Add patch CVE-2018-19519 for tcpdump

Change-Id: I3d0a407b09eb97d71c8bab2f1738deb7dc1bc820
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6874
Tested-by: michellew <[email protected]>
Reviewed-by: Anish Swaminathan <[email protected]>

SPECS/tcpdump/CVE-2018-19519.patch

@@ -0,0 +1,23 @@
+From 32af00b05a6ef573d0b340f97b54c13eb9509dc7 Mon Sep 17 00:00:00 2001
+From: Pedro Monreal <[email protected]>
+Date: Thu, 6 Dec 2018 12:18:38 +0100
+Subject: [PATCH] CVE-2018-19519 buffer overread. Initialize buf in
+ print-hncp.c:print_prefix.
+
+---
+ print-hncp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+Index: tcpdump-4.9.2/print-hncp.c
+===================================================================
+--- tcpdump-4.9.2.orig/print-hncp.c
++++ tcpdump-4.9.2/print-hncp.c
+@@ -206,6 +206,8 @@ print_prefix(netdissect_options *ndo, co
+     int plenbytes;
+     char buf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx::/128")];
+
++    buf[0] = '\0';
++
+     if (prefix[0] >= 96 && max_length >= IPV4_MAPPED_HEADING_LEN + 1 &&
+         is_ipv4_mapped_address(&prefix[1])) {
+         struct in_addr addr;

SPECS/tcpdump/tcpdump.spec

@@ -1,26 +1,30 @@
-Summary:	Packet Analyzer
-Name:		tcpdump
-Version:	4.9.2
-Release:	1%{?dist}
-License:	BSD
-URL:		http://www.tcpdump.org
-Source0:	http://www.tcpdump.org/release/%{name}-%{version}.tar.gz
+Summary:        Packet Analyzer
+Name:           tcpdump
+Version:        4.9.2
+Release:        2%{?dist}
+License:        BSD
+URL:            http://www.tcpdump.org
+Source0:        http://www.tcpdump.org/release/%{name}-%{version}.tar.gz
 %define sha1 tcpdump=e2db246a9dd19278bac1a5ff875106c75e0a16d4
-Group:		Networking
-Vendor:		VMware, Inc.
-Distribution:	Photon
-BuildRequires: 	libpcap
-Requires:	libpcap
+Patch0:         CVE-2018-19519.patch
+Group:          Networking
+Vendor:         VMware, Inc.
+Distribution:   Photon
+BuildRequires:  libpcap
+Requires:       libpcap
+
 %description
 Tcpdump is a common packet analyzer that runs under the command line. 
 It allows the user to display TCP/IP and other packets being 
 transmitted or received over a network to which the computer is attached.
+
 %prep
 %setup -qn tcpdump-tcpdump-%{version}
+%patch0 -p1
 %build
-./configure \
-	--prefix=%{_prefix}
+%configure
 make %{?_smp_mflags}
+
 %install
 make DESTDIR=%{buildroot} install
 find %{buildroot} -name '*.la' -delete
@@ -32,7 +36,10 @@ make %{?_smp_mflags} check
 %defattr(-,root,root)
 %{_sbindir}/*
 %{_mandir}/man1/*
+
 %changelog
+*   Thu Mar 14 2019 Michelle Wang <[email protected]> 4.9.2-2
+-   Add patch CVE-2018-19519
 *   Fri Sep 15 2017 Dheeraj Shetty <[email protected]> 4.9.2-1
 -   Updating version to 4.9.2
 *   Thu Sep 07 2017 Dheeraj Shetty <[email protected]> 4.9.1-2