[lwip-devel] Fixing CVE-2020-22283 & CVE-2020-22284

[Joan Lledó]

Hi,

I'm maintaining the lwip package in Debian, now I'd like to apply the 
patches to fix he CVEs 2020-22283 & 2020-22284, which are in [1] & [2].

The Debian package takes the code from the 2.1.2 release, at [3], and I 
can't apply the commits at [1] & [2] directly since they are created 
from a later code.

Attached is a patch I wrote, basically adding the implementation for 
pbuf_copy_partial_pbuf and calling it from icmp6.c and zepif.c

Could any of you take a fast look at it and tell me if it seems ok? I'd 
appreciate it.

Regards

---
[1] https://savannah.nongnu.org/bugs/index.php?58553
[2] https://savannah.nongnu.org/bugs/index.php?58554
[3] 
https://git.savannah.nongnu.org/cgit/lwip.git/tree/?h=STABLE-2_1_2_RELEASE

CVEs.patch
Description: Text Data