!4 fix CVE-2021-3571

From: @houyingchao
Reviewed-by: @small_leek
Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot 2021-07-14 02:26:49 +00:00 committed by Gitee
commit 0380f77d83
2 changed files with 33 additions and 1 deletions

26
CVE-2021-3571.patch Normal file
View File

@ -0,0 +1,26 @@
From d61d77e163dbee247819f3d88593ba111577af15 Mon Sep 17 00:00:00 2001
From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Fri, 26 Mar 2021 09:57:43 +0100
Subject: [PATCH] tc: Fix length of follow-up message of one-step sync.
Convert the length of the generated follow-up message to network order.
This fixes reading and sending of data past the message buffer.
Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
---
tc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tc.c b/tc.c
index d9e4853..2e3830c 100644
--- a/tc.c
+++ b/tc.c
@@ -452,7 +452,7 @@ int tc_fwd_sync(struct port *q, struct ptp_message *msg)
}
fup->header.tsmt = FOLLOW_UP | (msg->header.tsmt & 0xf0);
fup->header.ver = msg->header.ver;
- fup->header.messageLength = sizeof(struct follow_up_msg);
+ fup->header.messageLength = htons(sizeof(struct follow_up_msg));
fup->header.domainNumber = msg->header.domainNumber;
fup->header.sourcePortIdentity = msg->header.sourcePortIdentity;
fup->header.sequenceId = msg->header.sequenceId;

View File

@ -1,6 +1,6 @@
Name: linuxptp
Version: 2.0
Release: 3
Release: 4
Summary: Linuxptp is an implementation of the Precision Time Protocol (PTP)
Group: System Environment/Base
License: GPLv2+
@ -8,6 +8,9 @@ URL: http://linuxptp.sourceforge.net/
Source0: https://downloads.sourceforge.net/%{name}/%{name}-%{version}.tgz
Source1: phc2sys.service
Source2: ptp4l.service
patch0000: CVE-2021-3571.patch
BuildRequires: gcc gcc-c++ systemd git net-tools
@ -77,6 +80,9 @@ echo 'OPTIONS="-a -r"' > %{buildroot}%{_sysconfdir}/sysconfig/phc2sys
%{_mandir}/man8/*.8*
%changelog
* Wed Jul 14 2021 houyingchao <houyingchao@huawei.com> - 2.0-4
- fix CVE-2021-3571
* Thu Nov 28 2019 openEuler BuildTeam<buildteam@openeuler.org> 2.0-3
- Package Init