Skip to contentSkip to conversation

libidn: add fix for CVE-2017-14062

PATCH New Baruch Siach 2 participants 5 messages Sep 15, 2017 – Oct 16, 2017

lore
Share & tools
lore

Baruch Siach

author
#0 lore raw

PATCH 1/1 libidn: add fix for CVE-2017-14062

Add upstream patch fixing CVE-2017-14062:

Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

This issue also affects libidn.

Unfortunately, the patch also triggers reconf of the documentation subdirectory, since lib/punycode.c is listed in GDOC_SRC that is defined in doc/Makefile.am. Add autoreconf to handle that.

Signed-off-by Baruch Siach <[email protected]>
---
 ...ycode.c-decode_digit-Fix-integer-overflow.patch | 36 ++++++++++++++++++++++
 package/libidn/libidn.mk                           |  2 ++
 2 files changed, 38 insertions(+)
 create mode 100644 package/libidn/0001-lib-punycode.c-decode_digit-Fix-integer-overflow.patch
package/libidn/0001-lib-punycode.c-decode_digit-Fix-integer-overflow.patch new file +36 -0
new file mode 100644
index 000000000000..8a8ca47a66bb
@@ -0,0 +1,36 @@
+From e9e81b8063b095b02cf104bb992fa9bf9515b9d8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <[email protected]>
+Date: Fri, 1 Sep 2017 10:04:48 +0200
+Subject: [PATCH] lib/punycode.c (decode_digit): Fix integer overflow
+
+This fix is a backport from libidn2 and addresses
+CVE-2017-14062.
+
+Signed-off-by: Baruch Siach <[email protected]>
+---
+Upstream status: commit e9e81b8063b095
+
+ lib/punycode.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/punycode.c b/lib/punycode.c
+index 86819a7deb85..49250a13e2cc 100644
+--- a/lib/punycode.c
++++ b/lib/punycode.c
+@@ -88,10 +88,10 @@ enum
+ /* point (for use in representing integers) in the range 0 to */
+ /* base-1, or base if cp does not represent a value.          */
+ 
+-static punycode_uint
+-decode_digit (punycode_uint cp)
++static unsigned
++decode_digit (int cp)
+ {
+-  return cp - 48 < 10 ? cp - 22 : cp - 65 < 26 ? cp - 65 :
++  return (unsigned) cp - 48 < 10 ? cp - 22 : cp - 65 < 26 ? cp - 65 :
+     cp - 97 < 26 ? cp - 97 : base;
+ }
+ 
+-- 
+2.14.1
+
package/libidn/libidn.mk +2 -0
index b96e74262133..420b8dfb911a 100644
@@ -12,6 +12,8 @@ LIBIDN_CONF_OPTS = --disable-java --enable-csharp=no
 LIBIDN_DEPENDENCIES = host-pkgconf $(TARGET_NLS_DEPENDENCIES) $(if $(BR2_PACKAGE_LIBICONV),libiconv)
 LIBIDN_LICENSE = GPL-2.0+, GPL-3.0+, LGPL-3.0+
 LIBIDN_LICENSE_FILES = COPYINGv2 COPYINGv3 COPYING.LESSERv3
+# lib/punycode.c patch triggers reconf in doc/
+LIBIDN_AUTORECONF = YES
 
 define LIBIDN_REMOVE_BINARY
 	rm -f $(TARGET_DIR)/usr/bin/idn
Signature · 1 line
2.14.1
#1 lore raw

PATCH 1/1 libidn: add fix for CVE-2017-14062

Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Add upstream patch fixing CVE-2017-14062:
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Quoted 7 lines

This issue also affects libidn.

Unfortunately, the patch also triggers reconf of the documentation subdirectory, since lib/punycode.c is listed in GDOC_SRC that is defined in doc/Makefile.am. Add autoreconf to handle that.

Signed-off-by Baruch Siach <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#2 lore raw

PATCH 1/1 libidn: add fix for CVE-2017-14062

In reply to Baruch Siach
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Add upstream patch fixing CVE-2017-14062:
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Quoted 7 lines

This issue also affects libidn.

Unfortunately, the patch also triggers reconf of the documentation subdirectory, since lib/punycode.c is listed in GDOC_SRC that is defined in doc/Makefile.am. Add autoreconf to handle that.

Signed-off-by Baruch Siach <[email protected]>

The autoreconf causes some build issues related to makeinfo. Care to take a look?

http://autobuild.buildroot.net/results/b4a/b4a89f59b251cf0f11dac7095367f5d2fdab01ba/

Signature · 1 line
Bye, Peter Korsgaard
#3 lore raw

PATCH 1/1 libidn: add fix for CVE-2017-14062

In reply to Baruch Siach
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Add upstream patch fixing CVE-2017-14062:
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Quoted 7 lines

This issue also affects libidn.

Unfortunately, the patch also triggers reconf of the documentation subdirectory, since lib/punycode.c is listed in GDOC_SRC that is defined in doc/Makefile.am. Add autoreconf to handle that.

Signed-off-by Baruch Siach <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#4 lore raw

PATCH 1/1 libidn: add fix for CVE-2017-14062

In reply to Baruch Siach
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Add upstream patch fixing CVE-2017-14062:
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Quoted 7 lines

This issue also affects libidn.

Unfortunately, the patch also triggers reconf of the documentation subdirectory, since lib/punycode.c is listed in GDOC_SRC that is defined in doc/Makefile.am. Add autoreconf to handle that.

Signed-off-by Baruch Siach <[email protected]>

Committed to 2017.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard