svn commit: r360974 - in releng: 11.3/sys/netinet/libalias 11.4/sys/netinet/libalias 12.1/sys/netinet/libalias

[Gordon Tetlow]

Author: gordon
Date: Tue May 12 16:54:39 2020
New Revision: 360974
URL: https://svnweb.freebsd.org/changeset/base/360974

Log:
  Fix memory disclosure vulnerability in libalias.
  
  Approved by:	so
  Approved by:	re (implicit)
  Security:	FreeBSD-SA-20:13.libalias
  Security:	CVE-2020-7455

Modified:
  releng/11.3/sys/netinet/libalias/alias_ftp.c
  releng/11.4/sys/netinet/libalias/alias_ftp.c
  releng/12.1/sys/netinet/libalias/alias_ftp.c

Modified: releng/11.3/sys/netinet/libalias/alias_ftp.c
==============================================================================
--- releng/11.3/sys/netinet/libalias/alias_ftp.c	Tue May 12 16:52:08 2020	(r360973)
+++ releng/11.3/sys/netinet/libalias/alias_ftp.c	Tue May 12 16:54:39 2020	(r360974)
@@ -752,7 +752,8 @@ NewFtpMessage(struct libalias *la, struct ip *pip,
 		{
 			u_short new_len;
 
-			new_len = htons(hlen + slen);
+			new_len = htons(hlen +
+			    MIN(slen, maxpacketsize - hlen));
 			DifferentialChecksum(&pip->ip_sum,
 			    &new_len,
 			    &pip->ip_len,

Modified: releng/11.4/sys/netinet/libalias/alias_ftp.c
==============================================================================
--- releng/11.4/sys/netinet/libalias/alias_ftp.c	Tue May 12 16:52:08 2020	(r360973)
+++ releng/11.4/sys/netinet/libalias/alias_ftp.c	Tue May 12 16:54:39 2020	(r360974)
@@ -752,7 +752,8 @@ NewFtpMessage(struct libalias *la, struct ip *pip,
 		{
 			u_short new_len;
 
-			new_len = htons(hlen + slen);
+			new_len = htons(hlen +
+			    MIN(slen, maxpacketsize - hlen));
 			DifferentialChecksum(&pip->ip_sum,
 			    &new_len,
 			    &pip->ip_len,

Modified: releng/12.1/sys/netinet/libalias/alias_ftp.c
==============================================================================
--- releng/12.1/sys/netinet/libalias/alias_ftp.c	Tue May 12 16:52:08 2020	(r360973)
+++ releng/12.1/sys/netinet/libalias/alias_ftp.c	Tue May 12 16:54:39 2020	(r360974)
@@ -754,7 +754,8 @@ NewFtpMessage(struct libalias *la, struct ip *pip,
 		{
 			u_short new_len;
 
-			new_len = htons(hlen + slen);
+			new_len = htons(hlen +
+			    MIN(slen, maxpacketsize - hlen));
 			DifferentialChecksum(&pip->ip_sum,
 			    &new_len,
 			    &pip->ip_len,