diff --git a/CVE-2023-38403.patch b/CVE-2023-38403.patch deleted file mode 100644 index 8665a4d..0000000 --- a/CVE-2023-38403.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 0ef151550d96cc4460f98832df84b4a1e87c65e9 Mon Sep 17 00:00:00 2001 -From: "Bruce A. Mah" -Date: Fri, 7 Jul 2023 11:35:02 -0700 -Subject: [PATCH] Fix memory allocation hazard (#1542). (#1543) - -Reported by: @someusername123 on GitHub ---- - src/iperf_api.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/src/iperf_api.c b/src/iperf_api.c -index f2d416214..a95e02418 100644 ---- a/src/iperf_api.c -+++ b/src/iperf_api.c -@@ -2670,6 +2670,7 @@ static cJSON * - JSON_read(int fd) - { - uint32_t hsize, nsize; -+ size_t strsize; - char *str; - cJSON *json = NULL; - int rc; -@@ -2682,7 +2683,9 @@ JSON_read(int fd) - if (Nread(fd, (char*) &nsize, sizeof(nsize), Ptcp) >= 0) { - hsize = ntohl(nsize); - /* Allocate a buffer to hold the JSON */ -- str = (char *) calloc(sizeof(char), hsize+1); /* +1 for trailing null */ -+ strsize = hsize + 1; /* +1 for trailing NULL */ -+ if (strsize) { -+ str = (char *) calloc(sizeof(char), strsize); - if (str != NULL) { - rc = Nread(fd, str, hsize, Ptcp); - if (rc >= 0) { -@@ -2701,6 +2704,10 @@ JSON_read(int fd) - } - } - free(str); -+ } -+ else { -+ printf("WARNING: Data length overflow\n"); -+ } - } - return json; - } diff --git a/iperf-3.13.tar.gz b/iperf-3.13.tar.gz deleted file mode 100644 index cc56d16..0000000 Binary files a/iperf-3.13.tar.gz and /dev/null differ diff --git a/iperf-3.16.tar.gz b/iperf-3.16.tar.gz new file mode 100644 index 0000000..3320ee9 Binary files /dev/null and b/iperf-3.16.tar.gz differ diff --git a/iperf3.spec b/iperf3.spec index a044d10..7cfdcb8 100644 --- a/iperf3.spec +++ b/iperf3.spec @@ -1,11 +1,10 @@ Name: iperf3 -Version: 3.13 -Release: 2 +Version: 3.16 +Release: 1 Summary: TCP,UDP,and SCTP network bandwidth measurement tool License: BSD URL: http://github.com/esnet/iperf Source0: https://github.com/esnet/iperf/archive/%{version}/iperf-%{version}.tar.gz -Patch0: CVE-2023-38403.patch BuildRequires: libuuid-devel gcc @@ -54,6 +53,9 @@ mkdir -p %{buildroot}%{_mandir}/man1 %{_mandir}/man3/libiperf.3.gz %changelog +* Sun Jan 14 2024 menmazqj - 3.16-1 +- Update to 3.16 + * Mon Aug 07 2023 yaoxin - 3.13-2 - Fix CVE-2023-38403