aboutsummaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant
diff options
context:
space:
mode:
authorYue Tao <Yue.Tao@windriver.com>2015-05-26 12:55:42 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2015-05-27 17:47:36 +0100
commitfd0880c2b0958b72d641a6821ddd6d6790a92b7a (patch)
tree906d35d51db0b728c0ae89739fd869c3cbb67360 /meta/recipes-connectivity/wpa-supplicant/wpa-supplicant
parent5b549c6d73e91fdbd0b618a752d618deb1449ef9 (diff)
downloadopenembedded-core-fd0880c2b0958b72d641a6821ddd6d6790a92b7a.tar.gz
openembedded-core-fd0880c2b0958b72d641a6821ddd6d6790a92b7a.tar.bz2
openembedded-core-fd0880c2b0958b72d641a6821ddd6d6790a92b7a.zip
wpa-supplicant: upgrade to 2.4
1. upgrade to 2.4 2. update the checksum, and license checksum since date in it is changed 3. Backport a patch to fix CVE-2015-1863 4. remove two deprecated patches Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/wpa-supplicant/wpa-supplicant')
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch47
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch38
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch42
3 files changed, 47 insertions, 80 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
new file mode 100644
index 0000000000..e108a931c0
--- /dev/null
+++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch
@@ -0,0 +1,47 @@
+From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Tue, 7 Apr 2015 11:32:11 +0300
+Subject: [PATCH] P2P: Validate SSID element length before copying it
+ (CVE-2015-1863)
+
+This fixes a possible memcpy overflow for P2P dev->oper_ssid in
+p2p_add_device(). The length provided by the peer device (0..255 bytes)
+was used without proper bounds checking and that could have resulted in
+arbitrary data of up to 223 bytes being written beyond the end of the
+dev->oper_ssid[] array (of which about 150 bytes would be beyond the
+heap allocation) when processing a corrupted management frame for P2P
+peer discovery purposes.
+
+This could result in corrupted state in heap, unexpected program
+behavior due to corrupted P2P peer device information, denial of service
+due to process crash, exposure of memory contents during GO Negotiation,
+and potentially arbitrary code execution.
+
+Thanks to Google security team for reporting this issue and smart
+hardware research group of Alibaba security team for discovering it.
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+
+Upstream-Status: Backport
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+---
+ src/p2p/p2p.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
+index f584fae..a45fe73 100644
+--- a/src/p2p/p2p.c
++++ b/src/p2p/p2p.c
+@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
+ if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
+ os_memcpy(dev->interface_addr, addr, ETH_ALEN);
+ if (msg.ssid &&
++ msg.ssid[1] <= sizeof(dev->oper_ssid) &&
+ (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
+ os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
+ != 0)) {
+--
+1.7.9.5
+
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch
deleted file mode 100644
index 49a988b676..0000000000
--- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 159db445dc4cb0af5f6ad85f3a146ad137db5057 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Fri, 3 Apr 2015 20:38:21 -0700
-Subject: [PATCH] linux_wext: Fix types for musl
-
-| ../src/drivers/linux_wext.h:24:9: error: unknown type name '__uint32_t'
-| typedef __uint32_t __u32;
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Upstream-Status: Pending
----
- src/drivers/linux_wext.h | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/src/drivers/linux_wext.h b/src/drivers/linux_wext.h
-index 55cf955..e66df91 100644
---- a/src/drivers/linux_wext.h
-+++ b/src/drivers/linux_wext.h
-@@ -21,11 +21,11 @@
-
- #include <sys/types.h>
- #include <net/if.h>
--typedef __uint32_t __u32;
--typedef __int32_t __s32;
--typedef __uint16_t __u16;
--typedef __int16_t __s16;
--typedef __uint8_t __u8;
-+typedef u_int32_t __u32;
-+typedef int32_t __s32;
-+typedef u_int16_t __u16;
-+typedef int16_t __s16;
-+typedef u_int8_t __u8;
- #ifndef __user
- #define __user
- #endif /* __user */
---
-2.1.4
-
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch
deleted file mode 100644
index e899c1655d..0000000000
--- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-Upstream-Status: Pending
-
-From 37d6b3dd5a737cd67468e4a58b372bddd924a7be Mon Sep 17 00:00:00 2001
-From: Andreas Oberritter <obi@opendreambox.org>
-Date: Fri, 8 Mar 2013 22:55:19 +0100
-Subject: [PATCH] Revert "build: Use updated libnl3 header paths"
-
-This reverts commit e7ecddf33a446072effbc85a27a078a8e582c89e.
----
- src/drivers/drivers.mak | 2 +-
- src/drivers/drivers.mk | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/drivers/drivers.mak b/src/drivers/drivers.mak
-index 68ff910..1f38f57 100644
---- a/src/drivers/drivers.mak
-+++ b/src/drivers/drivers.mak
-@@ -35,7 +35,7 @@ NEED_RFKILL=y
- ifdef CONFIG_LIBNL32
- DRV_LIBS += -lnl-3
- DRV_LIBS += -lnl-genl-3
-- DRV_CFLAGS += -DCONFIG_LIBNL20 -I/usr/include/libnl3
-+ DRV_CFLAGS += -DCONFIG_LIBNL20
- ifdef CONFIG_LIBNL3_ROUTE
- DRV_LIBS += -lnl-route-3
- DRV_CFLAGS += -DCONFIG_LIBNL3_ROUTE
-diff --git a/src/drivers/drivers.mk b/src/drivers/drivers.mk
-index db8561a..c93e88d 100644
---- a/src/drivers/drivers.mk
-+++ b/src/drivers/drivers.mk
-@@ -30,7 +30,7 @@ NEED_RFKILL=y
- ifdef CONFIG_LIBNL32
- DRV_LIBS += -lnl-3
- DRV_LIBS += -lnl-genl-3
-- DRV_CFLAGS += -DCONFIG_LIBNL20 -I/usr/include/libnl3
-+ DRV_CFLAGS += -DCONFIG_LIBNL20
- ifdef CONFIG_LIBNL3_ROUTE
- DRV_LIBS += -lnl-route-3
- DRV_CFLAGS += -DCONFIG_LIBNL3_ROUTE
---
-1.7.10.4
-