1 files changed, 0 insertions, 74 deletions
diff --git a/community/quagga/0002-CVE-2012-1820.patch b/community/quagga/0002-CVE-2012-1820.patch
deleted file mode 100644
index aae2d7b18..000000000
--- a/community/quagga/0002-CVE-2012-1820.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-@@ -, +, @@ 
-    bgpd: CVE-2012-1820, DoS in bgp_capability_orf()
-    
-    An ORF (code 3) capability TLV is defined to contain exactly one
-    AFI/SAFI block. Function bgp_capability_orf(), which parses ORF
-    capability TLV, uses do-while cycle to call its helper function
-    bgp_capability_orf_entry(), which actually processes the AFI/SAFI data
-    block. The call is made at least once and repeated as long as the input
-    buffer has enough data for the next call.
-    
-    The helper function, bgp_capability_orf_entry(), uses "Number of ORFs"
-    field of the provided AFI/SAFI block to verify, if it fits the input
-    buffer. However, the check is made based on the total length of the ORF
-    TLV regardless of the data already consumed by the previous helper
-    function call(s). This way, the check condition is only valid for the
-    first AFI/SAFI block inside an ORF capability TLV.
-    
-    For the subsequent calls of the helper function, if any are made, the
-    check condition may erroneously tell, that the current "Number of ORFs"
-    field fits the buffer boundary, where in fact it does not. This makes it
-    possible to trigger an assertion by feeding an OPEN message with a
-    specially-crafted malformed ORF capability TLV.
-    
-    This commit fixes the vulnerability by making the implementation follow
-    the spec.
---- a/bgpd/bgp_open.c	
-+++ a/bgpd/bgp_open.c	
-@@ -231,7 +231,7 @@ bgp_capability_orf_entry (struct peer *peer, struct capability_header *hdr)
-     }
-   
-   /* validate number field */
--  if (sizeof (struct capability_orf_entry) + (entry.num * 2) > hdr->length)
-+  if (sizeof (struct capability_orf_entry) + (entry.num * 2) != hdr->length)
-     {
-       zlog_info ("%s ORF Capability entry length error,"
-                  " Cap length %u, num %u",
-@@ -335,28 +335,6 @@ bgp_capability_orf_entry (struct peer *peer, struct capability_header *hdr)
- }
- 
- static int
--bgp_capability_orf (struct peer *peer, struct capability_header *hdr)
--{
--  struct stream *s = BGP_INPUT (peer);
--  size_t end = stream_get_getp (s) + hdr->length;
--  
--  assert (stream_get_getp(s) + sizeof(struct capability_orf_entry) <= end);
--  
--  /* We must have at least one ORF entry, as the caller has already done
--   * minimum length validation for the capability code - for ORF there must
--   * at least one ORF entry (header and unknown number of pairs of bytes).
--   */
--  do
--    {
--      if (bgp_capability_orf_entry (peer, hdr) == -1)
--        return -1;
--    } 
--  while (stream_get_getp(s) + sizeof(struct capability_orf_entry) < end);
--  
--  return 0;
--}
--
--static int
- bgp_capability_restart (struct peer *peer, struct capability_header *caphdr)
- {
-   struct stream *s = BGP_INPUT (peer);
-@@ -573,7 +551,7 @@ bgp_capability_parse (struct peer *peer, size_t length, int *mp_capability,
-             break;
-           case CAPABILITY_CODE_ORF:
-           case CAPABILITY_CODE_ORF_OLD:
--            if (bgp_capability_orf (peer, &caphdr))
-+            if (bgp_capability_orf_entry (peer, &caphdr))
-               return -1;
-             break;
-           case CAPABILITY_CODE_RESTART: