr;
> -+#pragma pack()
> -
> -
> - /**
> -diff --git a/pjnath/src/pjnath/stun_msg.c b/pjnath/src/pjnath/stun_msg.c
> -index 3def6b3eac..e904a0ba47 100644
> ---- a/pjnath/src/pjnath/stun_msg.c
> -+++ b/pjnath/src/pjnath/stun_msg.c
> -@@ -746,7 +746,7 @@ PJ_DEF(int) pj_stun_set_padding_char(int chr)
> -
> - #define INIT_ATTR(a,t,l) (a)->hdr.type=(pj_uint16_t)(t), \
> - (a)->hdr.length=(pj_uint16_t)(l)
> --#define ATTR_HDR_LEN 4
> -+#define ATTR_HDR_LEN sizeof(pj_stun_attr_hdr)
> -
> - static pj_uint16_t GETVAL16H(const pj_uint8_t *buf, unsigned pos)
> - {
> -@@ -2327,6 +2327,14 @@ PJ_DEF(pj_status_t) pj_stun_msg_decode(pj_pool_t *pool,
> - status = pj_stun_msg_check(pdu, pdu_len, options);
> - if (status != PJ_SUCCESS)
> - return status;
> -+ } else {
> -+ /* For safety, verify packet length at least */
> -+ pj_uint32_t msg_len = GETVAL16H(pdu, 2) + 20;
> -+ if (msg_len > pdu_len ||
> -+ ((options & PJ_STUN_IS_DATAGRAM) && msg_len != pdu_len))
> -+ {
> -+ return PJNATH_EINSTUNMSGLEN;
> -+ }
> - }
> -
> - /* Create the message, copy the header, and convert to host byte order */
> -@@ -2345,7 +2353,7 @@ PJ_DEF(pj_status_t) pj_stun_msg_decode(pj_pool_t *pool,
> - p_response = NULL;
> -
> - /* Parse attributes */
> -- while (pdu_len >= 4) {
> -+ while (pdu_len >= ATTR_HDR_LEN) {
> - unsigned attr_type, attr_val_len;
> - const struct attr_desc *adesc;
> -
> -@@ -2357,7 +2365,7 @@ PJ_DEF(pj_status_t) pj_stun_msg_decode(pj_pool_t *pool,
> - attr_val_len = (attr_val_len + 3) & (~3);
> -
> - /* Check length */
> -- if (pdu_len < attr_val_len) {
> -+ if (pdu_len < attr_val_len + ATTR_HDR_LEN) {
> - pj_str_t err_msg;
> - char err_msg_buf[80];
> -
> diff --git a/package/libpjsip/0002-Merge-pull-request-from-GHSA-cxwq-5g9x-x7fr.patch b/package/libpjsip/0002-Merge-pull-request-from-GHSA-cxwq-5g9x-x7fr.patch
> deleted file mode 100644
> index 82249a2076..0000000000
> --- a/package/libpjsip/0002-Merge-pull-request-from-GHSA-cxwq-5g9x-x7fr.patch
> +++ /dev/null
> @@ -1,54 +0,0 @@
> -From bc4812d31a67d5e2f973fbfaf950d6118226cf36 Mon Sep 17 00:00:00 2001
> -From: sauwming <ming@teluu.com>
> -Date: Fri, 23 Dec 2022 15:05:28 +0800
> -Subject: [PATCH] Merge pull request from GHSA-cxwq-5g9x-x7fr
> -
> -* Fixed heap buffer overflow when parsing STUN errcode attribute
> -
> -* Also fixed uint parsing
> -
> -[Retrieved from:
> -https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36]
> -Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ----
> - pjnath/src/pjnath/stun_msg.c | 11 ++++++-----
> - 1 file changed, 6 insertions(+), 5 deletions(-)
> -
> -diff --git a/pjnath/src/pjnath/stun_msg.c b/pjnath/src/pjnath/stun_msg.c
> -index c6b0bdd284..b55d29849a 100644
> ---- a/pjnath/src/pjnath/stun_msg.c
> -+++ b/pjnath/src/pjnath/stun_msg.c
> -@@ -1438,12 +1438,12 @@ static pj_status_t decode_uint_attr(pj_pool_t *pool,
> - attr = PJ_POOL_ZALLOC_T(pool, pj_stun_uint_attr);
> - GETATTRHDR(buf, &attr->hdr);
> -
> -- attr->value = GETVAL32H(buf, 4);
> --
> - /* Check that the attribute length is valid */
> - if (attr->hdr.length != 4)
> - return PJNATH_ESTUNINATTRLEN;
> -
> -+ attr->value = GETVAL32H(buf, 4);
> -+
> - /* Done */
> - *p_attr = attr;
> -
> -@@ -1757,14 +1757,15 @@ static pj_status_t decode_errcode_attr(pj_pool_t *pool,
> - attr = PJ_POOL_ZALLOC_T(pool, pj_stun_errcode_attr);
> - GETATTRHDR(buf, &attr->hdr);
> -
> -+ /* Check that the attribute length is valid */
> -+ if (attr->hdr.length < 4)
> -+ return PJNATH_ESTUNINATTRLEN;
> -+
> - attr->err_code = buf[6] * 100 + buf[7];
> -
> - /* Get pointer to the string in the message */
> - value.ptr = ((char*)buf + ATTR_HDR_LEN + 4);
> - value.slen = attr->hdr.length - 4;
> -- /* Make sure the length is never negative */
> -- if (value.slen < 0)
> -- value.slen = 0;
> -
> - /* Copy the string to the attribute */
> - pj_strdup(pool, &attr->reason, &value);
> diff --git a/package/libpjsip/libpjsip.hash b/package/libpjsip/libpjsip.hash
> index 9935575567..2edd97bed4 100644
> --- a/package/libpjsip/libpjsip.hash
> +++ b/package/libpjsip/libpjsip.hash
> @@ -1,3 +1,3 @@
> # Locally computed
> -sha256 4178bb9f586299111463fc16ea04e461adca4a73e646f8ddef61ea53dafa92d9 pjproject-2.13.tar.gz
> +sha256 32a5ab5bfbb9752cb6a46627e4c410e61939c8dbbd833ac858473cfbd9fb9d7d pjproject-2.13.1.tar.gz
> sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING
> diff --git a/package/libpjsip/libpjsip.mk b/package/libpjsip/libpjsip.mk
> index 24db641446..f97d547fd7 100644
> --- a/package/libpjsip/libpjsip.mk
> +++ b/package/libpjsip/libpjsip.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -LIBPJSIP_VERSION = 2.13
> +LIBPJSIP_VERSION = 2.13.1
> LIBPJSIP_SOURCE = pjproject-$(LIBPJSIP_VERSION).tar.gz
> LIBPJSIP_SITE = $(call github,pjsip,pjproject,$(LIBPJSIP_VERSION))
>
> @@ -15,12 +15,6 @@ LIBPJSIP_CPE_ID_PRODUCT = pjsip
> LIBPJSIP_INSTALL_STAGING = YES
> LIBPJSIP_MAKE = $(MAKE1)
>
> -# 0001-Merge-pull-request-from-GHSA-9pfh-r8x4-w26w.patch
> -LIBPJSIP_IGNORE_CVES += CVE-2022-23537
> -
> -# 0002-Merge-pull-request-from-GHSA-cxwq-5g9x-x7fr.patch
> -LIBPJSIP_IGNORE_CVES += CVE-2022-23547
> -
> LIBPJSIP_CFLAGS = $(TARGET_CFLAGS) -DPJ_HAS_IPV6=1
>
> # relocation truncated to fit: R_68K_GOT16O
> --
> 2.30.2
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2023-09-24 9:02 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-23 9:24 [Buildroot] [PATCH] package/libpjsip: security bump to version 2.13.1 Peter Korsgaard
2023-09-24 9:02 ` Yann E. MORIN [this message]
2023-09-24 9:54 ` Peter Korsgaard
2023-09-26 8:03 ` Peter Korsgaard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230924090226.GF1469982@scaer \
--to=yann.morin.1998@free.fr \
--cc=buildroot@buildroot.org \
--cc=luca.ceresoli@bootlin.com \
--cc=peter@korsgaard.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.