backport community PR:Fix off-by-one overflow in the IP protocol table-nmap-AtomGit

已开启

backport community PR:Fix off-by-one overflow in the IP protocol table #77

Yang Li创建于 2025年6月23日从refs/pull/77/head 合入到 openEuler-24.03-LTS-Next

backport community PR:Fix off-by-one overflow in the IP protocol table #77

已开启

Yang Li创建于 2025年6月23日

从refs/pull/77/head合入到openEuler-24.03-LTS-Next

共 2 个文件变更+139-1

Abackport-Fix-off-by-one-overflow-in-the-IP-protocol-table.patch+131-0

@@ -0,0 +1,131 @@
	1	+diff --git a/portlist.cc b/portlist.cc
	2	+index fb237f0..89a757e 100644
	3	+--- a/portlist.cc
	4	++++ b/portlist.cc
	5	+@@ -479,7 +479,7 @@ void PortList::setPortState(u16 portno, u8 protocol, int state) {
	6	+ state != PORT_CLOSEDFILTERED)
	7	+ fatal("%s: attempt to add port number %d with illegal state %d\n", __func__, portno, state);
	8	+
	9	+- assert(protocol!=IPPROTO_IP \|\| portno<256);
	10	++ assert(protocol!=IPPROTO_IP \|\| portno<=MAX_IPPROTONUM);
	11	+
	12	+ oldport = lookupPort(portno, protocol);
	13	+ if (oldport != NULL) {
	14	+@@ -564,7 +564,7 @@ Port PortList::nextPort(const Port cur, Port *next,
	15	+ if (cur) {
	16	+ proto = INPROTO2PORTLISTPROTO(cur->proto);
	17	+ assert(port_map[proto]!=NULL); // Hmm, it's not possible to handle port that doesn't have anything in map
	18	+- assert(cur->proto!=IPPROTO_IP \|\| cur->portno<256);
	19	++ assert(cur->proto!=IPPROTO_IP \|\| cur->portno<=MAX_IPPROTONUM);
	20	+ mapped_pno = port_map[proto][cur->portno];
	21	+ mapped_pno++; // we're interested in next port after current
	22	+ } else { // running for the first time
	23	+@@ -613,7 +613,7 @@ void PortList::mapPort(u16 portno, u8 protocol) const {
	24	+ mapped_protocol = INPROTO2PORTLISTPROTO(*protocol);
	25	+
	26	+ if (*protocol == IPPROTO_IP)
	27	+- assert(*portno < 256);
	28	++ assert(*portno <= MAX_IPPROTONUM);
	29	+ if(port_map[mapped_protocol]==NULL \|\| port_list[mapped_protocol]==NULL) {
	30	+ fatal("%s(%i,%i): you're trying to access uninitialized protocol", __func__, portno, protocol);
	31	+ }
	32	+@@ -709,7 +709,7 @@ int PortList::port_list_count[PORTLIST_PROTO_MAX];
	33	+ * should be sorted. */
	34	+ void PortList::initializePortMap(int protocol, u16 *ports, int portcount) {
	35	+ int i;
	36	+- int ports_max = (protocol == IPPROTO_IP) ? 256 : 65536;
	37	++ int ports_max = (protocol == IPPROTO_IP) ? MAX_IPPROTONUM + 1 : 65536;
	38	+ int proto = INPROTO2PORTLISTPROTO(protocol);
	39	+
	40	+ if (port_map[proto] != NULL \|\| port_map_rev[proto] != NULL)
	41	+diff --git a/protocols.cc b/protocols.cc
	42	+index 6793c90..a3d4bd4 100644
	43	+--- a/protocols.cc
	44	++++ b/protocols.cc
	45	+@@ -78,7 +78,7 @@ struct strcmp_comparator {
	46	+
	47	+ // IP Protocol number is 8 bits wide
	48	+ // protocol_table[IPPROTO_TCP] == {"tcp", 6}
	49	+-static struct nprotoent *protocol_table[UCHAR_MAX];
	50	++static struct nprotoent *protocol_table[MAX_IPPROTONUM + 1];
	51	+ // proto_map["tcp"] = {"tcp", 6}
	52	+ typedef std::map<const char *, struct nprotoent, strcmp_comparator> ProtoMap;
	53	+ static ProtoMap proto_map;
	54	+@@ -118,7 +118,7 @@ static int nmap_protocols_init() {
	55	+ if (p == '#' \|\| p == '\0')
	56	+ continue;
	57	+ res = sscanf(line, "%127s %hu", protocolname, &protno);
	58	+- if (res !=2 \|\| protno > UCHAR_MAX) {
	59	++ if (res !=2 \|\| protno > MAX_IPPROTONUM) {
	60	+ error("Parse error in protocols file %s line %d", filename, lineno);
	61	+ continue;
	62	+ }
	63	+@@ -190,7 +190,7 @@ const struct nprotoent *nmap_getprotbynum(int num) {
	64	+ if (nmap_protocols_init() == -1)
	65	+ return NULL;
	66	+
	67	+- assert(num >= 0 && num < UCHAR_MAX);
	68	++ assert(num >= 0 && num <= MAX_IPPROTONUM);
	69	+ return protocol_table[num];
	70	+ }
	71	+
	72	+diff --git a/protocols.h b/protocols.h
	73	+index 9b9dd15..fe7ba6e 100644
	74	+--- a/protocols.h
	75	++++ b/protocols.h
	76	+@@ -78,6 +78,8 @@ int addprotocolsfromservmask(char mask, u8 porttbl);
	77	+ const struct nprotoent *nmap_getprotbynum(int num);
	78	+ const struct nprotoent nmap_getprotbyname(const char name);
	79	+
	80	++#define MAX_IPPROTONUM 255
	81	++
	82	+ #define MAX_IPPROTOSTRLEN 4
	83	+ #define IPPROTO2STR(p) \
	84	+ ((p)==IPPROTO_TCP ? "tcp" : \
	85	+diff --git a/scan_lists.cc b/scan_lists.cc
	86	+index 8d5e345..fb6e371 100644
	87	+--- a/scan_lists.cc
	88	++++ b/scan_lists.cc
	89	+@@ -164,7 +164,7 @@ void getpts(const char origexpr, struct scan_lists ports) {
	90	+ ports->udp_count++;
	91	+ if (porttbl[i] & SCAN_SCTP_PORT)
	92	+ ports->sctp_count++;
	93	+- if (porttbl[i] & SCAN_PROTOCOLS && i < 256)
	94	++ if (porttbl[i] & SCAN_PROTOCOLS && i <= MAX_IPPROTONUM)
	95	+ ports->prot_count++;
	96	+ }
	97	+
	98	+@@ -191,7 +191,7 @@ void getpts(const char origexpr, struct scan_lists ports) {
	99	+ ports->udp_ports[udpi++] = i;
	100	+ if (porttbl[i] & SCAN_SCTP_PORT)
	101	+ ports->sctp_ports[sctpi++] = i;
	102	+- if (porttbl[i] & SCAN_PROTOCOLS && i < 256)
	103	++ if (porttbl[i] & SCAN_PROTOCOLS && i <= MAX_IPPROTONUM)
	104	+ ports->prots[proti++] = i;
	105	+ }
	106	+
	107	+@@ -387,7 +387,7 @@ static void getpts_aux(const char origexpr, int nested, u8 porttbl, int range_
	108	+ } else if (isdigit((int) (unsigned char) *current_range)) {
	109	+ rangestart = strtol(current_range, &endptr, 10);
	110	+ if (range_type & SCAN_PROTOCOLS) {
	111	+- if (rangestart < 0 \|\| rangestart > 255)
	112	++ if (rangestart < 0 \|\| rangestart > MAX_IPPROTONUM)
	113	+ fatal("Protocols specified must be between 0 and 255 inclusive");
	114	+ } else {
	115	+ if (rangestart < 0 \|\| rangestart > 65535)
	116	+@@ -428,13 +428,13 @@ static void getpts_aux(const char origexpr, int nested, u8 porttbl, int range_
	117	+ if (!current_range \|\| current_range == ',' \|\| *current_range == ']') {
	118	+ /* Ended with a -, meaning up until the last possible port */
	119	+ if (range_type & SCAN_PROTOCOLS)
	120	+- rangeend = 255;
	121	++ rangeend = MAX_IPPROTONUM;
	122	+ else
	123	+ rangeend = 65535;
	124	+ } else if (isdigit((int) (unsigned char) *current_range)) {
	125	+ rangeend = strtol(current_range, &endptr, 10);
	126	+ if (range_type & SCAN_PROTOCOLS) {
	127	+- if (rangeend < 0 \|\| rangeend > 255)
	128	++ if (rangeend < 0 \|\| rangeend > MAX_IPPROTONUM)
	129	+ fatal("Protocols specified must be between 0 and 255 inclusive");
	130	+ } else {
	131	+ if (rangeend < 0 \|\| rangeend > 65535)

Mnmap.spec+8-1

	@@ -3,7 +3,7 @@
3	Name: nmap	3	Name: nmap
4	Epoch: 2	4	Epoch: 2
5	Version: 7.94	5	Version: 7.94
6	-Release: 7	6	+Release: 9
7	License: GPL-2.0-or-later	7	License: GPL-2.0-or-later
8	Summary: A tool for network discovery and security auditing.	8	Summary: A tool for network discovery and security auditing.
9	Requires: %{name}-ncat = %{epoch}:%{version}-%{release}	9	Requires: %{name}-ncat = %{epoch}:%{version}-%{release}
	@@ -25,6 +25,7 @@ Patch0006: backport-nping-fix-out-of-bounds-access.patch
25	Patch0007: backport-Ncat-server-UDP-do-not-quit-after-EOF-on-STDIN.-Fixe.patch	25	Patch0007: backport-Ncat-server-UDP-do-not-quit-after-EOF-on-STDIN.-Fixe.patch
26	Patch0008: remove-password-printing.patch	26	Patch0008: remove-password-printing.patch
27	Patch0009: backport-Bug-Lua-can-generate-wrong-code-when-_ENV-is-const.patch	27	Patch0009: backport-Bug-Lua-can-generate-wrong-code-when-_ENV-is-const.patch
		28	+Patch0010: backport-Fix-off-by-one-overflow-in-the-IP-protocol-table.patch
28		29
29	%define pixmap_srcdir zenmap/share/pixmaps	30	%define pixmap_srcdir zenmap/share/pixmaps
30		31
	@@ -75,6 +76,12 @@ ln -s ncat %{buildroot}%{_bindir}/nc
75	%{_mandir}/man1/*.1.gz	76	%{_mandir}/man1/*.1.gz
76		77
77	%changelog	78	%changelog
		79	+* Mon Jun 23 2025 liy460 <liy460@chinatelecom.cn> - 2:7.94-9
		80	+- Type:bugfix
		81	+- CVE:NA
		82	+- SUG:NA
		83	+- DESC:backport community PR:Fix off-by-one overflow in the IP protocol table
		84	+
78	* Wed Jan 15 2025 xingwei <xingwei14@h-partners.com> - 2:7.94-7	85	* Wed Jan 15 2025 xingwei <xingwei14@h-partners.com> - 2:7.94-7
79	- Type:CVE	86	- Type:CVE
80	- CVE:CVE-2022-28805	87	- CVE:CVE-2022-28805