From 43246b9a78788ad4751039f9daa5cb050c841c4f Mon Sep 17 00:00:00 2001
From: linwei9 <595019852@qq.com>
Date: Wed, 17 Jun 2020 17:36:52 +0800
Subject: [PATCH 1/2] add yaml file

---
 libtomcrypt.yaml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 libtomcrypt.yaml

diff --git a/libtomcrypt.yaml b/libtomcrypt.yaml
new file mode 100644
index 0000000..8e0b717
--- /dev/null
+++ b/libtomcrypt.yaml
@@ -0,0 +1,4 @@
+version_control: github
+src_repo: libtom/libtomcrypt
+tag_prefix: ^v
+seperator: .
-- 
Gitee


From b86a145932e984bd3470590f6102f6923f2c902a Mon Sep 17 00:00:00 2001
From: guoxiaoqi <guoxiaoqi2@huawei.com>
Date: Thu, 14 Jan 2021 11:41:13 +0800
Subject: [PATCH 2/2] fix CVE-2019-17362

---
 CVE-2019-17362.patch | 25 +++++++++++++++++++++++++
 libtomcrypt.spec     |  7 +++++--
 2 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 CVE-2019-17362.patch

diff --git a/CVE-2019-17362.patch b/CVE-2019-17362.patch
new file mode 100644
index 0000000..293c5b8
--- /dev/null
+++ b/CVE-2019-17362.patch
@@ -0,0 +1,25 @@
+From 25c26a3b7a9ad8192ccc923e15cf62bf0108ef94 Mon Sep 17 00:00:00 2001
+From: werew <werew@ret2libc.com>
+Date: Thu, 3 Oct 2019 19:57:10 +0200
+Subject: [PATCH] Fixes #507
+
+---
+ src/pk/asn1/der/utf8/der_decode_utf8_string.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pk/asn1/der/utf8/der_decode_utf8_string.c b/src/pk/asn1/der/utf8/der_decode_utf8_string.c
+index 94555b99..d3ed82be 100644
+--- a/src/pk/asn1/der/utf8/der_decode_utf8_string.c
++++ b/src/pk/asn1/der/utf8/der_decode_utf8_string.c
+@@ -65,7 +65,7 @@ int der_decode_utf8_string(const unsigned char *in,  unsigned long inlen,
+       /* count number of bytes */
+       for (z = 0; (tmp & 0x80) && (z <= 4); z++, tmp = (tmp << 1) & 0xFF);
+ 
+-      if (z > 4 || (x + (z - 1) > inlen)) {
++      if (z == 1 || z > 4 || (x + (z - 1) > inlen)) {
+          return CRYPT_INVALID_PACKET;
+       }
+ 
+-- 
+2.27.0
+
diff --git a/libtomcrypt.spec b/libtomcrypt.spec
index e90557e..7454114 100644
--- a/libtomcrypt.spec
+++ b/libtomcrypt.spec
@@ -1,11 +1,11 @@
 Name:            libtomcrypt
 Version:         1.18.2
-Release:         3
+Release:         4
 Summary:         A comprehensive, portable cryptographic toolkit
 License:         Public Domain or WTFPL
 URL:             http://www.libtom.net/
 Source0:         https://github.com/libtom/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
-
+Patch0:          CVE-2019-17362.patch
 BuildRequires:   libtommath-devel libtool
 
 %description
@@ -52,6 +52,9 @@ make test
 %{_libdir}/pkgconfig/*.pc
 
 %changelog
+* Thu Jan 14 2021 openEuler Buildteam <buildteam@openeuler.org> - 1.18.2-4
+- fix CVE-2019-17362
+
 * Fri Oct 11 2019 openEuler Buildteam <buildteam@openeuler.org> - 1.18.2-3
 - modify build path
 
-- 
Gitee