diff mbox series

[meta-networking,7/11] sngrep: upgrade 1.8.4 -> 1.9.0

Message ID 20261107101154.2992152-7-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-gnome,1/11] evolution-data-server: upgrade 3.62.0 -> 3.62.1 | expand

Commit Message

Ankur Tyagi Nov. 7, 2026, 10:11 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Dropped patch that is part of the upstream version

Changelog:
https://github.com/irontec/sngrep/releases/tag/v1.9.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../sngrep/sngrep/CVE-2026-90558.patch        | 84 -------------------
 .../{sngrep_1.8.4.bb => sngrep_1.9.0.bb}      |  3 +-
 2 files changed, 1 insertion(+), 86 deletions(-)
 delete mode 100644 meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch
 rename meta-networking/recipes-support/sngrep/{sngrep_1.8.4.bb => sngrep_1.9.0.bb} (93%)
diff mbox series

Patch

diff --git a/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch
deleted file mode 100644
index 64fd8044a9..0000000000
--- a/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch
+++ /dev/null
@@ -1,84 +0,0 @@ 
-From 399346a12ca3bcf7703734fa33b5b3427775b014 Mon Sep 17 00:00:00 2001
-From: Kaian <kaian@irontec.com>
-Date: Fri, 7 Aug 2026 08:45:42 +0200
-Subject: [PATCH] fix: prevent stack buffer overflow in SIP attribute
- formatting
-
-call_get_attribute() formatted the Call-ID, X-Call-ID and Reason header
-text with an unbounded sprintf("%s"). Call-ID/X-Call-ID can hold up to
-MAX_CALLID_SIZE/MAX_XCALLID_SIZE (1023 bytes) and Reason text is copied
-from the raw payload (up to MAX_SIP_PAYLOAD), while all callers pass a
-255-byte SIP_ATTR_MAXLEN stack buffer (call list rendering, sort compare).
-A SIP message with a long Call-ID, X-Call-ID or Reason header overflowed
-the stack, triggerable via pcap, live capture or HEP/EEP remote capture.
-
-Bound these writes with "%.*s" and SIP_ATTR_MAXLEN - 1. Also fix a
-matching off-by-one in msg_get_attribute(), where the existing "%.*s"
-used SIP_ATTR_MAXLEN as the precision and could write 256 bytes
-(255 chars + NUL) into the 255-byte buffer.
-
-Thanks to TristanInSec for reporting the issue.
-
-(cherry picked from commit 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b)
-
-CVE: CVE-2026-90558
-Upstream-Status: Backport [https://github.com/irontec/sngrep/commit/1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b]
-
-SIP contract change was dropped during backport as it was introduced in
-v1.8.4[1]
-
-[1]https://github.com/irontec/sngrep/commit/c61a26d90c166f996e31aceefc9c2f8f831ccd86
-
-Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
----
- src/sip_call.c | 6 +++---
- src/sip_msg.c  | 6 +++---
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/src/sip_call.c b/src/sip_call.c
-index bea879a..68ecb50 100644
---- a/src/sip_call.c
-+++ b/src/sip_call.c
-@@ -257,10 +257,10 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value)
-             sprintf(value, "%d", call->index);
-             break;
-         case SIP_ATTR_CALLID:
--            sprintf(value, "%s", call->callid);
-+            sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->callid);
-             break;
-         case SIP_ATTR_XCALLID:
--            sprintf(value, "%s", call->xcallid);
-+            sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->xcallid);
-             break;
-         case SIP_ATTR_MSGCNT:
-             sprintf(value, "%d", vector_count(call->msgs));
-@@ -282,7 +282,7 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value)
-             break;
-         case SIP_ATTR_REASON_TXT:
-             if (call->reasontxt)
--                sprintf(value, "%s", call->reasontxt);
-+                sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->reasontxt);
-             break;
-         case SIP_ATTR_WARNING:
-             if (call->warning)
-diff --git a/src/sip_msg.c b/src/sip_msg.c
-index 379a40a..6762862 100644
---- a/src/sip_msg.c
-+++ b/src/sip_msg.c
-@@ -136,13 +136,13 @@ msg_get_attribute(sip_msg_t *msg, int id, char *value)
-             }
-             break;
-         case SIP_ATTR_METHOD:
--            sprintf(value, "%.*s", SIP_ATTR_MAXLEN, sip_get_msg_reqresp_str(msg));
-+            sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, sip_get_msg_reqresp_str(msg));
-             break;
-         case SIP_ATTR_SIPFROM:
--            sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_from);
-+            sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_from);
-             break;
-         case SIP_ATTR_SIPTO:
--            sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_to);
-+            sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_to);
-             break;
-         case SIP_ATTR_SIPFROMUSER:
-             if (msg->sip_from && (ar = strchr(msg->sip_from, '@'))) {
diff --git a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb b/meta-networking/recipes-support/sngrep/sngrep_1.9.0.bb
similarity index 93%
rename from meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb
rename to meta-networking/recipes-support/sngrep/sngrep_1.9.0.bb
index c7457fd0c0..43eece2b51 100644
--- a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb
+++ b/meta-networking/recipes-support/sngrep/sngrep_1.9.0.bb
@@ -16,9 +16,8 @@  DEPENDS = "\
 "
 
 SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV} \
-           file://CVE-2026-90558.patch \
 "
-SRCREV = "9c370866afaf5ccb258bf03848b2d22f30cf61bd"
+SRCREV = "76b19854eea88bb0ca6df64f33fe8bec08130e6f"
 
 inherit cmake pkgconfig