From d182b7f86714d3660367566501e6ffa06230d21d Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Fri, 19 Jul 2024 03:30:39 +0300
Subject: [PATCH] import libndp-1.8-6.el9_4

---
 ...alid-route-information-option-length.patch | 44 +++++++++++++++++++
 SPECS/libndp.spec                             | 13 +++++-
 2 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100644 SOURCES/0000-libndp-valid-route-information-option-length.patch

diff --git a/SOURCES/0000-libndp-valid-route-information-option-length.patch b/SOURCES/0000-libndp-valid-route-information-option-length.patch
new file mode 100644
index 0000000..15c9129
--- /dev/null
+++ b/SOURCES/0000-libndp-valid-route-information-option-length.patch
@@ -0,0 +1,44 @@
+From 05e4ba7b0d126eea4c04387dcf40596059ee24af Mon Sep 17 00:00:00 2001
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Wed, 5 Jun 2024 11:57:43 +0800
+Subject: [PATCH] libndp: valid route information option length
+
+RFC 4191 specifies that the Route Information Option Length should be 1, 2,
+or 3, depending on the Prefix Length. A malicious node could potentially
+trigger a buffer overflow and crash the tool by sending an IPv6 router
+advertisement message containing the "Route Information" option with a
+"Length" field larger than 3.
+
+To address this, add a check on the length field.
+
+Fixes: 8296a5bf0755 ("add support for Route Information Option (rfc4191)")
+Reported-by: Evgeny Vereshchagin <evverx@gmail.com>
+Suggested-by: Felix Maurer <fmaurer@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Jiri Pirko <jiri@nvidia.com>
+---
+ libndp/libndp.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/libndp/libndp.c b/libndp/libndp.c
+index 6314717..72ec92e 100644
+--- a/libndp/libndp.c
++++ b/libndp/libndp.c
+@@ -1231,6 +1231,17 @@ static bool ndp_msg_opt_route_check_valid(void *opt_data)
+ 	 */
+ 	if (((ri->nd_opt_ri_prf_reserved >> 3) & 3) == 2)
+ 		return false;
++
++	/* The Length field is 1, 2, or 3 depending on the Prefix Length.
++	 * If Prefix Length is greater than 64, then Length must be 3.
++	 * If Prefix Length is greater than 0, then Length must be 2 or 3.
++	 * If Prefix Length is zero, then Length must be 1, 2, or 3.
++	 */
++	if (ri->nd_opt_ri_len > 3 ||
++	    (ri->nd_opt_ri_prefix_len > 64 && ri->nd_opt_ri_len != 3) ||
++	    (ri->nd_opt_ri_prefix_len > 0 && ri->nd_opt_ri_len == 1))
++		return false;
++
+ 	return true;
+ }
+ 
diff --git a/SPECS/libndp.spec b/SPECS/libndp.spec
index aef74ef..2e2903f 100644
--- a/SPECS/libndp.spec
+++ b/SPECS/libndp.spec
@@ -1,10 +1,11 @@
 Name: libndp
 Version: 1.8
-Release: 4%{?dist}
+Release: 6%{?dist}
 Summary: Library for Neighbor Discovery Protocol
-License: LGPLv2+
+License: LGPL-2.1-or-later
 URL: http://www.libndp.org/
 Source: http://www.libndp.org/files/libndp-%{version}.tar.gz
+Patch0: 0000-libndp-valid-route-information-option-length.patch
 
 BuildRequires:  gcc
 BuildRequires: make
@@ -23,6 +24,7 @@ necessary for developing programs using libndp.
 
 %prep
 %setup -q
+%patch -p1 -P 0
 
 %build
 %configure --disable-static
@@ -46,6 +48,13 @@ find $RPM_BUILD_ROOT -name \*.la -delete
 %{_libdir}/pkgconfig/*.pc
 
 %changelog
+* Wed Jul 10 2024 Felix Maurer <fmaurer@redhat.com> - 1.8-6
+- Validate route information option length
+
+* Wed Nov 15 2023 Hangbin Liu <haliu@redhat.com> - 1.8-5
+- Convert the license tag to SPDX format
+  Related: RHELMISC-1363
+
 * Wed Mar 15 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 1.8-4
 - Rebuilt for MSVSphere 9.1.