!106 update to 3.6.11 to fix CVE-2022-4344 and CVE-2022-4345 and CVE-2023-0413 and CVE-2023-0417 and CVE-2023-0415 and CVE-2023-0411 and CVE-2023-0412 and CVE-2023-0416 and CVE-2022-3724
From: @zxccxz Reviewed-by: @small_leek Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot
Gitee
commit
d9a642391c
@ -1,143 +0,0 @@
|
|||||||
From 0f27a83c5692b2afebe6e6934c1051f76aa2ecf9 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Jason Cohen <kryojenik2@gmail.com>
|
|
||||||
Date: Wed, 31 Aug 2022 11:10:17 -0500
|
|
||||||
Subject: [PATCH] f5ethtrailer: Improve "old-style" heuristic
|
|
||||||
|
|
||||||
Remove a chance for an infinate loop in the disection heuristic.
|
|
||||||
---
|
|
||||||
epan/dissectors/packet-f5ethtrailer.c | 108 +++++++++++++-------------
|
|
||||||
1 file changed, 56 insertions(+), 52 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/epan/dissectors/packet-f5ethtrailer.c b/epan/dissectors/packet-f5ethtrailer.c
|
|
||||||
index b2ba8f899d..915348ea83 100644
|
|
||||||
--- a/epan/dissectors/packet-f5ethtrailer.c
|
|
||||||
+++ b/epan/dissectors/packet-f5ethtrailer.c
|
|
||||||
@@ -2751,69 +2751,73 @@ dissect_dpt_trailer(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *d
|
|
||||||
static gint
|
|
||||||
dissect_old_trailer(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
|
|
||||||
{
|
|
||||||
- proto_tree *type_tree = NULL;
|
|
||||||
- proto_item *ti = NULL;
|
|
||||||
guint offset = 0;
|
|
||||||
- guint processed = 0;
|
|
||||||
- f5eth_tap_data_t *tdata = (f5eth_tap_data_t *)data;
|
|
||||||
- guint8 type;
|
|
||||||
- guint8 len;
|
|
||||||
- guint8 ver;
|
|
||||||
|
|
||||||
/* While we still have data in the trailer. For old format trailers, this needs
|
|
||||||
* type, length, version (3 bytes) and for new format trailers, the magic header (4 bytes).
|
|
||||||
* All old format trailers are at least 4 bytes long, so just check for length of magic.
|
|
||||||
*/
|
|
||||||
- while (tvb_reported_length_remaining(tvb, offset)) {
|
|
||||||
- type = tvb_get_guint8(tvb, offset);
|
|
||||||
- len = tvb_get_guint8(tvb, offset + F5_OFF_LENGTH) + F5_OFF_VERSION;
|
|
||||||
- ver = tvb_get_guint8(tvb, offset + F5_OFF_VERSION);
|
|
||||||
-
|
|
||||||
- if (len <= tvb_reported_length_remaining(tvb, offset) && type >= F5TYPE_LOW
|
|
||||||
- && type <= F5TYPE_HIGH && len >= F5_MIN_SANE && len <= F5_MAX_SANE
|
|
||||||
- && ver <= F5TRAILER_VER_MAX) {
|
|
||||||
- /* Parse out the specified trailer. */
|
|
||||||
- switch (type) {
|
|
||||||
- case F5TYPE_LOW:
|
|
||||||
- ti = proto_tree_add_item(tree, hf_low_id, tvb, offset, len, ENC_NA);
|
|
||||||
- type_tree = proto_item_add_subtree(ti, ett_f5ethtrailer_low);
|
|
||||||
-
|
|
||||||
- processed = dissect_low_trailer(tvb, pinfo, type_tree, offset, len, ver, tdata);
|
|
||||||
- if (processed > 0) {
|
|
||||||
- tdata->trailer_len += processed;
|
|
||||||
- tdata->noise_low = 1;
|
|
||||||
- }
|
|
||||||
- break;
|
|
||||||
- case F5TYPE_MED:
|
|
||||||
- ti = proto_tree_add_item(tree, hf_med_id, tvb, offset, len, ENC_NA);
|
|
||||||
- type_tree = proto_item_add_subtree(ti, ett_f5ethtrailer_med);
|
|
||||||
-
|
|
||||||
- processed = dissect_med_trailer(tvb, pinfo, type_tree, offset, len, ver, tdata);
|
|
||||||
- if (processed > 0) {
|
|
||||||
- tdata->trailer_len += processed;
|
|
||||||
- tdata->noise_med = 1;
|
|
||||||
- }
|
|
||||||
- break;
|
|
||||||
- case F5TYPE_HIGH:
|
|
||||||
- ti = proto_tree_add_item(tree, hf_high_id, tvb, offset, len, ENC_NA);
|
|
||||||
- type_tree = proto_item_add_subtree(ti, ett_f5ethtrailer_high);
|
|
||||||
-
|
|
||||||
- processed =
|
|
||||||
- dissect_high_trailer(tvb, pinfo, type_tree, offset, len, ver, tdata);
|
|
||||||
- if (processed > 0) {
|
|
||||||
- tdata->trailer_len += processed;
|
|
||||||
- tdata->noise_high = 1;
|
|
||||||
- }
|
|
||||||
- break;
|
|
||||||
+ while (tvb_reported_length_remaining(tvb, offset) >= F5_MIN_SANE) {
|
|
||||||
+ /* length field does not include the type and length bytes. Add them back in */
|
|
||||||
+ guint8 len = tvb_get_guint8(tvb, offset + F5_OFF_LENGTH) + F5_OFF_VERSION;
|
|
||||||
+ if (len > tvb_reported_length_remaining(tvb, offset)
|
|
||||||
+ || len < F5_MIN_SANE || len > F5_MAX_SANE) {
|
|
||||||
+ /* Invalid length - either a malformed trailer, corrupt packet, or not f5ethtrailer */
|
|
||||||
+ return offset;
|
|
||||||
+ }
|
|
||||||
+ guint8 type = tvb_get_guint8(tvb, offset);
|
|
||||||
+ guint8 ver = tvb_get_guint8(tvb, offset + F5_OFF_VERSION);
|
|
||||||
+
|
|
||||||
+ /* Parse out the specified trailer. */
|
|
||||||
+ proto_tree *type_tree = NULL;
|
|
||||||
+ proto_item *ti = NULL;
|
|
||||||
+ f5eth_tap_data_t *tdata = (f5eth_tap_data_t *)data;
|
|
||||||
+ guint processed = 0;
|
|
||||||
+
|
|
||||||
+ switch (type) {
|
|
||||||
+ case F5TYPE_LOW:
|
|
||||||
+ ti = proto_tree_add_item(tree, hf_low_id, tvb, offset, len, ENC_NA);
|
|
||||||
+ type_tree = proto_item_add_subtree(ti, ett_f5ethtrailer_low);
|
|
||||||
+
|
|
||||||
+ processed = dissect_low_trailer(tvb, pinfo, type_tree, offset, len, ver, tdata);
|
|
||||||
+ if (processed > 0) {
|
|
||||||
+ tdata->trailer_len += processed;
|
|
||||||
+ tdata->noise_low = 1;
|
|
||||||
}
|
|
||||||
- if (processed == 0) {
|
|
||||||
- proto_item_set_len(ti, 1);
|
|
||||||
- return offset;
|
|
||||||
+ break;
|
|
||||||
+ case F5TYPE_MED:
|
|
||||||
+ ti = proto_tree_add_item(tree, hf_med_id, tvb, offset, len, ENC_NA);
|
|
||||||
+ type_tree = proto_item_add_subtree(ti, ett_f5ethtrailer_med);
|
|
||||||
+
|
|
||||||
+ processed = dissect_med_trailer(tvb, pinfo, type_tree, offset, len, ver, tdata);
|
|
||||||
+ if (processed > 0) {
|
|
||||||
+ tdata->trailer_len += processed;
|
|
||||||
+ tdata->noise_med = 1;
|
|
||||||
+ }
|
|
||||||
+ break;
|
|
||||||
+ case F5TYPE_HIGH:
|
|
||||||
+ ti = proto_tree_add_item(tree, hf_high_id, tvb, offset, len, ENC_NA);
|
|
||||||
+ type_tree = proto_item_add_subtree(ti, ett_f5ethtrailer_high);
|
|
||||||
+
|
|
||||||
+ processed =
|
|
||||||
+ dissect_high_trailer(tvb, pinfo, type_tree, offset, len, ver, tdata);
|
|
||||||
+ if (processed > 0) {
|
|
||||||
+ tdata->trailer_len += processed;
|
|
||||||
+ tdata->noise_high = 1;
|
|
||||||
}
|
|
||||||
+ break;
|
|
||||||
+ default:
|
|
||||||
+ /* Unknown type - malformed trailer, corrupt packet, or not f5ethtrailer - bali out*/
|
|
||||||
+ return offset;
|
|
||||||
+ }
|
|
||||||
+ if (processed == 0) {
|
|
||||||
+ /* couldn't process trailer - bali out */
|
|
||||||
+ proto_item_set_len(ti, 1);
|
|
||||||
+ return offset;
|
|
||||||
}
|
|
||||||
offset += processed;
|
|
||||||
}
|
|
||||||
-return offset;
|
|
||||||
+ return offset;
|
|
||||||
} /* dissect_old_trailer() */
|
|
||||||
|
|
||||||
/*---------------------------------------------------------------------------*/
|
|
||||||
--
|
|
||||||
GitLab
|
|
||||||
|
|
||||||
@ -1,32 +0,0 @@
|
|||||||
From 5db46d3a7c0f6481361a4a007de125ab92bfb674 Mon Sep 17 00:00:00 2001
|
|
||||||
From: John Thacker <johnthacker@gmail.com>
|
|
||||||
Date: Mon, 26 Sep 2022 19:55:59 -0400
|
|
||||||
Subject: [PATCH] opus: Don't overflow a signed 16-bit integer
|
|
||||||
|
|
||||||
The internal sample rate of 48KHz overflows a signed 16-bit
|
|
||||||
integer, and causes incorrect calculations. Use an unsigned integer.
|
|
||||||
|
|
||||||
Fix #18378
|
|
||||||
|
|
||||||
|
|
||||||
(cherry picked from commit 749a8d091200b43175268689996471b59fa34266)
|
|
||||||
---
|
|
||||||
epan/dissectors/packet-opus.c | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/epan/dissectors/packet-opus.c b/epan/dissectors/packet-opus.c
|
|
||||||
index 9451fed0a1..54a83a007e 100644
|
|
||||||
--- a/epan/dissectors/packet-opus.c
|
|
||||||
+++ b/epan/dissectors/packet-opus.c
|
|
||||||
@@ -128,7 +128,7 @@ parse_size_field(const unsigned char *ch, int32_t cn, int16_t *size)
|
|
||||||
}
|
|
||||||
|
|
||||||
static int16_t
|
|
||||||
-opus_packet_get_samples_per_frame(const unsigned char *data, int16_t Fs)
|
|
||||||
+opus_packet_get_samples_per_frame(const unsigned char *data, uint16_t Fs)
|
|
||||||
{
|
|
||||||
int audiosize;
|
|
||||||
if (data[0] & 0x80) {
|
|
||||||
--
|
|
||||||
GitLab
|
|
||||||
|
|
||||||
BIN
SIGNATURES-3.6.11.txt
Normal file
BIN
SIGNATURES-3.6.11.txt
Normal file
Binary file not shown.
Binary file not shown.
Binary file not shown.
@ -4,8 +4,8 @@
|
|||||||
|
|
||||||
Summary: Network traffic analyzer
|
Summary: Network traffic analyzer
|
||||||
Name: wireshark
|
Name: wireshark
|
||||||
Version: 3.6.3
|
Version: 3.6.11
|
||||||
Release: 3
|
Release: 1
|
||||||
Epoch: 1
|
Epoch: 1
|
||||||
License: GPL+
|
License: GPL+
|
||||||
Url: http://www.wireshark.org/
|
Url: http://www.wireshark.org/
|
||||||
@ -21,8 +21,6 @@ Patch4: wireshark-0004-Restore-Fedora-specific-groups.patch
|
|||||||
Patch5: wireshark-0005-Fix-paths-in-a-wireshark.desktop-file.patch
|
Patch5: wireshark-0005-Fix-paths-in-a-wireshark.desktop-file.patch
|
||||||
Patch6: wireshark-0006-Move-tmp-to-var-tmp.patch
|
Patch6: wireshark-0006-Move-tmp-to-var-tmp.patch
|
||||||
Patch7: wireshark-0007-cmakelists.patch
|
Patch7: wireshark-0007-cmakelists.patch
|
||||||
Patch8: CVE-2022-3190.patch
|
|
||||||
Patch9: CVE-2022-3725.patch
|
|
||||||
|
|
||||||
Requires: xdg-utils
|
Requires: xdg-utils
|
||||||
Requires: hicolor-icon-theme
|
Requires: hicolor-icon-theme
|
||||||
@ -197,6 +195,9 @@ exit 0
|
|||||||
%{_mandir}/man?/*
|
%{_mandir}/man?/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Feb 14 2023 liyuxiang<liyuxiang@ncti-gba.cn> - 1:3.6.11-1
|
||||||
|
- Update to 3.6.11
|
||||||
|
|
||||||
* Wed Nov 09 2022 liyuxiang<liyuxiang@ncti-gba.cn> - 1:3.6.3-3
|
* Wed Nov 09 2022 liyuxiang<liyuxiang@ncti-gba.cn> - 1:3.6.3-3
|
||||||
- fix CVE-2022-3725
|
- fix CVE-2022-3725
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user