This fixes the following security problems in dnsmasq:
* CVE-2020-25681:
Dnsmasq versions before 2.83 is susceptible to a heap-based buffer
overflow in sort_rrset() when DNSSEC is used. This can allow a remote
attacker to write arbitrary data into target device's memory that can
lead to memory corruption and other unexpected behaviors on the target
device.
* CVE-2020-25682:
Dnsmasq versions before 2.83 is susceptible to buffer overflow in
extract_name() function due to missing length check, when DNSSEC is
enabled. This can allow a remote attacker to cause memory corruption
on the target device.
* CVE-2020-25683:
Dnsmasq version before 2.83 is susceptible to a heap-based buffer
overflow when DNSSEC is enabled. A remote attacker, who can create
valid DNS replies, could use this flaw to cause an overflow in a heap-
allocated memory. This flaw is caused by the lack of length checks in
rtc1035.c:extract_name(), which could be abused to make the code
execute memcpy() with a negative size in get_rdata() and cause a crash
in Dnsmasq, resulting in a Denial of Service.
* CVE-2020-25684:
A lack of proper address/port check implemented in Dnsmasq version <
2.83 reply_query function makes forging replies easier to an off-path
attacker.
* CVE-2020-25685:
A lack of query resource name (RRNAME) checks implemented in Dnsmasq's
versions before 2.83 reply_query function allows remote attackers to
spoof DNS traffic that can lead to DNS cache poisoning.
* CVE-2020-25686:
Multiple DNS query requests for the same resource name (RRNAME) by
Dnsmasq versions before 2.83 allows for remote attackers to spoof DNS
traffic, using a birthday attack (RFC 5452), that can lead to DNS
cache poisoning.
* CVE-2020-25687:
Dnsmasq versions before 2.83 is vulnerable to a heap-based buffer
overflow with large memcpy in sort_rrset() when DNSSEC is enabled. A
remote attacker, who can create valid DNS replies, could use this flaw
to cause an overflow in a heap-allocated memory. This flaw is caused
by the lack of length checks in rtc1035.c:extract_name(), which could
be abused to make the code execute memcpy() with a negative size in
sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of
Service.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: CN_SZTL <cnsztl@project-openwrt.eu.org>
This makes it a little easier to figure out which options to choose.
Signed-off-by: Rogan Dawes <rogan@dawes.za.net>
Signed-off-by: CN_SZTL <cnsztl@project-openwrt.eu.org>
The "cidr_contains6" functions clones the given cidr. The contains4
does not clone the cidr. Both functions do not behave the same.
I see no reason to push the cidr. I think that we get only a negligible
performance gain, but it makes ipv4 and ipv6 equal again.
Signed-off-by: Nick Hainke <vincent@systemli.org>
Reordered for consistency between packages.
Fixed license information.
Change PKG_BUILD_PARALLEL to 1. This is no longer a problem.1
Signed-off-by: Rosen Penev <rosenp@gmail.com>
This adds a config option to allow compiling with HKDF algorithm support
to support applications that require this feature.
Signed-off-by: Etan Kissling <etan_kissling@apple.com>
4c619b3eed x86: Check IFUNC definition in unrelocated executable [BZ #20019]
87450ecf8a x86: Set header.feature_1 in TCB for always-on CET [BZ #27177]
2b4f67c2b3 Update for [BZ #27130] fix
1a24bbd43e x86-64: Avoid rep movsb with short distance [BZ #27130]
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
The cidr_parse6 function parses a string to an ipv6-address.
The cidr struct contains a union called buf for the ipv4 and ipv6
address. Since it is a char pointer and the struct is initialized with
the maximum size (so ipv6 string) it does not make any difference.
However, we should access the buffer using the v6 name, since it could
be confusing otherwise.
Signed-off-by: Nick Hainke <vincent@systemli.org>
Since 4ee3cf2b5a profiles with alternative vendor names may appear
multiple times in `tmp/.targetinfo` or `.targetinfo` (for
ImageBuilders).
The `target-metadata.pl` script adds these profiles then twice to
`PROFILE_NAMES` and the ImageBuilder show the profile twice when running
`make info`.
This patch removes duplicate profile IDs and only adds them once to
`.profiles.mk`.
Signed-off-by: Paul Spooren <mail@aparcar.org>
glibc does not officially support ARC700 so this adds the missing
pieces. I looked at uClibc-ng and a patch by Synopsis for glibc.
ran make toolchain/glibc/refresh to clean up fuzz.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
It looks like GitHub changed the URL path for release tarballs, thus the
download for the zstd package was always falling back to the OpenWrt
sources mirror.
Fix the GitHub URL for one which works. The file hash remains unchanged.
Signed-off-by: David Bauer <mail@david-bauer.net>
This hack is not stable and causes some devices against to boot,
users should make oc via their u-boot but not kernel hacks.
This reverts commit 5c6eeab752.
Signed-off-by: CN_SZTL <cnsztl@project-openwrt.eu.org>
Previously, ccache would end up using the system libzstd, which is not
supposed to be a build requirement.
Signed-off-by: Thomas Nixon <tom@tomn.co.uk>
