diff --git a/package/net-tools/0002-CVE-2025-46836-interface-statistic-regression.patch b/package/net-tools/0002-CVE-2025-46836-interface-statistic-regression.patch new file mode 100644 index 0000000000..60cae48aef --- /dev/null +++ b/package/net-tools/0002-CVE-2025-46836-interface-statistic-regression.patch @@ -0,0 +1,30 @@ +From ddb0e375fb9ca95bb69335540b85bbdaa2714348 Mon Sep 17 00:00:00 2001 +From: Bernd Eckenfels +Date: Sat, 17 May 2025 21:53:23 +0200 +Subject: [PATCH] Interface statistic regression after 7a8f42fb2 + +CVE: CVE-2025-46836 +Upstream: https://sourceforge.net/p/net-tools/code/ci/ddb0e375fb9ca95bb69335540b85bbdaa2714348/ +Signed-off-by: Thomas Perale +--- + lib/interface.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/lib/interface.c b/lib/interface.c +index a054f12..ca4adf1 100644 +--- a/lib/interface.c ++++ b/lib/interface.c +@@ -239,12 +239,11 @@ static const char *get_name(char *name, const char *p) + /* copy the digits */ + while (*p && isdigit((unsigned char)*p) && dst < end) + *dst++ = *p++; +- +- if (*p == ':') /* consume trailing colon */ +- ++p; + } else { /* if so treat as normal */ + p = dot; + } ++ if (*p == ':') /* consume trailing colon */ ++ ++p; + break; /* interface name ends here */ + } diff --git a/package/net-tools/net-tools.mk b/package/net-tools/net-tools.mk index a227d6477f..0468a00bf0 100644 --- a/package/net-tools/net-tools.mk +++ b/package/net-tools/net-tools.mk @@ -13,6 +13,7 @@ NET_TOOLS_LICENSE_FILES = COPYING NET_TOOLS_CPE_ID_VALID = YES # 0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch +# 0002-CVE-2025-46836-interface-statistic-regression.patch NET_TOOLS_IGNORE_CVES += CVE-2025-46836 define NET_TOOLS_CONFIGURE_CMDS