package/net-tools: fix regression introduced by CVE fix

Commit [1] backported an upstream patch to address CVE-2025-46836 that
included a regression.
Upstream later fixed this regression in commit [2].

This patch add that fix to correct the issue introduced by the original
patch.

[1] 323aaa9f54 package/net-tools: add upstream security fix for CVE-2025-46836
[2] ddb0e375fb/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d3274210f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2025-07-01 17:34:48 +02:00
parent ab2b4f5a06
commit 0bccce3848
2 changed files with 31 additions and 0 deletions

View File

@@ -0,0 +1,30 @@
From ddb0e375fb9ca95bb69335540b85bbdaa2714348 Mon Sep 17 00:00:00 2001
From: Bernd Eckenfels <net-tools@lina.inka.de>
Date: Sat, 17 May 2025 21:53:23 +0200
Subject: [PATCH] Interface statistic regression after 7a8f42fb2
CVE: CVE-2025-46836
Upstream: https://sourceforge.net/p/net-tools/code/ci/ddb0e375fb9ca95bb69335540b85bbdaa2714348/
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
lib/interface.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/lib/interface.c b/lib/interface.c
index a054f12..ca4adf1 100644
--- a/lib/interface.c
+++ b/lib/interface.c
@@ -239,12 +239,11 @@ static const char *get_name(char *name, const char *p)
/* copy the digits */
while (*p && isdigit((unsigned char)*p) && dst < end)
*dst++ = *p++;
-
- if (*p == ':') /* consume trailing colon */
- ++p;
} else { /* if so treat as normal */
p = dot;
}
+ if (*p == ':') /* consume trailing colon */
+ ++p;
break; /* interface name ends here */
}

View File

@@ -13,6 +13,7 @@ NET_TOOLS_LICENSE_FILES = COPYING
NET_TOOLS_CPE_ID_VALID = YES
# 0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
# 0002-CVE-2025-46836-interface-statistic-regression.patch
NET_TOOLS_IGNORE_CVES += CVE-2025-46836
define NET_TOOLS_CONFIGURE_CMDS