Compare commits

...

No commits in common. "c9" and "c8" have entirely different histories.
c9 ... c8

4 changed files with 25 additions and 111 deletions

View File

@ -1 +0,0 @@
bc5c6c8022187511be5665b3818d919be5987dcc SOURCES/traceroute-2.1.0.tar.gz

View File

@ -1,57 +0,0 @@
From 4bbfd43121e4c1f59074b1b0def9804c1890b2dc Mon Sep 17 00:00:00 2001
From: Jan Macku <jamacku@redhat.com>
Date: Mon, 19 Jul 2021 09:48:19 +0200
Subject: [PATCH] review of CWE-170, CWE-772
Resolves: #1938887
---
libsupp/clif.c | 2 ++
traceroute/traceroute.c | 7 ++++++-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/libsupp/clif.c b/libsupp/clif.c
index 4ef20e4..60ec291 100644
--- a/libsupp/clif.c
+++ b/libsupp/clif.c
@@ -229,10 +229,12 @@ static void err_bad_arg (const CLIF_option *optn, char c, int n) {
if (c) {
s = show_short (&tmp); /* always without arg... */
+ /* coverity[buffer_size_warning] - not a bug, s ends with '\0', see line 97 */
strncpy (ss, s, sizeof (ss));
s = show_short (optn);
} else {
s = show_long (&tmp); /* always without arg... */
+ /* coverity[buffer_size_warning] - not a bug, s ends with '\0', see line 97 */
strncpy (ss, s, sizeof (ss));
s = show_long (optn);
}
diff --git a/traceroute/traceroute.c b/traceroute/traceroute.c
index 4be9b24..0a29e36 100644
--- a/traceroute/traceroute.c
+++ b/traceroute/traceroute.c
@@ -217,8 +217,12 @@ static int getaddr (const char *name, sockaddr_any *addr) {
}
if (!ai) ai = res; /* anything... */
- if (ai->ai_addrlen > sizeof (*addr))
+ if (ai->ai_addrlen > sizeof (*addr)) {
+ /* Avoid of leaking res (CWE-772) */
+ freeaddrinfo (res);
return -1; /* paranoia */
+ }
+
memcpy (addr, ai->ai_addr, ai->ai_addrlen);
freeaddrinfo (res);
@@ -244,6 +248,7 @@ static void make_fd_used (int fd) {
close (nfd);
}
+ /* coverity[leaked_handle] - not a bug, see line 665 */
return;
}
--
2.31.1

View File

@ -2,20 +2,17 @@ Summary: Traces the route taken by packets over an IPv4/IPv6 network
Name: traceroute
Epoch: 3
Version: 2.1.0
Release: 18%{?dist}
Release: 8%{?dist}
Group: Applications/Internet
License: GPLv2+
URL: http://traceroute.sourceforge.net
Source0: https://downloads.sourceforge.net/project/traceroute/traceroute/traceroute-%{version}/traceroute-%{version}.tar.gz
Source0: http://downloads.sourceforge.net/project/traceroute/traceroute/traceroute-%{version}/traceroute-%{version}.tar.gz
Patch001: 001-review-of-CWE-170-CWE-772.patch
Patch002: 002-traceroute-CVE-2023-46316.patch
Patch001: 001-traceroute-CVE-2023-46316.patch
Provides: tcptraceroute = 1.5-1
Obsoletes: tcptraceroute < 1.5-1
BuildRequires: make
BuildRequires: gcc
%description
The traceroute utility displays the route used by IP packets on their
@ -34,67 +31,42 @@ problems.
%build
%make_build CFLAGS="$RPM_OPT_FLAGS" LDFLAGS="$RPM_LD_FLAGS"
make %{?_smp_mflags} CFLAGS="$RPM_OPT_FLAGS" LDFLAGS="$RPM_LD_FLAGS"
%install
install -D -p -m755 traceroute/traceroute $RPM_BUILD_ROOT%{_bindir}/traceroute
ln -s traceroute $RPM_BUILD_ROOT%{_bindir}/traceroute6
install -D -p -m755 wrappers/tcptraceroute $RPM_BUILD_ROOT%{_bindir}/tcptraceroute
install -D -p -m644 traceroute/traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8/traceroute.8
ln -s traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8/traceroute6.8
ln -s traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8/tcptraceroute.8
install -d $RPM_BUILD_ROOT/bin
install -m755 traceroute/traceroute $RPM_BUILD_ROOT/bin
pushd $RPM_BUILD_ROOT/bin
ln -s traceroute traceroute6
popd
install -d $RPM_BUILD_ROOT%{_bindir}
install -m755 wrappers/tcptraceroute $RPM_BUILD_ROOT%{_bindir}
install -d $RPM_BUILD_ROOT%{_mandir}/man8
install -p -m644 traceroute/traceroute.8 $RPM_BUILD_ROOT%{_mandir}/man8
pushd $RPM_BUILD_ROOT%{_mandir}/man8
ln -s traceroute.8 traceroute6.8
ln -s traceroute.8 tcptraceroute.8
popd
%files
%license COPYING
%doc README TODO CREDITS
%doc COPYING README TODO CREDITS
/bin/*
%{_bindir}/*
%{_mandir}/*/*
%changelog
* Mon Nov 27 2023 Jan Macku <jamacku@redhat.com> - 3:2.1.0-18
* Mon Nov 27 2023 Jan Macku <jamacku@redhat.com> - 3:2.1.0-8
- add gating.yaml
* Mon Oct 30 2023 Jan Macku <jamacku@redhat.com> - 3:2.1.0-17
* Mon Oct 30 2023 Jan Macku <jamacku@redhat.com> - 3:2.1.0-7
- fix improper command line parsing (CVE-2023-46316)
* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 3:2.1.0-16
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Mon Jul 19 2021 Jan Macku <jamacku@redhat.com> - 3:2.1.0-15
- review of CWE-170 and CWE-772 (#1938887)
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3:2.1.0-14
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-13
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Jan 13 2021 Dmitry Butskoy <Dmitry@Butskoy.name> - 3:2.1.0-13
- Install into %{_bindir} (#1915614)
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 3:2.1.0-11
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3:2.1.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild