CaROS/meta-openembedded
3
1
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-01-01 13:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

libcoap: patch CVE-2024-31031

Browse Source 
Pick commit [1] from [2] which fixes [3] as listed in [4].

[1] 214665ac4b
[2] https://github.com/obgm/libcoap/pull/1352
[3] https://github.com/obgm/libcoap/issues/1351
[4] https://nvd.nist.gov/vuln/detail/CVE-2024-31031

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Peter Marko 2025-07-12 11:45:32 +02:00 committed by Armin Kuster
parent c8a1b909ec
commit ba84c52d55
2 changed files with 83 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
meta-networking/recipes-devtools/libcoap/libcoap/CVE-2024-31031.patch Normal file
View File

@ -0,0 +1,82 @@
From 214665ac4b44b1b6a7e38d4d6907ee835a174928 Mon Sep 17 00:00:00 2001
From: Jon Shallow <supjps-libcoap@jpshallow.com>
Date: Mon, 25 Mar 2024 20:44:48 +0000
Subject: [PATCH] coap_pdu.c: Fix UndefinedBehaviorSanitizer:
undefined-behavior
This fixes a reported error in coap_update_token() where a size_t
calculation is overflowed (but all ends up with the correct value).
Instead of adding an overflowed size_t, now subtract the reversed
size_t calculation as appropriate.
coap_update_option() and coap_insert_option() similarily updated.
CVE: CVE-2024-31031
Upstream-Status: Backport [https://github.com/obgm/libcoap/commit/214665ac4b44b1b6a7e38d4d6907ee835a174928]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
src/coap_pdu.c | 33 ++++++++++++++++++++++++---------
1 file changed, 24 insertions(+), 9 deletions(-)
diff --git a/src/coap_pdu.c b/src/coap_pdu.c
index afe445c8..e3be3f02 100644
--- a/src/coap_pdu.c
+++ b/src/coap_pdu.c
@@ -389,12 +389,15 @@ coap_update_token(coap_pdu_t *pdu, size_t len, const uint8_t *data) {
memmove(&pdu->token[(len + bias) - pdu->e_token_length],
pdu->token, pdu->used_size);
pdu->used_size += len + bias - pdu->e_token_length;
+ if (pdu->data) {
+ pdu->data += (len + bias) - pdu->e_token_length;
+ }
} else {
pdu->used_size -= pdu->e_token_length - (len + bias);
memmove(pdu->token, &pdu->token[pdu->e_token_length - (len + bias)], pdu->used_size);
- }
- if (pdu->data) {
- pdu->data += (len + bias) - pdu->e_token_length;
+ if (pdu->data) {
+ pdu->data -= pdu->e_token_length - (len + bias);
+ }
}
pdu->actual_token.length = len;
@@ -641,9 +644,15 @@ coap_insert_option(coap_pdu_t *pdu, coap_option_num_t number, size_t len,
number - prev_number, data, len))
return 0;
- pdu->used_size += shift - shrink;
- if (pdu->data)
- pdu->data += shift - shrink;
+ if (shift >= shrink) {
+ pdu->used_size += shift - shrink;
+ if (pdu->data)
+ pdu->data += shift - shrink;
+ } else {
+ pdu->used_size -= shrink - shift;
+ if (pdu->data)
+ pdu->data -= shrink - shift;
+ }
return shift;
}
@@ -681,9 +690,15 @@ coap_update_option(coap_pdu_t *pdu, coap_option_num_t number, size_t len,
decode.delta, data, len))
return 0;
- pdu->used_size += new_length - old_length;
- if (pdu->data)
- pdu->data += new_length - old_length;
+ if (new_length >= old_length) {
+ pdu->used_size += new_length - old_length;
+ if (pdu->data)
+ pdu->data += new_length - old_length;
+ } else {
+ pdu->used_size -= old_length - new_length;
+ if (pdu->data)
+ pdu->data -= old_length - new_length;
+ }
return 1;
}

1
meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb
View File

@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=1978dbc41673ab1c20e64b287c8317bc"
SRC_URI = "git://github.com/obgm/libcoap.git;branch=main;protocol=https \
file://run-ptest \
file://CVE-2024-0962.patch \
file://CVE-2024-31031.patch \
"
SRCREV = "5fd2f89ef068214130e5d60b7087ef48711fa615"