From a8da643bcbc9a985b21ca2bbcf841aea69a625d0 Mon Sep 17 00:00:00 2001 From: yixiangzhike Date: Thu, 14 Jan 2021 16:00:24 +0800 Subject: [PATCH] Fix CVE-2019-17362 --- backport-CVE-2019-17362.patch | 25 +++++++++++++++++++++++++ libtomcrypt.spec | 7 ++++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2019-17362.patch diff --git a/backport-CVE-2019-17362.patch b/backport-CVE-2019-17362.patch new file mode 100644 index 0000000..ea10682 --- /dev/null +++ b/backport-CVE-2019-17362.patch @@ -0,0 +1,25 @@ +From 25c26a3b7a9ad8192ccc923e15cf62bf0108ef94 Mon Sep 17 00:00:00 2001 +From: werew +Date: Thu, 3 Oct 2019 19:57:10 +0200 +Subject: [PATCH] Fixes #507 + +--- + src/pk/asn1/der/utf8/der_decode_utf8_string.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/pk/asn1/der/utf8/der_decode_utf8_string.c b/src/pk/asn1/der/utf8/der_decode_utf8_string.c +index 94555b9..d3ed82b 100644 +--- a/src/pk/asn1/der/utf8/der_decode_utf8_string.c ++++ b/src/pk/asn1/der/utf8/der_decode_utf8_string.c +@@ -65,7 +65,7 @@ int der_decode_utf8_string(const unsigned char *in, unsigned long inlen, + /* count number of bytes */ + for (z = 0; (tmp & 0x80) && (z <= 4); z++, tmp = (tmp << 1) & 0xFF); + +- if (z > 4 || (x + (z - 1) > inlen)) { ++ if (z == 1 || z > 4 || (x + (z - 1) > inlen)) { + return CRYPT_INVALID_PACKET; + } + +-- +1.8.3.1 + diff --git a/libtomcrypt.spec b/libtomcrypt.spec index e90557e..700f7f4 100644 --- a/libtomcrypt.spec +++ b/libtomcrypt.spec @@ -1,6 +1,6 @@ Name: libtomcrypt Version: 1.18.2 -Release: 3 +Release: 4 Summary: A comprehensive, portable cryptographic toolkit License: Public Domain or WTFPL URL: http://www.libtom.net/ @@ -8,6 +8,8 @@ Source0: https://github.com/libtom/%{name}/archive/v%{version}/%{name}-% BuildRequires: libtommath-devel libtool +Patch0: backport-CVE-2019-17362.patch + %description LibTomCrypt is a fairly comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, @@ -52,6 +54,9 @@ make test %{_libdir}/pkgconfig/*.pc %changelog +* Thu Jan 14 2021 yixiangzhike - 1.18.2-4 +- fix CVE-2019-17362 + * Fri Oct 11 2019 openEuler Buildteam - 1.18.2-3 - modify build path -- Gitee