new file mode 100644
@@ -0,0 +1,97 @@
+From 0ea4200f04ab2a823a718f48b8f853328858fcc9 Mon Sep 17 00:00:00 2001
+From: Sarah Larsen <swlarsen@es.net>
+Date: Wed, 25 Jun 2025 15:11:03 +0000
+Subject: [PATCH] Fix off-by-one heap overflow in auth.
+
+Reported by Han Lee (Apple Information Security)
+CVE-2025-54349
+
+CVE: CVE-2025-54349
+Upstream-Status: Backport [https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf]
+Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
+---
+ src/iperf_auth.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/src/iperf_auth.c b/src/iperf_auth.c
+index 72e85fc..86b4eba 100644
+--- a/src/iperf_auth.c
++++ b/src/iperf_auth.c
+@@ -288,6 +288,7 @@ int encrypt_rsa_message(const char *plaintext, EVP_PKEY *public_key, unsigned ch
+ }
+
+ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedtext_len, EVP_PKEY *private_key, unsigned char **plaintext, int use_pkcs1_padding) {
++ int ret =0;
+ #if OPENSSL_VERSION_MAJOR >= 3
+ EVP_PKEY_CTX *ctx;
+ #else
+@@ -310,7 +311,8 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
+ keysize = RSA_size(rsa);
+ #endif
+ rsa_buffer = OPENSSL_malloc(keysize * 2);
+- *plaintext = (unsigned char*)OPENSSL_malloc(keysize);
++ // Note: +1 for NULL
++ *plaintext = (unsigned char*)OPENSSL_malloc(keysize + 1);
+
+ BIO *bioBuff = BIO_new_mem_buf((void*)encryptedtext, encryptedtext_len);
+ rsa_buffer_len = BIO_read(bioBuff, rsa_buffer, keysize * 2);
+@@ -320,13 +322,15 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
+ padding = RSA_PKCS1_PADDING;
+ }
+ #if OPENSSL_VERSION_MAJOR >= 3
++
+ plaintext_len = keysize;
+ EVP_PKEY_decrypt_init(ctx);
+- int ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
++
++ ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
+ if (ret < 0){
+ goto errreturn;
+ }
+- EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len);
++ ret = EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len);
+ EVP_PKEY_CTX_free(ctx);
+ #else
+ plaintext_len = RSA_private_decrypt(rsa_buffer_len, rsa_buffer, *plaintext, rsa, padding);
+@@ -337,7 +341,7 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
+ BIO_free(bioBuff);
+
+ /* Treat a decryption error as an empty string. */
+- if (plaintext_len < 0) {
++ if (plaintext_len <= 0) {
+ plaintext_len = 0;
+ }
+
+@@ -386,24 +390,28 @@ int decode_auth_setting(int enable_debug, const char *authtoken, EVP_PKEY *priva
+ int plaintext_len;
+ plaintext_len = decrypt_rsa_message(encrypted_b64, encrypted_len_b64, private_key, &plaintext, use_pkcs1_padding);
+ free(encrypted_b64);
+- if (plaintext_len < 0) {
++ if (plaintext_len <= 0) {
+ return -1;
+ }
++
+ plaintext[plaintext_len] = '\0';
+
+ char *s_username, *s_password;
+ s_username = (char *) calloc(plaintext_len, sizeof(char));
+ if (s_username == NULL) {
++ OPENSSL_free(plaintext);
+ return -1;
+ }
+ s_password = (char *) calloc(plaintext_len, sizeof(char));
+ if (s_password == NULL) {
++ OPENSSL_free(plaintext);
+ free(s_username);
+ return -1;
+ }
+
+ int rc = sscanf((char *) plaintext, auth_text_format, s_username, s_password, &utc_seconds);
+ if (rc != 3) {
++ OPENSSL_free(plaintext);
+ free(s_password);
+ free(s_username);
+ return -1;
+--
+2.50.0
+
@@ -15,6 +15,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=f9873a72f714e240530e759e103ac7b2"
SRC_URI = "git://github.com/esnet/iperf.git;branch=master;protocol=https \
file://0002-Remove-pg-from-profile_CFLAGS.patch \
file://0001-configure.ac-check-for-CPP-prog.patch \
+ file://CVE-2025-54349.patch \
"
SRCREV = "2a2984488d6de8f7a2d1f5938e03ca7be57e227c"