Complete Yocto mirror with license table for TQMa6UL (2038-compliance)
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
This commit is contained in:
Siggi (OpenClaw Agent)
@@ -0,0 +1,36 @@
|
||||
From 22b52db4842611ac31a356f023fc09595384e2ad Mon Sep 17 00:00:00 2001
|
||||
From: Khem Raj <raj.khem@gmail.com>
|
||||
Date: Thu, 23 May 2019 18:11:22 -0700
|
||||
Subject: [PATCH] mbim: add an optional TEMP_FAILURE_RETRY macro copy
|
||||
|
||||
Fixes build on musl which does not provide this macro
|
||||
|
||||
Upstream-Status: Submitted [https://lists.ofono.org/pipermail/ofono/2019-May/019370.html]
|
||||
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
||||
---
|
||||
drivers/mbimmodem/mbim-private.h | 9 +++++++++
|
||||
1 file changed, 9 insertions(+)
|
||||
|
||||
diff --git a/drivers/mbimmodem/mbim-private.h b/drivers/mbimmodem/mbim-private.h
|
||||
index e159235..51693ea 100644
|
||||
--- a/drivers/mbimmodem/mbim-private.h
|
||||
+++ b/drivers/mbimmodem/mbim-private.h
|
||||
@@ -21,6 +21,15 @@
|
||||
|
||||
#define align_len(len, boundary) (((len)+(boundary)-1) & ~((boundary)-1))
|
||||
|
||||
+#ifndef TEMP_FAILURE_RETRY
|
||||
+#define TEMP_FAILURE_RETRY(expression) ({ \
|
||||
+ __typeof(expression) __result; \
|
||||
+ do { \
|
||||
+ __result = (expression); \
|
||||
+ } while (__result == -1 && errno == EINTR); \
|
||||
+ __result; })
|
||||
+#endif
|
||||
+
|
||||
enum mbim_control_message {
|
||||
MBIM_OPEN_MSG = 0x1,
|
||||
MBIM_CLOSE_MSG = 0x2,
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
From 76e4054801350ebd4a44057379431a33d460ad0f Mon Sep 17 00:00:00 2001
|
||||
From: Martin Jansa <Martin.Jansa@gmail.com>
|
||||
Date: Wed, 21 Apr 2021 11:01:34 +0000
|
||||
Subject: [PATCH] mbim: Fix build with ell-0.39 by restoring unlikely macro
|
||||
from ell/util.h
|
||||
|
||||
Upstream-Status: Pending
|
||||
|
||||
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
|
||||
---
|
||||
drivers/mbimmodem/mbim-private.h | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/drivers/mbimmodem/mbim-private.h b/drivers/mbimmodem/mbim-private.h
|
||||
index 51693eae..d917312c 100644
|
||||
--- a/drivers/mbimmodem/mbim-private.h
|
||||
+++ b/drivers/mbimmodem/mbim-private.h
|
||||
@@ -30,6 +30,10 @@
|
||||
__result; })
|
||||
#endif
|
||||
|
||||
+/* used to be part of ell/util.h before 0.39:
|
||||
+ https://git.kernel.org/pub/scm/libs/ell/ell.git/commit/?id=2a682421b06e41c45098217a686157f576847021 */
|
||||
+#define unlikely(x) __builtin_expect(!!(x), 0)
|
||||
+
|
||||
enum mbim_control_message {
|
||||
MBIM_OPEN_MSG = 0x1,
|
||||
MBIM_CLOSE_MSG = 0x2,
|
||||
@@ -0,0 +1,38 @@
|
||||
From 9c7a7fe29605d3d8bb5c0cfcee21a8f01ab9f4aa Mon Sep 17 00:00:00 2001
|
||||
From: Denis Kenzior <denkenz@gmail.com>
|
||||
Date: Thu, 29 Feb 2024 11:18:25 -0600
|
||||
Subject: [PATCH 1/4] smsutil: ensure the address length in bytes <= 10
|
||||
|
||||
If a specially formatted SMS is received, it is conceivable that the
|
||||
address length might overflow the structure it is being parsed into.
|
||||
Ensure that the length in bytes of the address never exceeds 10.
|
||||
|
||||
CVE: CVE-2023-2794
|
||||
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=a90421d8e45d63b304dc010baba24633e7869682]
|
||||
|
||||
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
|
||||
---
|
||||
src/smsutil.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/smsutil.c b/src/smsutil.c
|
||||
index f46507f..d3844f3 100644
|
||||
--- a/src/smsutil.c
|
||||
+++ b/src/smsutil.c
|
||||
@@ -643,7 +643,12 @@ gboolean sms_decode_address_field(const unsigned char *pdu, int len,
|
||||
else
|
||||
byte_len = (addr_len + 1) / 2;
|
||||
|
||||
- if ((len - *offset) < byte_len)
|
||||
+ /*
|
||||
+ * 23.040:
|
||||
+ * The maximum length of the full address field
|
||||
+ * (AddressLength, TypeofAddress and AddressValue) is 12 octets.
|
||||
+ */
|
||||
+ if ((len - *offset) < byte_len || byte_len > 10)
|
||||
return FALSE;
|
||||
|
||||
out->number_type = bit_field(addr_type, 4, 3);
|
||||
--
|
||||
2.40.0
|
||||
@@ -0,0 +1,33 @@
|
||||
From 3f58f4f5260be9e9e46bc50382768563a5ce2bcd Mon Sep 17 00:00:00 2001
|
||||
From: Denis Kenzior <denkenz@gmail.com>
|
||||
Date: Thu, 29 Feb 2024 11:42:28 -0600
|
||||
Subject: [PATCH 2/4] smsutil: Check cbs_dcs_decode return value
|
||||
|
||||
It is better to explicitly check the return value of cbs_dcs_decode
|
||||
instead of relying on udhi not being changed due to side-effects.
|
||||
|
||||
CVE: CVE-2023-2794
|
||||
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=7f2adfa22fbae824f8e2c3ae86a3f51da31ee400]
|
||||
|
||||
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
|
||||
---
|
||||
src/smsutil.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/smsutil.c b/src/smsutil.c
|
||||
index d3844f3..cfa157a 100644
|
||||
--- a/src/smsutil.c
|
||||
+++ b/src/smsutil.c
|
||||
@@ -1765,7 +1765,8 @@ gboolean sms_udh_iter_init_from_cbs(const struct cbs *cbs,
|
||||
const guint8 *hdr;
|
||||
guint8 max_ud_len;
|
||||
|
||||
- cbs_dcs_decode(cbs->dcs, &udhi, NULL, NULL, NULL, NULL, NULL);
|
||||
+ if (!cbs_dcs_decode(cbs->dcs, &udhi, NULL, NULL, NULL, NULL, NULL))
|
||||
+ return FALSE;
|
||||
|
||||
if (!udhi)
|
||||
return FALSE;
|
||||
--
|
||||
2.40.0
|
||||
@@ -0,0 +1,45 @@
|
||||
From be0df9a74cecdf16c26f86bf88b29d823aa2a369 Mon Sep 17 00:00:00 2001
|
||||
From: Denis Kenzior <denkenz@gmail.com>
|
||||
Date: Thu, 29 Feb 2024 12:06:54 -0600
|
||||
Subject: [PATCH 3/4] simutil: Make sure set_length on the parent succeeds
|
||||
|
||||
CVE: CVE-2023-2794
|
||||
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=07f48b23e3877ef7d15a7b0b8b79d32ad0a3607e]
|
||||
|
||||
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
|
||||
---
|
||||
src/simutil.c | 11 ++++++-----
|
||||
1 file changed, 6 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/src/simutil.c b/src/simutil.c
|
||||
index 0354caf..218612b 100644
|
||||
--- a/src/simutil.c
|
||||
+++ b/src/simutil.c
|
||||
@@ -588,8 +588,9 @@ gboolean ber_tlv_builder_set_length(struct ber_tlv_builder *builder,
|
||||
if (new_pos > builder->max)
|
||||
return FALSE;
|
||||
|
||||
- if (builder->parent)
|
||||
- ber_tlv_builder_set_length(builder->parent, new_pos);
|
||||
+ if (builder->parent &&
|
||||
+ !ber_tlv_builder_set_length(builder->parent, new_pos))
|
||||
+ return FALSE;
|
||||
|
||||
builder->len = new_len;
|
||||
|
||||
@@ -730,9 +731,9 @@ gboolean comprehension_tlv_builder_set_length(
|
||||
if (builder->pos + new_ctlv_len > builder->max)
|
||||
return FALSE;
|
||||
|
||||
- if (builder->parent)
|
||||
- ber_tlv_builder_set_length(builder->parent,
|
||||
- builder->pos + new_ctlv_len);
|
||||
+ if (builder->parent && !ber_tlv_builder_set_length(builder->parent,
|
||||
+ builder->pos + new_ctlv_len))
|
||||
+ return FALSE;
|
||||
|
||||
len = MIN(builder->len, new_len);
|
||||
if (len > 0 && new_len_size != len_size)
|
||||
--
|
||||
2.40.0
|
||||
@@ -0,0 +1,128 @@
|
||||
From 44648c764268b6e9e4f1c4aec44782b494385fca Mon Sep 17 00:00:00 2001
|
||||
From: Denis Kenzior <denkenz@gmail.com>
|
||||
Date: Thu, 29 Feb 2024 17:16:00 -0600
|
||||
Subject: [PATCH 4/4] smsutil: Use a safer strlcpy
|
||||
|
||||
sms_address_from_string is meant as private API, to be used with string
|
||||
form addresses that have already been sanitized. However, to be safe,
|
||||
use a safe version of strcpy to avoid overflowing the buffer in case the
|
||||
input was not sanitized properly. While here, add a '__' prefix to the
|
||||
function name to help make it clearer that this API is private and
|
||||
should be used with more care.
|
||||
|
||||
CVE: CVE-2023-2794
|
||||
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=8fa1fdfcb54e1edb588c6a5e2688880b065a39c9]
|
||||
|
||||
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
|
||||
---
|
||||
src/smsutil.c | 14 +++++++-------
|
||||
src/smsutil.h | 2 +-
|
||||
unit/test-sms.c | 6 +++---
|
||||
3 files changed, 11 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/src/smsutil.c b/src/smsutil.c
|
||||
index cfa157a..def47e8 100644
|
||||
--- a/src/smsutil.c
|
||||
+++ b/src/smsutil.c
|
||||
@@ -1887,15 +1887,15 @@ time_t sms_scts_to_time(const struct sms_scts *scts, struct tm *remote)
|
||||
return ret;
|
||||
}
|
||||
|
||||
-void sms_address_from_string(struct sms_address *addr, const char *str)
|
||||
+void __sms_address_from_string(struct sms_address *addr, const char *str)
|
||||
{
|
||||
addr->numbering_plan = SMS_NUMBERING_PLAN_ISDN;
|
||||
if (str[0] == '+') {
|
||||
addr->number_type = SMS_NUMBER_TYPE_INTERNATIONAL;
|
||||
- strcpy(addr->address, str + 1);
|
||||
+ l_strlcpy(addr->address, str + 1, sizeof(addr->address));
|
||||
} else {
|
||||
addr->number_type = SMS_NUMBER_TYPE_UNKNOWN;
|
||||
- strcpy(addr->address, str);
|
||||
+ l_strlcpy(addr->address, str, sizeof(addr->address));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3086,7 +3086,7 @@ gboolean status_report_assembly_report(struct status_report_assembly *assembly,
|
||||
}
|
||||
}
|
||||
|
||||
- sms_address_from_string(&addr, straddr);
|
||||
+ __sms_address_from_string(&addr, straddr);
|
||||
|
||||
if (pending == TRUE && node->deliverable == TRUE) {
|
||||
/*
|
||||
@@ -3179,7 +3179,7 @@ void status_report_assembly_expire(struct status_report_assembly *assembly,
|
||||
while (g_hash_table_iter_next(&iter_addr, (gpointer) &straddr,
|
||||
(gpointer) &id_table)) {
|
||||
|
||||
- sms_address_from_string(&addr, straddr);
|
||||
+ __sms_address_from_string(&addr, straddr);
|
||||
g_hash_table_iter_init(&iter_node, id_table);
|
||||
|
||||
/* Go through different messages. */
|
||||
@@ -3473,7 +3473,7 @@ GSList *sms_datagram_prepare(const char *to,
|
||||
template.submit.vp.relative = 0xA7; /* 24 Hours */
|
||||
template.submit.dcs = 0x04; /* Class Unspecified, 8 Bit */
|
||||
template.submit.udhi = TRUE;
|
||||
- sms_address_from_string(&template.submit.daddr, to);
|
||||
+ __sms_address_from_string(&template.submit.daddr, to);
|
||||
|
||||
offset = 1;
|
||||
|
||||
@@ -3600,7 +3600,7 @@ GSList *sms_text_prepare_with_alphabet(const char *to, const char *utf8,
|
||||
template.submit.srr = use_delivery_reports;
|
||||
template.submit.mr = 0;
|
||||
template.submit.vp.relative = 0xA7; /* 24 Hours */
|
||||
- sms_address_from_string(&template.submit.daddr, to);
|
||||
+ __sms_address_from_string(&template.submit.daddr, to);
|
||||
|
||||
/* There are two enums for the same thing */
|
||||
dialect = (enum gsm_dialect)alphabet;
|
||||
diff --git a/src/smsutil.h b/src/smsutil.h
|
||||
index 01487de..bc21504 100644
|
||||
--- a/src/smsutil.h
|
||||
+++ b/src/smsutil.h
|
||||
@@ -487,7 +487,7 @@ int sms_udl_in_bytes(guint8 ud_len, guint8 dcs);
|
||||
time_t sms_scts_to_time(const struct sms_scts *scts, struct tm *remote);
|
||||
|
||||
const char *sms_address_to_string(const struct sms_address *addr);
|
||||
-void sms_address_from_string(struct sms_address *addr, const char *str);
|
||||
+void __sms_address_from_string(struct sms_address *addr, const char *str);
|
||||
|
||||
const guint8 *sms_extract_common(const struct sms *sms, gboolean *out_udhi,
|
||||
guint8 *out_dcs, guint8 *out_udl,
|
||||
diff --git a/unit/test-sms.c b/unit/test-sms.c
|
||||
index 154bb33..66755f3 100644
|
||||
--- a/unit/test-sms.c
|
||||
+++ b/unit/test-sms.c
|
||||
@@ -1603,7 +1603,7 @@ static void test_sr_assembly(void)
|
||||
sr3.status_report.mr);
|
||||
}
|
||||
|
||||
- sms_address_from_string(&addr, "+4915259911630");
|
||||
+ __sms_address_from_string(&addr, "+4915259911630");
|
||||
|
||||
sra = status_report_assembly_new(NULL);
|
||||
|
||||
@@ -1626,7 +1626,7 @@ static void test_sr_assembly(void)
|
||||
* Send sms-message in the national address-format,
|
||||
* but receive in the international address-format.
|
||||
*/
|
||||
- sms_address_from_string(&addr, "9911630");
|
||||
+ __sms_address_from_string(&addr, "9911630");
|
||||
status_report_assembly_add_fragment(sra, sha1, &addr, 4, time(NULL), 2);
|
||||
status_report_assembly_add_fragment(sra, sha1, &addr, 5, time(NULL), 2);
|
||||
|
||||
@@ -1641,7 +1641,7 @@ static void test_sr_assembly(void)
|
||||
* Send sms-message in the international address-format,
|
||||
* but receive in the national address-format.
|
||||
*/
|
||||
- sms_address_from_string(&addr, "+358123456789");
|
||||
+ __sms_address_from_string(&addr, "+358123456789");
|
||||
status_report_assembly_add_fragment(sra, sha1, &addr, 6, time(NULL), 1);
|
||||
|
||||
g_assert(status_report_assembly_report(sra, &sr3, id, &delivered));
|
||||
--
|
||||
2.40.0
|
||||
@@ -0,0 +1,31 @@
|
||||
From 2ff2da7ac374a790f8b2a0216bcb4e3126498225 Mon Sep 17 00:00:00 2001
|
||||
From: "Sicelo A. Mhlongo" <absicsz@gmail.com>
|
||||
Date: Wed, 4 Dec 2024 10:18:52 +0200
|
||||
Subject: [PATCH] smsutil: check status report fits in buffer
|
||||
|
||||
Fixes CVE-2023-4232
|
||||
|
||||
CVE: CVE-2023-4232
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=2ff2da7ac374a790f8b2a0216bcb4e3126498225]
|
||||
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
||||
---
|
||||
src/smsutil.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/smsutil.c b/src/smsutil.c
|
||||
index ac89f16c..a706e26f 100644
|
||||
--- a/src/smsutil.c
|
||||
+++ b/src/smsutil.c
|
||||
@@ -1088,6 +1088,9 @@ static gboolean decode_status_report(const unsigned char *pdu, int len,
|
||||
if ((len - offset) < expected)
|
||||
return FALSE;
|
||||
|
||||
+ if (expected > (int)sizeof(out->status_report.ud))
|
||||
+ return FALSE;
|
||||
+
|
||||
memcpy(out->status_report.ud, pdu + offset, expected);
|
||||
}
|
||||
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
From 02aa0f9bad3d9e47a152fc045d0f51874d901d7e Mon Sep 17 00:00:00 2001
|
||||
From: "Sicelo A. Mhlongo" <absicsz@gmail.com>
|
||||
Date: Wed, 4 Dec 2024 10:18:51 +0200
|
||||
Subject: [PATCH] smsutil: check deliver reports fit in buffer
|
||||
|
||||
Fixes CVE-2023-4235
|
||||
|
||||
CVE: CVE-2023-4235
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=02aa0f9bad3d9e47a152fc045d0f51874d901d7e]
|
||||
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
||||
---
|
||||
src/smsutil.c | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/src/smsutil.c b/src/smsutil.c
|
||||
index 484bfd0b..ac89f16c 100644
|
||||
--- a/src/smsutil.c
|
||||
+++ b/src/smsutil.c
|
||||
@@ -1240,10 +1240,16 @@ static gboolean decode_deliver_report(const unsigned char *pdu, int len,
|
||||
return FALSE;
|
||||
|
||||
if (out->type == SMS_TYPE_DELIVER_REPORT_ERROR) {
|
||||
+ if (expected > (int) sizeof(out->deliver_err_report.ud))
|
||||
+ return FALSE;
|
||||
+
|
||||
out->deliver_err_report.udl = udl;
|
||||
memcpy(out->deliver_err_report.ud,
|
||||
pdu + offset, expected);
|
||||
} else {
|
||||
+ if (expected > (int) sizeof(out->deliver_ack_report.ud))
|
||||
+ return FALSE;
|
||||
+
|
||||
out->deliver_ack_report.udl = udl;
|
||||
memcpy(out->deliver_ack_report.ud,
|
||||
pdu + offset, expected);
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@@ -0,0 +1,59 @@
|
||||
From e6d8d526d5077c0b6ab459efeb6b882c28e0fdeb Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Sun, 16 Mar 2025 12:26:42 +0200
|
||||
Subject: [PATCH] qmi: sms: Fix possible out-of-bounds read
|
||||
|
||||
Fixes: CVE-2024-7537
|
||||
|
||||
CVE: CVE-2024-7537
|
||||
Upstream-Status: Backport [https://web.git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=e6d8d526d5077c0b6ab459efeb6b882c28e0fdeb]
|
||||
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
||||
---
|
||||
drivers/qmimodem/sms.c | 13 ++++++++++---
|
||||
1 file changed, 10 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/drivers/qmimodem/sms.c b/drivers/qmimodem/sms.c
|
||||
index 3e2bef6e..75863480 100644
|
||||
--- a/drivers/qmimodem/sms.c
|
||||
+++ b/drivers/qmimodem/sms.c
|
||||
@@ -467,6 +467,8 @@ static void get_msg_list_cb(struct qmi_result *result, void *user_data)
|
||||
const struct qmi_wms_result_msg_list *list;
|
||||
uint32_t cnt = 0;
|
||||
uint16_t tmp;
|
||||
+ uint16_t length;
|
||||
+ size_t msg_size;
|
||||
|
||||
DBG("");
|
||||
|
||||
@@ -476,7 +478,7 @@ static void get_msg_list_cb(struct qmi_result *result, void *user_data)
|
||||
goto done;
|
||||
}
|
||||
|
||||
- list = qmi_result_get(result, QMI_WMS_RESULT_MSG_LIST, NULL);
|
||||
+ list = qmi_result_get(result, QMI_WMS_RESULT_MSG_LIST, &length);
|
||||
if (list == NULL) {
|
||||
DBG("Err: get msg list empty");
|
||||
goto done;
|
||||
@@ -485,6 +487,13 @@ static void get_msg_list_cb(struct qmi_result *result, void *user_data)
|
||||
cnt = GUINT32_FROM_LE(list->cnt);
|
||||
DBG("msgs found %d", cnt);
|
||||
|
||||
+ msg_size = cnt * sizeof(list->msg[0]);
|
||||
+
|
||||
+ if (length != sizeof(list->cnt) + msg_size) {
|
||||
+ DBG("Err: invalid msg list count");
|
||||
+ goto done;
|
||||
+ }
|
||||
+
|
||||
for (tmp = 0; tmp < cnt; tmp++) {
|
||||
DBG("unread type %d ndx %d", list->msg[tmp].type,
|
||||
GUINT32_FROM_LE(list->msg[tmp].ndx));
|
||||
@@ -498,8 +507,6 @@ static void get_msg_list_cb(struct qmi_result *result, void *user_data)
|
||||
|
||||
/* save list and get 1st msg */
|
||||
if (cnt) {
|
||||
- int msg_size = cnt * sizeof(list->msg[0]);
|
||||
-
|
||||
data->msg_list = g_try_malloc0(sizeof(list->cnt) + msg_size);
|
||||
if (data->msg_list == NULL)
|
||||
goto done;
|
||||
@@ -0,0 +1,88 @@
|
||||
From 389e2344f86319265fb72ae590b470716e038fdc Mon Sep 17 00:00:00 2001
|
||||
From: "Sicelo A. Mhlongo" <absicsz@gmail.com>
|
||||
Date: Tue, 17 Dec 2024 11:31:29 +0200
|
||||
Subject: [PATCH] ussd: ensure ussd content fits in buffers
|
||||
|
||||
Fixes: CVE-2024-7539
|
||||
|
||||
CVE: CVE-2024-7539
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=389e2344f86319265fb72ae590b470716e038fdc]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
drivers/atmodem/ussd.c | 5 ++++-
|
||||
drivers/huaweimodem/ussd.c | 5 ++++-
|
||||
drivers/speedupmodem/ussd.c | 5 ++++-
|
||||
3 files changed, 12 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/drivers/atmodem/ussd.c b/drivers/atmodem/ussd.c
|
||||
index aaf47b2..cee9bc5 100644
|
||||
--- a/drivers/atmodem/ussd.c
|
||||
+++ b/drivers/atmodem/ussd.c
|
||||
@@ -107,7 +107,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
const char *content;
|
||||
int dcs;
|
||||
enum sms_charset charset;
|
||||
- unsigned char msg[160];
|
||||
+ unsigned char msg[160] = {0};
|
||||
const unsigned char *msg_ptr = NULL;
|
||||
long msg_len;
|
||||
|
||||
@@ -127,6 +127,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
if (!g_at_result_iter_next_number(&iter, &dcs))
|
||||
dcs = 0;
|
||||
|
||||
+ if (strlen(content) > sizeof(msg) * 2)
|
||||
+ goto out;
|
||||
+
|
||||
if (!cbs_dcs_decode(dcs, NULL, NULL, &charset, NULL, NULL, NULL)) {
|
||||
ofono_error("Unsupported USSD data coding scheme (%02x)", dcs);
|
||||
status = 4; /* Not supported */
|
||||
diff --git a/drivers/huaweimodem/ussd.c b/drivers/huaweimodem/ussd.c
|
||||
index ffb9b2a..cfdb4ee 100644
|
||||
--- a/drivers/huaweimodem/ussd.c
|
||||
+++ b/drivers/huaweimodem/ussd.c
|
||||
@@ -52,7 +52,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
int status;
|
||||
int dcs = 0;
|
||||
const char *content;
|
||||
- unsigned char msg[160];
|
||||
+ unsigned char msg[160] = {0};
|
||||
const unsigned char *msg_ptr = NULL;
|
||||
long msg_len;
|
||||
|
||||
@@ -69,6 +69,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
|
||||
g_at_result_iter_next_number(&iter, &dcs);
|
||||
|
||||
+ if (strlen(content) > sizeof(msg) * 2)
|
||||
+ goto out;
|
||||
+
|
||||
msg_ptr = decode_hex_own_buf(content, -1, &msg_len, 0, msg);
|
||||
|
||||
out:
|
||||
diff --git a/drivers/speedupmodem/ussd.c b/drivers/speedupmodem/ussd.c
|
||||
index 44da8ed..33441c6 100644
|
||||
--- a/drivers/speedupmodem/ussd.c
|
||||
+++ b/drivers/speedupmodem/ussd.c
|
||||
@@ -51,7 +51,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
int status;
|
||||
int dcs = 0;
|
||||
const char *content;
|
||||
- unsigned char msg[160];
|
||||
+ unsigned char msg[160] = {0};
|
||||
const unsigned char *msg_ptr = NULL;
|
||||
long msg_len;
|
||||
|
||||
@@ -68,6 +68,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
||||
|
||||
g_at_result_iter_next_number(&iter, &dcs);
|
||||
|
||||
+ if (strlen(content) > sizeof(msg) * 2)
|
||||
+ goto out;
|
||||
+
|
||||
msg_ptr = decode_hex_own_buf(content, -1, &msg_len, 0, msg);
|
||||
|
||||
out:
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
From 29ff6334b492504ace101be748b256e6953d2c2f Mon Sep 17 00:00:00 2001
|
||||
From: "Sicelo A. Mhlongo" <absicsz@gmail.com>
|
||||
Date: Tue, 17 Dec 2024 11:31:28 +0200
|
||||
Subject: [PATCH] atmodem: sms: ensure buffer is initialized before use
|
||||
|
||||
Fixes: CVE-2024-7540
|
||||
Fixes: CVE-2024-7541
|
||||
Fixes: CVE-2024-7542
|
||||
|
||||
CVE: CVE-2024-7540
|
||||
CVE: CVE-2024-7541
|
||||
CVE: CVE-2024-7542
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=29ff6334b492504ace101be748b256e6953d2c2f]
|
||||
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
||||
---
|
||||
drivers/atmodem/sms.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/drivers/atmodem/sms.c b/drivers/atmodem/sms.c
|
||||
index d994856b..0668c631 100644
|
||||
--- a/drivers/atmodem/sms.c
|
||||
+++ b/drivers/atmodem/sms.c
|
||||
@@ -412,7 +412,7 @@ static void at_cmt_notify(GAtResult *result, gpointer user_data)
|
||||
struct sms_data *data = ofono_sms_get_data(sms);
|
||||
GAtResultIter iter;
|
||||
const char *hexpdu;
|
||||
- unsigned char pdu[176];
|
||||
+ unsigned char pdu[176] = {0};
|
||||
long pdu_len;
|
||||
int tpdu_len;
|
||||
|
||||
@@ -479,7 +479,7 @@ static void at_cmgr_notify(GAtResult *result, gpointer user_data)
|
||||
struct sms_data *data = ofono_sms_get_data(sms);
|
||||
GAtResultIter iter;
|
||||
const char *hexpdu;
|
||||
- unsigned char pdu[176];
|
||||
+ unsigned char pdu[176] = {0};
|
||||
long pdu_len;
|
||||
int tpdu_len;
|
||||
|
||||
@@ -661,7 +661,7 @@ static void at_cmgl_notify(GAtResult *result, gpointer user_data)
|
||||
struct sms_data *data = ofono_sms_get_data(sms);
|
||||
GAtResultIter iter;
|
||||
const char *hexpdu;
|
||||
- unsigned char pdu[176];
|
||||
+ unsigned char pdu[176] = {0};
|
||||
long pdu_len;
|
||||
int tpdu_len;
|
||||
int index;
|
||||
--
|
||||
2.30.2
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
From 90e60ada012de42964214d8155260f5749d0dcc7 Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Tue, 3 Dec 2024 21:43:50 +0200
|
||||
Subject: [PATCH] stkutil: Fix CVE-2024-7543
|
||||
|
||||
CVE: CVE-2024-7543
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=90e60ada012de42964214d8155260f5749d0dcc7]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/stkutil.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/stkutil.c b/src/stkutil.c
|
||||
index 4f31af4..fdd11ad 100644
|
||||
--- a/src/stkutil.c
|
||||
+++ b/src/stkutil.c
|
||||
@@ -1876,6 +1876,10 @@ static bool parse_dataobj_mms_reference(struct comprehension_tlv_iter *iter,
|
||||
|
||||
data = comprehension_tlv_iter_get_data(iter);
|
||||
mr->len = len;
|
||||
+
|
||||
+ if (len > sizeof(mr->ref))
|
||||
+ return false;
|
||||
+
|
||||
memcpy(mr->ref, data, len);
|
||||
|
||||
return true;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
From a240705a0d5d41eca6de4125ab2349ecde4c873a Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Tue, 3 Dec 2024 21:43:49 +0200
|
||||
Subject: [PATCH] stkutil: Fix CVE-2024-7544
|
||||
|
||||
CVE: CVE-2024-7544
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=a240705a0d5d41eca6de4125ab2349ecde4c873a]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/stkutil.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/stkutil.c b/src/stkutil.c
|
||||
index fdd11ad..475caaa 100644
|
||||
--- a/src/stkutil.c
|
||||
+++ b/src/stkutil.c
|
||||
@@ -1898,6 +1898,10 @@ static bool parse_dataobj_mms_id(struct comprehension_tlv_iter *iter,
|
||||
|
||||
data = comprehension_tlv_iter_get_data(iter);
|
||||
mi->len = len;
|
||||
+
|
||||
+ if (len > sizeof(mi->id))
|
||||
+ return false;
|
||||
+
|
||||
memcpy(mi->id, data, len);
|
||||
|
||||
return true;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
From 556e14548c38c2b96d85881542046ee7ed750bb5 Mon Sep 17 00:00:00 2001
|
||||
From: Sicelo A. Mhlongo <absicsz@gmail.com>
|
||||
Date: Wed, Dec 4 12:07:34 2024 +0200
|
||||
Subject: [PATCH] stkutil: ensure data fits in buffer
|
||||
|
||||
Fixes CVE-2024-7545
|
||||
|
||||
CVE: CVE-2024-7545
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=556e14548c38c2b96d85881542046ee7ed750bb5]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/stkutil.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/stkutil.c b/src/stkutil.c
|
||||
index 475caaa..e1fd75c 100644
|
||||
--- a/src/stkutil.c
|
||||
+++ b/src/stkutil.c
|
||||
@@ -1938,6 +1938,10 @@ static bool parse_dataobj_mms_content_id(
|
||||
|
||||
data = comprehension_tlv_iter_get_data(iter);
|
||||
mci->len = len;
|
||||
+
|
||||
+ if (len > sizeof(mci->id))
|
||||
+ return false;
|
||||
+
|
||||
memcpy(mci->id, data, len);
|
||||
|
||||
return true;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
From 79ea6677669e50b0bb9c231765adb4f81c375f63 Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Tue, 3 Dec 2024 21:43:52 +0200
|
||||
Subject: [PATCH] Fix CVE-2024-7546
|
||||
|
||||
CVE: CVE-2024-7546
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=79ea6677669e50b0bb9c231765adb4f81c375f63]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/stkutil.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/src/stkutil.c b/src/stkutil.c
|
||||
index e1fd75c..88a715d 100644
|
||||
--- a/src/stkutil.c
|
||||
+++ b/src/stkutil.c
|
||||
@@ -1783,6 +1783,10 @@ static bool parse_dataobj_frame_layout(struct comprehension_tlv_iter *iter,
|
||||
|
||||
fl->layout = data[0];
|
||||
fl->len = len - 1;
|
||||
+
|
||||
+ if (fl->len > sizeof(fl->size))
|
||||
+ return false;
|
||||
+
|
||||
memcpy(fl->size, data + 1, fl->len);
|
||||
|
||||
return true;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -0,0 +1,29 @@
|
||||
From 305df050d02aea8532f7625d6642685aa530f9b0 Mon Sep 17 00:00:00 2001
|
||||
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
|
||||
Date: Tue, 3 Dec 2024 21:43:51 +0200
|
||||
Subject: [PATCH] Fix CVE-2024-7547
|
||||
|
||||
CVE: CVE-2024-7547
|
||||
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=305df050d02aea8532f7625d6642685aa530f9b0]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
src/smsutil.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/smsutil.c b/src/smsutil.c
|
||||
index def47e8..f79f59d 100644
|
||||
--- a/src/smsutil.c
|
||||
+++ b/src/smsutil.c
|
||||
@@ -1475,6 +1475,9 @@ static gboolean decode_command(const unsigned char *pdu, int len,
|
||||
if ((len - offset) < out->command.cdl)
|
||||
return FALSE;
|
||||
|
||||
+ if (out->command.cdl > sizeof(out->command.cd))
|
||||
+ return FALSE;
|
||||
+
|
||||
memcpy(out->command.cd, pdu + offset, out->command.cdl);
|
||||
|
||||
return TRUE;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
42
sources/poky/meta/recipes-connectivity/ofono/ofono/ofono
Normal file
42
sources/poky/meta/recipes-connectivity/ofono/ofono/ofono
Normal file
@@ -0,0 +1,42 @@
|
||||
#!/bin/sh
|
||||
|
||||
DAEMON=/usr/sbin/ofonod
|
||||
PIDFILE=/var/run/ofonod.pid
|
||||
DESC="Telephony daemon"
|
||||
|
||||
if [ -f /etc/default/ofono ] ; then
|
||||
. /etc/default/ofono
|
||||
fi
|
||||
|
||||
set -e
|
||||
|
||||
do_start() {
|
||||
$DAEMON
|
||||
}
|
||||
|
||||
do_stop() {
|
||||
start-stop-daemon --stop --name ofonod --quiet
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
echo "Starting $DESC"
|
||||
do_start
|
||||
;;
|
||||
stop)
|
||||
echo "Stopping $DESC"
|
||||
do_stop
|
||||
;;
|
||||
restart|force-reload)
|
||||
echo "Restarting $DESC"
|
||||
do_stop
|
||||
sleep 1
|
||||
do_start
|
||||
;;
|
||||
*)
|
||||
echo "Usage: $0 {start|stop|restart|force-reload}" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
exit 0
|
||||
69
sources/poky/meta/recipes-connectivity/ofono/ofono_2.4.bb
Normal file
69
sources/poky/meta/recipes-connectivity/ofono/ofono_2.4.bb
Normal file
@@ -0,0 +1,69 @@
|
||||
SUMMARY = "open source telephony"
|
||||
DESCRIPTION = "oFono is a stack for mobile telephony devices on Linux. oFono supports speaking to telephony devices through specific drivers, or with generic AT commands."
|
||||
HOMEPAGE = "http://www.ofono.org"
|
||||
BUGTRACKER = "https://01.org/jira/browse/OF"
|
||||
LICENSE = "GPL-2.0-only"
|
||||
LIC_FILES_CHKSUM = "file://COPYING;md5=eb723b61539feef013de476e68b5c50a \
|
||||
file://src/ofono.h;beginline=1;endline=20;md5=3ce17d5978ef3445def265b98899c2ee"
|
||||
DEPENDS = "dbus glib-2.0 udev mobile-broadband-provider-info ell"
|
||||
|
||||
SRC_URI = "\
|
||||
${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \
|
||||
file://ofono \
|
||||
file://0001-mbim-add-an-optional-TEMP_FAILURE_RETRY-macro-copy.patch \
|
||||
file://0002-mbim-Fix-build-with-ell-0.39-by-restoring-unlikely-m.patch \
|
||||
file://CVE-2023-2794-0001.patch \
|
||||
file://CVE-2023-2794-0002.patch \
|
||||
file://CVE-2023-2794-0003.patch \
|
||||
file://CVE-2023-2794-0004.patch \
|
||||
file://CVE-2024-7539.patch \
|
||||
file://CVE-2024-7543.patch \
|
||||
file://CVE-2024-7544.patch \
|
||||
file://CVE-2024-7545.patch \
|
||||
file://CVE-2024-7546.patch \
|
||||
file://CVE-2024-7547.patch \
|
||||
file://CVE-2024-7540_CVE-2024-7541_CVE-2024-7542.patch \
|
||||
file://CVE-2023-4232.patch \
|
||||
file://CVE-2023-4235.patch \
|
||||
file://CVE-2024-7537.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "93580adc1afd1890dc516efb069de0c5cdfef014415256ddfb28ab172df2d11d"
|
||||
|
||||
inherit autotools pkgconfig update-rc.d systemd gobject-introspection-data
|
||||
|
||||
INITSCRIPT_NAME = "ofono"
|
||||
INITSCRIPT_PARAMS = "defaults 22"
|
||||
SYSTEMD_SERVICE:${PN} = "ofono.service"
|
||||
|
||||
PACKAGECONFIG ??= "\
|
||||
${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
|
||||
${@bb.utils.contains('DISTRO_FEATURES', 'bluetooth', 'bluez', '', d)} \
|
||||
"
|
||||
PACKAGECONFIG[systemd] = "--with-systemdunitdir=${systemd_system_unitdir}/,--with-systemdunitdir="
|
||||
PACKAGECONFIG[bluez] = "--enable-bluetooth, --disable-bluetooth, bluez5"
|
||||
|
||||
EXTRA_OECONF += "--enable-test --enable-external-ell"
|
||||
|
||||
do_configure:prepend() {
|
||||
bbnote "Removing bundled ell from ${S}/ell to prevent including it"
|
||||
rm -rf ${S}/ell
|
||||
}
|
||||
|
||||
do_install:append() {
|
||||
install -d ${D}${sysconfdir}/init.d/
|
||||
install -m 0755 ${WORKDIR}/ofono ${D}${sysconfdir}/init.d/ofono
|
||||
}
|
||||
|
||||
PACKAGES =+ "${PN}-tests"
|
||||
|
||||
FILES:${PN} += "${systemd_unitdir}"
|
||||
FILES:${PN}-tests = "${libdir}/${BPN}/test"
|
||||
|
||||
RDEPENDS:${PN} += "dbus"
|
||||
RDEPENDS:${PN}-tests = "\
|
||||
python3-core \
|
||||
python3-dbus \
|
||||
${@bb.utils.contains('GI_DATA_ENABLED', 'True', 'python3-pygobject', '', d)} \
|
||||
"
|
||||
|
||||
RRECOMMENDS:${PN} += "kernel-module-tun mobile-broadband-provider-info"
|
||||
Reference in New Issue
Block a user