Date: Mon, 10 Aug 2015 09:01:32 +0200 From: Erwin Lansing <erwin@FreeBSD.org> To: Ryan Steinmetz <zi@FreeBSD.org> Cc: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: Re: svn commit: r393838 - in head/net-mgmt/net-snmp: . files Message-ID: <20150810070132.GC63119@droso.dk> In-Reply-To: <201508100215.t7A2FrMv066401@repo.freebsd.org> References: <201508100215.t7A2FrMv066401@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--sxhug0Teuf3tiWmo Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Aug 10, 2015 at 02:15:53AM +0000, Ryan Steinmetz wrote: > Author: zi > Date: Mon Aug 10 02:15:52 2015 > New Revision: 393838 > URL: https://svnweb.freebsd.org/changeset/ports/393838 >=20 > Log: > - Fix CVE-2015-5621 > - Bump PORTREVISION > =20 > PR: 202099 > Submitted by: serg@tmn.ru MFH as this is a security update? Hereby approved as well. Erwin >=20 > Added: > head/net-mgmt/net-snmp/files/patch-snmplib_snmp__api.c (contents, pro= ps changed) > Modified: > head/net-mgmt/net-snmp/Makefile >=20 > Modified: head/net-mgmt/net-snmp/Makefile > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D > --- head/net-mgmt/net-snmp/Makefile Mon Aug 10 01:51:59 2015 (r393837) > +++ head/net-mgmt/net-snmp/Makefile Mon Aug 10 02:15:52 2015 (r393838) > @@ -3,7 +3,7 @@ > =20 > PORTNAME=3D snmp > PORTVERSION=3D 5.7.3 > -PORTREVISION=3D 7 > +PORTREVISION=3D 8 > CATEGORIES=3D net-mgmt ipv6 > MASTER_SITES=3D SF/net-${PORTNAME}/net-${PORTNAME}/${PORTVERSION} > PKGNAMEPREFIX=3D net- >=20 > Added: head/net-mgmt/net-snmp/files/patch-snmplib_snmp__api.c > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D > --- /dev/null 00:00:00 1970 (empty, because file is newly added) > +++ head/net-mgmt/net-snmp/files/patch-snmplib_snmp__api.c Mon Aug 10 02:= 15:52 2015 (r393838) > @@ -0,0 +1,117 @@ > +--- snmplib/snmp_api.c.orig 2014-12-08 20:23:22 UTC > ++++ snmplib/snmp_api.c > +@@ -4350,10 +4350,9 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char=20 > + u_char type; > + u_char msg_type; > + u_char *var_val; > +- int badtype =3D 0; > + size_t len; > + size_t four; > +- netsnmp_variable_list *vp =3D NULL; > ++ netsnmp_variable_list *vp =3D NULL, *vplast =3D NULL; > + oid objid[MAX_OID_LEN]; > + u_char *p; > +=20 > +@@ -4493,38 +4492,24 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char=20 > + (ASN_SEQUENCE | ASN_CONSTRUCTOR), > + "varbinds"); > + if (data =3D=3D NULL) > +- return -1; > ++ goto fail; > +=20 > + /* > + * get each varBind sequence=20 > + */ > + while ((int) *length > 0) { > +- netsnmp_variable_list *vptemp; > +- vptemp =3D (netsnmp_variable_list *) malloc(sizeof(*vptemp)); > +- if (NULL =3D=3D vptemp) { > +- return -1; > +- } > +- if (NULL =3D=3D vp) { > +- pdu->variables =3D vptemp; > +- } else { > +- vp->next_variable =3D vptemp; > +- } > +- vp =3D vptemp; > ++ vp =3D SNMP_MALLOC_TYPEDEF(netsnmp_variable_list); > ++ if (NULL =3D=3D vp) > ++ goto fail; > +=20 > +- vp->next_variable =3D NULL; > +- vp->val.string =3D NULL; > + vp->name_length =3D MAX_OID_LEN; > +- vp->name =3D NULL; > +- vp->index =3D 0; > +- vp->data =3D NULL; > +- vp->dataFreeHook =3D NULL; > + DEBUGDUMPSECTION("recv", "VarBind"); > + data =3D snmp_parse_var_op(data, objid, &vp->name_length, &vp->= type, > + &vp->val_len, &var_val, length); > + if (data =3D=3D NULL) > +- return -1; > ++ goto fail; > + if (snmp_set_var_objid(vp, objid, vp->name_length)) > +- return -1; > ++ goto fail; > +=20 > + len =3D MAX_PACKET_LENGTH; > + DEBUGDUMPHEADER("recv", "Value"); > +@@ -4604,7 +4589,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char=20 > + vp->val.string =3D (u_char *) malloc(vp->val_len); > + } > + if (vp->val.string =3D=3D NULL) { > +- return -1; > ++ goto fail; > + } > + p =3D asn_parse_string(var_val, &len, &vp->type, vp->val.st= ring, > + &vp->val_len); > +@@ -4619,7 +4604,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char=20 > + vp->val_len *=3D sizeof(oid); > + vp->val.objid =3D (oid *) malloc(vp->val_len); > + if (vp->val.objid =3D=3D NULL) { > +- return -1; > ++ goto fail; > + } > + memmove(vp->val.objid, objid, vp->val_len); > + break; > +@@ -4631,7 +4616,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char=20 > + case ASN_BIT_STR: > + vp->val.bitstring =3D (u_char *) malloc(vp->val_len); > + if (vp->val.bitstring =3D=3D NULL) { > +- return -1; > ++ goto fail; > + } > + p =3D asn_parse_bitstring(var_val, &len, &vp->type, > + vp->val.bitstring, &vp->val_len); > +@@ -4640,12 +4625,28 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char=20 > + break; > + default: > + snmp_log(LOG_ERR, "bad type returned (%x)\n", vp->type); > +- badtype =3D -1; > ++ goto fail; > + break; > + } > + DEBUGINDENTADD(-4); > ++ > ++ if (NULL =3D=3D vplast) { > ++ pdu->variables =3D vp; > ++ } else { > ++ vplast->next_variable =3D vp; > ++ } > ++ vplast =3D vp; > ++ vp =3D NULL; > + } > +- return badtype; > ++ return 0; > ++ > ++ fail: > ++ DEBUGMSGTL(("recv", "error while parsing VarBindList\n")); > ++ /** if we were parsing a var, remove it from the pdu and free it */ > ++ if (vp) > ++ snmp_free_var(vp); > ++ > ++ return -1; > + } > +=20 > + /* >=20 --=20 Erwin Lansing http://droso.dk erwin@FreeBSD.org http:// www.FreeBSD.org --sxhug0Teuf3tiWmo Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEVAwUBVchMS1F75hSlwe7HAQosigf/bsvzIwwyvnEGNDOE16GRswevM5/4N3/n Oh3fT8vM/yc7XY/JG2wCnyMYWfNE4zHLMkOeboDqPBq1QWTWX19xbIONv+/wTqF2 4Y8r4IqncUnpJXXZo/C3zTOKkktBk4gKA89wmhahVHKPZkhWWwiH3xrYf3JAQ+VB 83fPNCQuQNo4PKHzK2MWbZsa+fahPE8Y7moBpPjQnMhCUBiBscsSyS4g7/c28gAG LBFqQXDgtbyaqJp36QdfKE3COhChAuKG7LjUe4GpCfEkTdwPvpR5rGjm3+osQNCR UWVKjd8LbebiziCgRnnYkWGjRrl7d3WCEXAQIY+bAt8+IaqS7pLZkw== =ZAVm -----END PGP SIGNATURE----- --sxhug0Teuf3tiWmo--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150810070132.GC63119>