new file mode 100644

@@ -0,0 +1,20 @@

+Reported-by: Bhargava Shastry <bshastry at sec.t-labs.tu-berlin.de>

+Signed-off-by: Ben Pfaff <blp at ovn.org>

+---

+ lib/ofp-util.c | 2 +-

+ 1 file changed, 1 insertion(+), 1 deletion(-)

+

+diff --git a/lib/ofp-util.c b/lib/ofp-util.c

+index bdf89b6c3017..f05ca398c13e 100644

+--- a/lib/ofp-util.c

+@@ -2610,7 +2610,7 @@ ofputil_pull_queue_get_config_reply10(struct ofpbuf *msg,

+ 

+         hdr = ofpbuf_at_assert(msg, 0, sizeof *hdr);

+         prop_len = ntohs(hdr->len);

+-        if (prop_len < sizeof *hdr || prop_len > msg->size || prop_len % 8) {

++        if (prop_len < sizeof *hdr || prop_len > len || prop_len % 8) {

+             return OFPERR_OFPBRC_BAD_LEN;

+         }

+ 

+--

new file mode 100644

@@ -0,0 +1,21 @@

+Reported-by: Bhargava Shastry <bshastry at sec.t-labs.tu-berlin.de>

+Signed-off-by: Ben Pfaff <blp at ovn.org>

+---

+ lib/ofp-util.c | 3 +++

+ 1 file changed, 3 insertions(+)

+

+diff --git a/lib/ofp-util.c b/lib/ofp-util.c

+index f05ca398c13e..46bc628d4191 100644

+--- a/lib/ofp-util.c

+@@ -9581,6 +9581,9 @@ ofputil_pull_ofp15_group_mod(struct ofpbuf *msg, enum ofp_version ofp_version,

+     }

+ 

+     bucket_list_len = ntohs(ogm->bucket_array_len);

++    if (bucket_list_len > msg->size) {

++        return OFPERR_OFPBRC_BAD_LEN;

++    }

+     error = ofputil_pull_ofp15_buckets(msg, bucket_list_len, ofp_version,

+                                        gm->type, &gm->buckets);

+     if (error) {

+-- 

@@ -3,7 +3,7 @@

 Summary:        Open vSwitch daemon/database/utilities

 Name:           openvswitch

 Version:        2.7.0

-Release:        3%{?dist}

+Release:        4%{?dist}

 License:        ASL 2.0 and LGPLv2+

 URL:            http://www.openvswitch.org/

 Group:          System Environment/Daemons

@@ -11,8 +11,9 @@ Vendor:         VMware, Inc.

 Distribution:   Photon

 Source0:        http://openvswitch.org/releases/%{name}-%{version}.tar.gz

-Patch0:         ovs-CVE-2017-9264.patch

 %define sha1 openvswitch=0f324ccfe52ae84a2b102a7f2db1411f4debacf6

+Patch0:         OVS-CVE-2017-9214.patch

+Patch1:         OVS-CVE-2017-9265.patch

 BuildRequires:  gcc >= 4.0.0

 BuildRequires:  libcap-ng

@@ -72,6 +73,7 @@ It contains the documentation and manpages for openvswitch.

 %prep

 %setup -q

 %patch0 -p1

+%patch1 -p1

 %build

 ./configure \

@@ -167,6 +169,8 @@ make -k check |& tee %{_specdir}/%{name}-check-log || %{nocheck}

 %{_mandir}/man8/vtep-ctl.8.gz

 %changelog

+*   Fri Jun 16 2017 Vinay Kulkarni <kulkarniv@vmware.com> 2.7.0-4

+-   Fix CVE-2017-9214, CVE-2017-9265

 *   Mon Jun 12 2017 Vinay Kulkarni <kulkarniv@vmware.com> 2.7.0-3

 -   Fix CVE-2017-9264

 *   Tue May 23 2017 Xiaolin Li <xiaolinl@vmware.com> 2.7.0-2

deleted file mode 100644

@@ -1,47 +0,0 @@

-Reported-by: Bhargava Shastry <bshastry at sec.t-labs.tu-berlin.de>

-Signed-off-by: Ben Pfaff <blp at ovn.org>

- lib/conntrack.c | 14 ++++++++++++--

- 1 file changed, 12 insertions(+), 2 deletions(-)

-

-diff --git a/lib/conntrack.c b/lib/conntrack.c

-index 9bea3d93e4ad..9c1dd63648b8 100644

-+++ b/lib/conntrack.c

-@@ -568,6 +568,10 @@ extract_l3_ipv6(struct conn_key *key, const void *data, size_t size,

-                 const char **new_data)

- {

-     const struct ovs_16aligned_ip6_hdr *ip6 = data;

-+    if (size < sizeof *ip6) {

-+        return false;

-+    }

-+

-     uint8_t nw_proto = ip6->ip6_nxt;

-     uint8_t nw_frag = 0;

- 

-@@ -623,8 +627,11 @@ check_l4_tcp(const struct conn_key *key, const void *data, size_t size,

-              const void *l3)

- {

-     const struct tcp_header *tcp = data;

--    size_t tcp_len = TCP_OFFSET(tcp->tcp_ctl) * 4;

-+    if (size < sizeof *tcp) {

-+        return false;

-+    }

- 

-+    size_t tcp_len = TCP_OFFSET(tcp->tcp_ctl) * 4;

-     if (OVS_UNLIKELY(tcp_len < TCP_HEADER_LEN || tcp_len > size)) {

-         return false;

-     }

-@@ -637,8 +644,11 @@ check_l4_udp(const struct conn_key *key, const void *data, size_t size,

-              const void *l3)

- {

-     const struct udp_header *udp = data;

--    size_t udp_len = ntohs(udp->udp_len);

-+    if (size < sizeof *udp) {

-+        return false;

-+    }

- 

-+    size_t udp_len = ntohs(udp->udp_len);

-     if (OVS_UNLIKELY(udp_len < UDP_HEADER_LEN || udp_len > size)) {

-         return false;

-     }