Fix for CVE-2014-9140

(cherry picked from commit 34303452e4286e4894117adbfa017897597cbbb6)

0016-Do-bounds-checking-when-unescaping-PPP.patch

@@ -0,0 +1,55 @@
+From 34303452e4286e4894117adbfa017897597cbbb6 Mon Sep 17 00:00:00 2001
+From: Guy Harris <guy@alum.mit.edu>
+Date: Wed, 22 Oct 2014 12:31:21 -0700
+Subject: [PATCH] Do bounds checking when unescaping PPP.
+
+Clean up a const issue while we're at it.
+---
+ print-ppp.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/print-ppp.c b/print-ppp.c
+index b858b73..eacba34 100644
+--- a/print-ppp.c
++++ b/print-ppp.c
+@@ -1351,14 +1351,15 @@ static void
+ ppp_hdlc(netdissect_options *ndo,
+          const u_char *p, int length)
+ {
+-	u_char *b, *s, *t, c;
++	u_char *b, *t, c;
++	const u_char *s;
+ 	int i, proto;
+ 	const void *se;
+ 
+         if (length <= 0)
+                 return;
+ 
+-	b = (uint8_t *)malloc(length);
++	b = (u_char *)malloc(length);
+ 	if (b == NULL)
+ 		return;
+ 
+@@ -1367,14 +1368,13 @@ ppp_hdlc(netdissect_options *ndo,
+ 	 * Do this so that we dont overwrite the original packet
+ 	 * contents.
+ 	 */
+-	for (s = (u_char *)p, t = b, i = length; i > 0; i--) {
++	for (s = p, t = b, i = length; i > 0 && ND_TTEST(*s); i--) {
+ 		c = *s++;
+ 		if (c == 0x7d) {
+-			if (i > 1) {
+-				i--;
+-				c = *s++ ^ 0x20;
+-			} else
+-				continue;
++			if (i <= 1 || !ND_TTEST(*s))
++				break;
++			i--;
++			c = *s++ ^ 0x20;
+ 		}
+ 		*t++ = c;
+ 	}
+-- 
+1.8.3.1
+

tcpdump.spec

@@ -2,7 +2,7 @@ Summary: A network traffic monitoring tool
 Name: tcpdump
 Epoch: 14
 Version: 4.6.2
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: BSD with advertising
 URL: http://www.tcpdump.org
 Group: Applications/Internet
@@ -27,6 +27,7 @@ Patch0012:      0012-Clean-up-error-message-printing.patch
 Patch0013:      0013-Further-cleanups.patch
 Patch0014:      0014-Not-using-offsetof-any-more-so-no-need-for-stddef.h.patch
 Patch0015:      0015-Report-a-too-long-unreachable-destination-list.patch
+Patch0016:      0016-Do-bounds-checking-when-unescaping-PPP.patch
 
 %define tcpslice_dir tcpslice-1.2a3
 
@@ -89,6 +90,9 @@ exit 0
 %{_mandir}/man8/tcpdump.8*
 
 %changelog
+* Wed Dec 03 2014 Michal Sekletar <msekleta@redhat.com> - 14:4.6.2-3
+- fix for CVE-2014-9140
+
 * Thu Nov 20 2014 Michal Sekletar <msekleta@redhat.com> - 14:4.6.2-2
 - fix for CVE-2014-8767 (#1165160)
 - fix for CVE-2014-8768 (#1165161)