diff options
| author |   Changqing Li <changqing.li@windriver.com> | 2020-02-27 11:38:54 +0800 |
|---|---|---|
| committer |   Khem Raj <raj.khem@gmail.com> | 2020-02-27 08:25:49 -0800 |
| commit | 62b3a48219ef1ea9ff62dd8e6d78d81c4325a7fb (patch) | |
| tree | 1566184f4d80c1a5a5b7088a5c3838e220d51fc4 /meta-networking | |
| parent | ed7936674bfd7c830328e5b975897df393f77a39 (diff) | |
| download | meta-openembedded-62b3a48219ef1ea9ff62dd8e6d78d81c4325a7fb.tar.gz | |
cyrus-sasl: fix CVE-2019-19906
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Diffstat (limited to 'meta-networking')
| -rw-r--r-- | meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl/CVE-2019-19906.patch | 35 | ||||
| -rw-r--r-- | meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl_2.1.27.bb | 1 |
2 files changed, 36 insertions, 0 deletions
diff --git a/meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl/CVE-2019-19906.patch b/meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl/CVE-2019-19906.patch new file mode 100644 index 0000000000..b94780f302 --- /dev/null +++ b/meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl/CVE-2019-19906.patch @@ -0,0 +1,35 @@ +From 94fe6eb9ea2691f4a7c32fbf2d0c7c454995b666 Mon Sep 17 00:00:00 2001 +From: Changqing Li <changqing.li@windriver.com> +Date: Thu, 27 Feb 2020 11:08:57 +0800 +Subject: [PATCH] Fix #587 + +Off by one error in common.c, CVE-2019-19906. + +Thanks to Stephan Zeisberg for reporting + +CVE: CVE-2019-19906 + +Upstream-Stauts: Backport [https://github.com/cyrusimap/cyrus-sasl +/commit/dcc9f51cbd4ed622cfb0f9b1c141eb2ffe3b12f1] + +Signed-off-by: Changqing Li <changqing.li@windriver.com> +--- + lib/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/common.c b/lib/common.c +index 305311d..445c5d5 100644 +--- a/lib/common.c ++++ b/lib/common.c +@@ -190,7 +190,7 @@ int _sasl_add_string(char **out, size_t *alloclen, + + if (add==NULL) add = "(null)"; + +- addlen=strlen(add); /* only compute once */ ++ addlen=strlen(add)+1; /* only compute once */ + if (_buf_alloc(out, alloclen, (*outlen)+addlen)!=SASL_OK) + return SASL_NOMEM; + +-- +2.7.4 + diff --git a/meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl_2.1.27.bb b/meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl_2.1.27.bb index be7131d7d0..d55dc4ab7e 100644 --- a/meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl_2.1.27.bb +++ b/meta-networking/recipes-daemons/cyrus-sasl/cyrus-sasl_2.1.27.bb @@ -16,6 +16,7 @@ SRC_URI = "git://github.com/cyrusimap/cyrus-sasl;protocol=https \ file://0004-configure.ac-fix-condition-for-suppliment-snprintf-i.patch \ file://0001-Allow-saslauthd-to-be-built-outside-of-source-tree-w.patch \ file://0001-makeinit.sh-fix-parallel-build-issue.patch \ + file://CVE-2019-19906.patch \ " UPSTREAM_CHECK_URI = "https://github.com/cyrusimap/cyrus-sasl/archives" |