svn commit: r392466 - in branches/2015Q3/security/wpa_supplicant: . files
Mark Felder
feld at FreeBSD.org
Sat Jul 18 21:47:57 UTC 2015
Author: feld
Date: Sat Jul 18 21:47:55 2015
New Revision: 392466
URL: https://svnweb.freebsd.org/changeset/ports/392466
Log:
MFH: r391779
security/wpa_supplicant: Address security issue (2015-5)
There was a vulnerability to the WPS_NFC option which is off by default.
The port is being bumped anyway since people using that option will want
the latest version.
PR: 201432
Submitted by: Jason Unovitch
Approved by: ports-secteam (with hat)
Added:
branches/2015Q3/security/wpa_supplicant/files/patch-src_wps_ndef.c
- copied unchanged from r391779, head/security/wpa_supplicant/files/patch-src_wps_ndef.c
Modified:
branches/2015Q3/security/wpa_supplicant/Makefile
Directory Properties:
branches/2015Q3/ (props changed)
Modified: branches/2015Q3/security/wpa_supplicant/Makefile
==============================================================================
--- branches/2015Q3/security/wpa_supplicant/Makefile Sat Jul 18 21:39:49 2015 (r392465)
+++ branches/2015Q3/security/wpa_supplicant/Makefile Sat Jul 18 21:47:55 2015 (r392466)
@@ -2,7 +2,7 @@
PORTNAME= wpa_supplicant
PORTVERSION= 2.4
-PORTREVISION= 3
+PORTREVISION= 4
CATEGORIES= security net
MASTER_SITES= http://w1.fi/releases/
Copied: branches/2015Q3/security/wpa_supplicant/files/patch-src_wps_ndef.c (from r391779, head/security/wpa_supplicant/files/patch-src_wps_ndef.c)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ branches/2015Q3/security/wpa_supplicant/files/patch-src_wps_ndef.c Sat Jul 18 21:47:55 2015 (r392466, copy of r391779, head/security/wpa_supplicant/files/patch-src_wps_ndef.c)
@@ -0,0 +1,21 @@
+--- src/wps/ndef.c.orig 2015-03-15 17:30:39 UTC
++++ src/wps/ndef.c
+@@ -48,6 +48,8 @@ static int ndef_parse_record(const u8 *d
+ if (size < 6)
+ return -1;
+ record->payload_length = ntohl(*(u32 *)pos);
++ if (record->payload_length > size - 6)
++ return -1;
+ pos += sizeof(u32);
+ }
+
+@@ -68,7 +70,8 @@ static int ndef_parse_record(const u8 *d
+ pos += record->payload_length;
+
+ record->total_length = pos - data;
+- if (record->total_length > size)
++ if (record->total_length > size ||
++ record->total_length < record->payload_length)
+ return -1;
+ return 0;
+ }
More information about the svn-ports-branches
mailing list