From f701b545c3da595238999261d0dde1782eac51c0 Mon Sep 17 00:00:00 2001 From: guibuilder_pel7x64builder0 Date: Thu, 26 Dec 2019 18:49:11 +0100 Subject: [PATCH] openslp package update Signed-off-by: guibuilder_pel7x64builder0 --- SOURCES/openslp-2.0.0-cve-2017-17833.patch | 19 ++ ...2.0.0-fortify-source-buffer-overflow.patch | 53 +++++ SOURCES/openslp-2.0.0-multicast-set.patch | 134 ++++++++++++ SOURCES/slpd.8.gz | Bin 0 -> 428 bytes SOURCES/slpd.service | 11 + SOURCES/slptool.1.gz | Bin 0 -> 577 bytes SPECS/openslp.spec | 200 ++++++++++++++++++ 7 files changed, 417 insertions(+) create mode 100644 SOURCES/openslp-2.0.0-cve-2017-17833.patch create mode 100644 SOURCES/openslp-2.0.0-fortify-source-buffer-overflow.patch create mode 100644 SOURCES/openslp-2.0.0-multicast-set.patch create mode 100644 SOURCES/slpd.8.gz create mode 100644 SOURCES/slpd.service create mode 100644 SOURCES/slptool.1.gz create mode 100644 SPECS/openslp.spec diff --git a/SOURCES/openslp-2.0.0-cve-2017-17833.patch b/SOURCES/openslp-2.0.0-cve-2017-17833.patch new file mode 100644 index 0000000..eefce40 --- /dev/null +++ b/SOURCES/openslp-2.0.0-cve-2017-17833.patch @@ -0,0 +1,19 @@ +diff -up openslp-2.0.0/slpd/slpd_process.c.orig openslp-2.0.0/slpd/slpd_process.c +--- openslp-2.0.0/slpd/slpd_process.c.orig 2018-05-09 13:08:06.185104375 +0200 ++++ openslp-2.0.0/slpd/slpd_process.c 2018-05-09 13:07:21.017095089 +0200 +@@ -462,6 +462,15 @@ static int ProcessSrvRqst(SLPMessage * m + message->body.srvrqst.srvtype, 23, SLP_DA_SERVICE_TYPE) == 0) + { + errorcode = ProcessDASrvRqst(message, sendbuf, errorcode); ++ ++ if (result != *sendbuf) ++ { ++ // The pointer stored at *sendbuf can be modified by a realloc ++ // operation in ProcessDASrvRqst(). Fix up the local copy of ++ // that pointer if necessary. ++ result = *sendbuf; ++ } ++ + if (errorcode == 0) + { + /* Since we have an errorcode of 0, we were successful, diff --git a/SOURCES/openslp-2.0.0-fortify-source-buffer-overflow.patch b/SOURCES/openslp-2.0.0-fortify-source-buffer-overflow.patch new file mode 100644 index 0000000..0048606 --- /dev/null +++ b/SOURCES/openslp-2.0.0-fortify-source-buffer-overflow.patch @@ -0,0 +1,53 @@ +diff -up openslp-2.0.0/slpd/slpd_predicate.c.orig openslp-2.0.0/slpd/slpd_predicate.c +--- openslp-2.0.0/slpd/slpd_predicate.c.orig 2012-12-11 00:31:53.000000000 +0100 ++++ openslp-2.0.0/slpd/slpd_predicate.c 2015-01-14 13:17:45.115104003 +0100 +@@ -1425,6 +1425,8 @@ void freePredicateParseTree(SLPDPredicat + break; + } + pNextNode = pNode->next; ++ xfree(pNode->nodeBody.comparison.tag_str); ++ xfree(pNode->nodeBody.comparison.value_str); + xfree(pNode); + pNode = pNextNode; + } +@@ -1643,26 +1645,28 @@ SLPDPredicateParseResult createPredicate + rhs = val_start; + + /***** Create leaf node. *****/ +- *ppNode = (SLPDPredicateTreeNode *)xmalloc(sizeof (SLPDPredicateTreeNode) + lhs_len + rhs_len); ++ *ppNode = (SLPDPredicateTreeNode *)xmalloc(sizeof (SLPDPredicateTreeNode)); + if (!(*ppNode)) + return PREDICATE_PARSE_INTERNAL_ERROR; + ++ (*ppNode)->nodeBody.comparison.tag_str = (char *)xmalloc((lhs_len+1) * sizeof(char)); ++ if (!((*ppNode)->nodeBody.comparison.tag_str)) ++ return PREDICATE_PARSE_INTERNAL_ERROR; ++ ++ (*ppNode)->nodeBody.comparison.value_str = (char *)xmalloc((rhs_len+1) * sizeof(char)); ++ if (!((*ppNode)->nodeBody.comparison.value_str)) ++ return PREDICATE_PARSE_INTERNAL_ERROR; ++ + (*ppNode)->nodeType = op; + (*ppNode)->next = (SLPDPredicateTreeNode *)0; + +- /* Finished with "operator" now - just use as temporary pointer to assist with copying the +- * attribute name (lhs) and required value (rhs) into the node +- */ +- operator = (*ppNode)->nodeBody.comparison.storage; +- strncpy(operator, lhs, lhs_len); +- operator[lhs_len] = '\0'; + (*ppNode)->nodeBody.comparison.tag_len = lhs_len; +- (*ppNode)->nodeBody.comparison.tag_str = operator; +- operator += lhs_len + 1; +- strncpy(operator, rhs, rhs_len); +- operator[rhs_len] = '\0'; ++ strncpy((*ppNode)->nodeBody.comparison.tag_str, lhs, lhs_len); ++ (*ppNode)->nodeBody.comparison.tag_str[lhs_len] = '\0'; ++ + (*ppNode)->nodeBody.comparison.value_len = rhs_len; +- (*ppNode)->nodeBody.comparison.value_str = operator; ++ strncpy((*ppNode)->nodeBody.comparison.value_str, rhs, rhs_len); ++ (*ppNode)->nodeBody.comparison.value_str[rhs_len] = '\0'; + + return PREDICATE_PARSE_OK; + } diff --git a/SOURCES/openslp-2.0.0-multicast-set.patch b/SOURCES/openslp-2.0.0-multicast-set.patch new file mode 100644 index 0000000..bb4c945 --- /dev/null +++ b/SOURCES/openslp-2.0.0-multicast-set.patch @@ -0,0 +1,134 @@ +diff -up openslp-2.0.0/etc/slpd.all_init.orig openslp-2.0.0/etc/slpd.all_init +--- openslp-2.0.0/etc/slpd.all_init.orig 2012-11-28 18:07:04.000000000 +0100 ++++ openslp-2.0.0/etc/slpd.all_init 2013-06-24 13:27:34.375575496 +0200 +@@ -1,28 +1,5 @@ + #!/bin/bash +-# +-# /etc/rc.d/init.d/slpd +-# +-# slpd Start/Stop the OpenSLP SA daemon (slpd). +-# +-# chkconfig: 345 13 87 +-# description: OpenSLP daemon for the Service Location Protocol +-# processname: slpd +- +-# Author: Miquel van Smoorenburg, +-# Modified for RHS Linux by Damien Neil +-# Modified for COL by Raymund Will, +-# Modified for OpenSLP by Matt Peterson +-# Modified to be distribution agnostic by Bart Whiteley +- +-#//////////////////////////////////////////////////# +-# Does nothing if a route exists that supports # +-# multicast traffic. If no routes supporting # +-# multicast traffic exists, the function tries to # +-# add one. A 0 is returned on success and a 1 # +-# on failure. One parameter must be passed in. # +-# This variable determins verbosity. If parameter # +-# is non-zero debugging will appear # +-#//////////////////////////////////////////////////# ++ + multicast_route_set() + { + PING_OPTIONS_1='-c1 -w1' +@@ -91,94 +68,11 @@ multicast_route_set() + return $retval + } + +-NAME=slpd +-DAEMON=/usr/sbin/$NAME +-SUSE=0 +- +-# Change to root +-OLDDIR=`pwd` +-cd / +- +-# Source function library. +-if [ -f /etc/rc.d/init.d/functions ]; then +- . /etc/rc.d/init.d/functions +-else +- SUSE=1 +-fi +- +-test -x $DAEMON || exit 0 +- +-if [ ! "$SVIlock" = "" ]; then +- unset LOCK +-else +- LOCK=/var/lock/subsys/slpd ++multicast_route_set 1 ++multicast_enabled=$? ++if [ "$multicast_enabled" != "0" ] ; then ++ echo "Failure: No Route Available for Multicast Traffic" ++ exit 1 + fi + +-RETVAL=0 +- +-# +-# See how we were called. +-# +-case "$1" in +- start) +- # Check if atd is already running +- # RH style +- if [ $SUSE -eq 0 ] && [ ! "$LOCK" = "" ] && [ -f $LOCK ]; then +- exit 0 +- fi +- # Caldera Style +- if [ ! "$SVIlock" = "" ] && [ -f $SVIlock ]; then +- exit 0 +- fi +- echo -n 'Starting slpd: ' +- +- multicast_route_set 1 +- multicast_enabled=$? +- if [ "$multicast_enabled" != "0" ] ; then +- echo "Failure: No Route Available for Multicast Traffic" +- exit 1 +- fi +- if [ $SUSE -eq 0 ]; then +- if [ -x /sbin/ssd ]; then +- ssd -S -n $NAME -x $DAEMON -- $OPTIONS +- [ ! "$SVIlock" = "" ] && touch $SVIlock +- else +- daemon $DAEMON +- RETVAL=$? +- fi +- else +- startproc $DAEMON $OPTIONS +- fi +- [ $SUSE -eq 0 ] && [ ! "$LOCK" = "" ] && [ $RETVAL -eq 0 ] && touch $LOCK +- echo +- ;; +- stop) +- echo -n 'Stopping slpd: ' +- +- if [ -x /sbin/ssd ]; then +- ssd -K -p /var/run/$NAME.pid -n $NAME +- [ ! "$SVIlock" = "" ] && rm -f $SVIlock +- else +- killproc $DAEMON +- RETVAL=$? +- fi +- [ ! "$LOCK" = "" ] && [ $RETVAL -eq 0 ] && rm -f $LOCK +- echo +- ;; +- reload|restart) +- cd $OLDDIR +- $0 stop +- $0 start +- cd / +- RETVAL=$? +- ;; +- status) +- status /usr/sbin/slpd +- RETVAL=$? +- ;; +- *) +- echo "Usage: /etc/rc.d/init.d/slpd {start|stop|restart|reload|status}" +- exit 1 +-esac +- +-exit $RETVAL ++exit 0 diff --git a/SOURCES/slpd.8.gz b/SOURCES/slpd.8.gz new file mode 100644 index 0000000000000000000000000000000000000000..f87cc30d019d80101dba3cdde089ab437d649e54 GIT binary patch literal 428 zcmV;d0aN}TiwFql?2u6a19NO}WG*-Wjgmia!Y~lU_k4;IOBXPdE?q%X0;&8FfuSl4 zCU%G=$Byg+#JBI+q?EuwheYx7-MgP(%vNJaKNllty|qA3^HqSwa=B7QP806-^ziL`|HT7?7>&+x~ia3;<`G*Q94i6+cv-LV#kEFO!iqF9?DTnH7*bTLKm`@Sw9=E3*g0GrQ@^HgJOr!DHfkfVT$8~ZFWhjPHde8ULKO;GE*QNSEBUos>r@8-a4XpdkXMA;T9;qX1 zbUy|Cjf|Qe80%ZpK&!P!qQYu%(IQ*rY(`mu690+H9n2*vvTtAol20{{SxyUrf~ literal 0 HcmV?d00001 diff --git a/SOURCES/slpd.service b/SOURCES/slpd.service new file mode 100644 index 0000000..1ac7fec --- /dev/null +++ b/SOURCES/slpd.service @@ -0,0 +1,11 @@ +[Unit] +Description=OpenSLP daemon for the Service Location Protocol +After=network.target + +[Service] +Type=forking +ExecStart=/usr/sbin/slpd +ExecStartPre=/usr/lib/openslp-server/slp-multicast-set.sh + +[Install] +WantedBy=multi-user.target diff --git a/SOURCES/slptool.1.gz b/SOURCES/slptool.1.gz new file mode 100644 index 0000000000000000000000000000000000000000..15c823d6f75074037345dc7e74d6e10189b86ab4 GIT binary patch literal 577 zcmV-H0>1qpiwFoM<&aST19NO}bZ>8LE-?V5lTDA>Fc60C`4yv_7HRR4(3TddhusPZ zBp^{krB;N42~M!&e8_fa^Y3e$goFsSlpa7H&%BR4<2PtChhXV%JZ}lMV}rfI6}Tg3 ztd@cmGS3;fXoU7eVpr{b6NJN;JWX+S5VnPaIjmn-Gpnf$hZ+abxdIr?2LB7KF^()+Pvt=fB1V?OUrFeO^qJ z5&21gGUka!L`|V82yA1@6mNH_!BTPoC1I1l7YRG|fQ)Vk6vfxU|Wd+S5!znQ)o_&8^`O8^w>7w!81ygr3O)I@ZzosuQX?4tn zL~1Z#Kk37r&nL{B!Ltcm9k>Jg3fCXb1$ST7^*Pt*) - 1:2.0.0-7 +- Fix possible heap memory corruption, CVE-2017-17833 + Resolves: #1575698 + +* Tue Jun 28 2016 Vitezslav Crhonek - 1:2.0.0-6 +- Fix buffer overflow termination of slpd with -D_FORTIFY_SOURCE=2 + Resolves: #1181474 + +* Fri Jan 24 2014 Daniel Mach - 1:2.0.0-5 +- Mass rebuild 2014-01-24 + +* Fri Dec 27 2013 Daniel Mach - 1:2.0.0-4 +- Mass rebuild 2013-12-27 + +* Wed Oct 16 2013 Vitezslav Crhonek - 1:2.0.0-3 +- Fix full relro + Resolves: #881226 + +* Mon Jul 15 2013 Vitezslav Crhonek - 1:2.0.0-2 +- Fix -devel requires + +* Tue Jun 25 2013 Vitezslav Crhonek - 1:2.0.0-1 +- Update to openslp-2.0.0 +- Add systemd support +- Require /bin/netstat + +* Wed May 15 2013 Vitezslav Crhonek - 2.0-0.3.beta2 +- Add man pages for slptool and slpd +- Add CFLAGS and LDFLAGS for full relro + +* Thu Jul 28 2011 Vitezslav Crhonek - 2.0-0.2.beta2 +- Build with -fno-strict-aliasing + +* Wed Jul 20 2011 Vitezslav Crhonek - 2.0-0.1.beta2 +- Fix N-V-R + +* Wed Jul 20 2011 Vitezslav Crhonek - 2.0.beta2-2 +- Build + +* Tue Jul 19 2011 Vitezslav Crhonek - 2.0.beta2-1 +- Initial support