- security fixes for 3.7.2 (Ra) and 3.8.1 (current)

Changed files:
    tcpdump-isakmp-CAN-2004-0057.patch -> 1.1
    tcpdump-radius-CAN-2004-0055.patch -> 1.1

diff --git a/tcpdump-isakmp-CAN-2004-0057.patch b/tcpdump-isakmp-CAN-2004-0057.patch
new file mode 100644 (file)
index 0000000..7e50399
--- /dev/null
+++ b/tcpdump-isakmp-CAN-2004-0057.patch
@@ -0,0 +1,43 @@
+--- print-isakmp.c
++++ print-isakmp.c
+@@ -30,7 +30,7 @@
+ 
+ #ifndef lint
+ static const char rcsid[] _U_ =
+-    "@(#) $Header$ (LBL)";
++    "@(#) $Header$ (LBL)";
+ #endif
+ 
+ #ifdef HAVE_CONFIG_H
+@@ -327,9 +327,13 @@
+       static u_char *p;
+       size_t i;
+ 
++      TCHECK2(*loc, len);
++      
+       p = (u_char *)loc;
+       for (i = 0; i < len; i++)
+               printf("%02x", p[i] & 0xff);
++trunc:
++
+ }
+ 
+ struct attrmap {
+@@ -1111,6 +1115,8 @@
+       cp = (const u_char *)ext;
+ 
+       while (np) {
++              TCHECK2(*ext, sizeof(e));
++              
+               safememcpy(&e, ext, sizeof(e));
+ 
+               if (ep < (u_char *)ext + ntohs(e.len)) {
+@@ -1136,6 +1142,8 @@
+               ext = (struct isakmp_gen *)cp;
+       }
+       return cp;
++trunc:
++      return NULL;
+ }
+ 
+ static char *

diff --git a/tcpdump-radius-CAN-2004-0055.patch b/tcpdump-radius-CAN-2004-0055.patch
new file mode 100644 (file)
index 0000000..5ef3250
--- /dev/null
+++ b/tcpdump-radius-CAN-2004-0055.patch
@@ -0,0 +1,11 @@
+--- print-radius.c
++++ print-radius.c
+@@ -474,7 +474,7 @@
+         break;
+    }
+ 
+-   for (i=0; i < length ; i++, data++)
++   for (i=0; *data && i < length ; i++, data++)
+        printf("%c",(*data < 32 || *data > 128) ? '.' : *data );
+ 
+    printf("}");