main/wpa_supplicant: upgrade to 2.4 and fix CVE-2015-1863

3 files changed, 51 insertions, 28 deletions

diff --git a/main/wpa_supplicant/APKBUILD b/main/wpa_supplicant/APKBUILD
index 8676c7a77d..a59abecffb 100644
--- a/main/wpa_supplicant/APKBUILD
+++ b/main/wpa_supplicant/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=wpa_supplicant
-pkgver=2.3
-pkgrel=1
+pkgver=2.4
+pkgrel=0
 pkgdesc="A utility providing key negotiation for WPA wireless networks"
 url="http://hostap.epitest.fi/wpa_supplicant"
 arch="all"
@@ -10,7 +10,7 @@ subpackages="$pkgname-doc $pkgname-gui"
 depends="dbus"
 makedepends="openssl-dev dbus-dev libnl3-dev qt-dev"
 source="http://hostap.epitest.fi/releases/$pkgname-$pkgver.tar.gz
-	musl-fix-types.patch
+	CVE-2015-1863.patch
 
 	wpa_supplicant.initd
 	wpa_supplicant.confd
@@ -153,15 +153,15 @@ gui() {
 	mv "$pkgdir"/usr/bin/wpa_gui "$subpkgdir"/usr/bin/
 }
 
-md5sums="f2ed8fef72cf63d8d446a2d0a6da630a  wpa_supplicant-2.3.tar.gz
-6023cac7f7fc6801e575f255af025368  musl-fix-types.patch
+md5sums="f0037dbe03897dcaf2ad2722e659095d  wpa_supplicant-2.4.tar.gz
+8e8c34267fefcc4142ee142e5515b5df  CVE-2015-1863.patch
 5ee64e2494a9e83740d2344dd5b9bb19  wpa_supplicant.initd
 bc117427f2c538439f3f1481a028ee06  wpa_supplicant.confd"
-sha256sums="eaaa5bf3055270e521b2dff64f2d203ec8040f71958b8588269a82c00c9d7b6a  wpa_supplicant-2.3.tar.gz
-2196f8850f72c5f269d2b5c1495c33e254c7c1526648e5cd4a51901205d3b45b  musl-fix-types.patch
+sha256sums="058dc832c096139a059e6df814080f50251a8d313c21b13364c54a1e70109122  wpa_supplicant-2.4.tar.gz
+a3abf75801f02199ff48c316a7b6598860e6ca20ce2fe79b0bec873905e5c8a4  CVE-2015-1863.patch
 131828768c8f334b39bb5294398105ed4cd6d031908e6e9b00bb4a0938f5f7f2  wpa_supplicant.initd
 61ec59007f66ac5bacc0aa095d1f2ccbc977a687038e161a463d1727223d5a90  wpa_supplicant.confd"
-sha512sums="dc64c0ff5581ca36e9c41f7663883d5bf6626a4418423233fa69b2c4b57c24fa120e0699c95613152be7775835a45bd9edbe5cc95456ac3ce699b546ddaee71e  wpa_supplicant-2.3.tar.gz
-64bc462d10f99f13098554db85d514530fcb85bc93d65843d0db66493cf7b6280e22540c95846d0f6c870f6cbd95cc8d4208675775e964988d97351bc716b7df  musl-fix-types.patch
+sha512sums="03d8199325b3910f77013ddb7edd803ab4444542230484e1cb465dc3df9372b39ee3307d823ce88730e8f5a5231ef3183954c54cf07297b70432f526e45aac2b  wpa_supplicant-2.4.tar.gz
+61f90d06bd42fb7ea17ba147db861303f5b1fdce2cda35492cec578214da5ea5d654a1df99dee4d4a0c07ef3e8b3bfb65ab4b98eff21c2013adf536766136ce1  CVE-2015-1863.patch
 4a62879f6eb37226a2009a4bceb123c6e610c366c2369ee2fc84b66b79e8dddee5185a64cebe0331bafe13d61cf44c0bbbe3dce2620c0f4525c96afcb58dd362  wpa_supplicant.initd
 29103161ec2b9631fca9e8d9a97fafd60ffac3fe78cf613b834395ddcaf8be1e253c22e060d7d9f9b974b2d7ce794caa932a2125e29f6494b75bce475f7b30e1  wpa_supplicant.confd"
diff --git a/main/wpa_supplicant/CVE-2015-1863.patch b/main/wpa_supplicant/CVE-2015-1863.patch
new file mode 100644
index 0000000000..de1964ca76
--- /dev/null
+++ b/main/wpa_supplicant/CVE-2015-1863.patch
@@ -0,0 +1,42 @@
+From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Tue, 7 Apr 2015 11:32:11 +0300
+Subject: [PATCH] P2P: Validate SSID element length before copying it
+ (CVE-2015-1863)
+
+This fixes a possible memcpy overflow for P2P dev->oper_ssid in
+p2p_add_device(). The length provided by the peer device (0..255 bytes)
+was used without proper bounds checking and that could have resulted in
+arbitrary data of up to 223 bytes being written beyond the end of the
+dev->oper_ssid[] array (of which about 150 bytes would be beyond the
+heap allocation) when processing a corrupted management frame for P2P
+peer discovery purposes.
+
+This could result in corrupted state in heap, unexpected program
+behavior due to corrupted P2P peer device information, denial of service
+due to process crash, exposure of memory contents during GO Negotiation,
+and potentially arbitrary code execution.
+
+Thanks to Google security team for reporting this issue and smart
+hardware research group of Alibaba security team for discovering it.
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+---
+ src/p2p/p2p.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
+index f584fae..a45fe73 100644
+--- a/src/p2p/p2p.c
++++ b/src/p2p/p2p.c
+@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq,
+ 	if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
+ 		os_memcpy(dev->interface_addr, addr, ETH_ALEN);
+ 	if (msg.ssid &&
++	    msg.ssid[1] <= sizeof(dev->oper_ssid) &&
+ 	    (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
+ 	     os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
+ 	     != 0)) {
+-- 
+1.9.1
+
diff --git a/main/wpa_supplicant/musl-fix-types.patch b/main/wpa_supplicant/musl-fix-types.patch
deleted file mode 100644
index a79000d9e7..0000000000
--- a/main/wpa_supplicant/musl-fix-types.patch
+++ /dev/null
@@ -1,19 +0,0 @@
---- wpa_supplicant-2.0.orig/src/drivers/linux_wext.h
-+++ wpa_supplicant-2.0/src/drivers/linux_wext.h
-@@ -21,11 +21,11 @@
- 
- #include <sys/types.h>
- #include <net/if.h>
--typedef __uint32_t __u32;
--typedef __int32_t __s32;
--typedef __uint16_t __u16;
--typedef __int16_t __s16;
--typedef __uint8_t __u8;
-+typedef u_int32_t __u32;
-+typedef int32_t __s32;
-+typedef u_int16_t __u16;
-+typedef int16_t __s16;
-+typedef u_int8_t __u8;
- #ifndef __user
- #define __user
- #endif /* __user */