From cd5e53c2ab81dec49aa11f0dc8cfc5ef5179d665 Mon Sep 17 00:00:00 2001
From: Timothy Redaelli <tredaelli@redhat.com>
Date: May 31 2017 11:28:23 +0000
Subject: Backport fix for CVE-2017-9214


Use %autosetup instead of %setup

Resolves: #1456797

---

diff --git a/openvswitch-CVE-2017-9214.patch b/openvswitch-CVE-2017-9214.patch
new file mode 100644
index 0000000..78b7df5
--- /dev/null
+++ b/openvswitch-CVE-2017-9214.patch
@@ -0,0 +1,30 @@
+From 7b7b186a8d40fc6f287cef2582702181da74bdc3 Mon Sep 17 00:00:00 2001
+From: Ben Pfaff <blp@ovn.org>
+Date: Sat, 20 May 2017 16:38:24 -0700
+Subject: [PATCH] ofp-util: Fix buffer overread in
+ ofputil_pull_queue_get_config_reply10().
+
+msg->size isn't the relevant measurement here because we're only supposed
+to read 'len' bytes.  Reading more than that causes 'len' to underflow to a
+large number at the end of the loop.
+
+Reported-by: Bhargava Shastry <bshastry@sec.t-labs.tu-berlin.de>
+Signed-off-by: Ben Pfaff <blp@ovn.org>
+Acked-by: Greg Rose <gvrose8192@gmail.com>
+---
+ lib/ofp-util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/ofp-util.c b/lib/ofp-util.c
+index db27abf8bc..a6dd5dbddf 100644
+--- a/lib/ofp-util.c
++++ b/lib/ofp-util.c
+@@ -2598,7 +2598,7 @@ ofputil_pull_queue_get_config_reply10(struct ofpbuf *msg,
+ 
+         hdr = ofpbuf_at_assert(msg, 0, sizeof *hdr);
+         prop_len = ntohs(hdr->len);
+-        if (prop_len < sizeof *hdr || prop_len > msg->size || prop_len % 8) {
++        if (prop_len < sizeof *hdr || prop_len > len || prop_len % 8) {
+             return OFPERR_OFPBRC_BAD_LEN;
+         }
+ 
diff --git a/openvswitch.spec b/openvswitch.spec
index 1982903..dfe079d 100644
--- a/openvswitch.spec
+++ b/openvswitch.spec
@@ -30,7 +30,7 @@
 
 Name: openvswitch
 Version: 2.7.0
-Release: 2%{?snapshot}%{?dist}
+Release: 3%{?snapshot}%{?dist}
 Summary: Open vSwitch daemon/database/utilities
 
 # Nearly all of openvswitch is ASL 2.0.  The bugtool is LGPLv2+, and the
@@ -42,6 +42,8 @@ Source0: http://openvswitch.org/releases/%{name}-%{version}%{?snap_gitsha}.tar.g
 Source1: http://fast.dpdk.org/rel/dpdk-%{dpdkver}.tar.gz
 Source2: ovs-snapshot.sh
 
+Patch1: openvswitch-CVE-2017-9214.patch
+
 %if %{with dpdk}
 %define dpdkarches x86_64 i686 aarch64 ppc64le
 
@@ -194,7 +196,7 @@ Requires: openvswitch openvswitch-ovn-common python2-openvswitch
 Docker network plugins for OVN.
 
 %prep
-%setup -q -n %{name}-%{version}%{?snap_gitsha} -a 1
+%autosetup -n %{name}-%{version}%{?snap_gitsha} -a 1 -p 1
 
 %build
 %if %{with dpdk}
@@ -648,6 +650,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_unitdir}/ovn-controller-vtep.service
 
 %changelog
+* Wed May 31 2017 Timothy Redaelli <tredaelli@redhat.com> - 2.7.0-3
+- Backport fix for CVE-2017-9214 (#1456797)
+- Use %%autosetup instead of %%setup
+
 * Mon May 29 2017 Timothy Redaelli <tredaelli@redhat.com> - 2.7.0-2
 - Install OVN firewalld rules