Browse code
Fixed CVE-2016-4008
Change-Id: Ie82e59c2aef17cc37823d8889010b4a97b9b55d6
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/1800
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Sharath George
DheerajSShetty authored on 2016/12/01 10:41:32Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,22 @@ |
| 0 |
+diff -rupr a/lib/decoding.c b/lib/decoding.c |
|
| 1 |
+--- a/lib/decoding.c 2015-09-14 10:41:16.000000000 -0700 |
|
| 2 |
+@@ -767,10 +767,17 @@ _asn1_extract_der_octet (asn1_node node, |
|
| 3 |
+ DECR_LEN(der_len, len3); |
|
| 4 |
+ |
|
| 5 |
+ if (len2 == -1) |
|
| 6 |
+- counter_end = der_len - 2; |
|
| 7 |
++ {
|
|
| 8 |
++ if (der_len < 2) |
|
| 9 |
++ return ASN1_DER_ERROR; |
|
| 10 |
++ counter_end = der_len - 2; |
|
| 11 |
++ } |
|
| 12 |
+ else |
|
| 13 |
+ counter_end = der_len; |
|
| 14 |
+ |
|
| 15 |
++ if (counter_end < counter) |
|
| 16 |
++ return ASN1_DER_ERROR; |
|
| 17 |
++ |
|
| 18 |
+ while (counter < counter_end) |
|
| 19 |
+ {
|
|
| 20 |
+ DECR_LEN(der_len, 1); |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: ASN.1 library |
| 2 | 2 |
Name: libtasn1 |
| 3 | 3 |
Version: 4.7 |
| 4 |
-Release: 2%{?dist}
|
|
| 4 |
+Release: 3%{?dist}
|
|
| 5 | 5 |
License: GPLv3+ and LGPLv2+ |
| 6 | 6 |
URL: http://www.gnu.org/software/libtasn1/ |
| 7 | 7 |
Source0: http://ftp.gnu.org/gnu/libtasn1/%{name}-%{version}.tar.gz
|
| ... | ... |
@@ -9,6 +9,9 @@ Source0: http://ftp.gnu.org/gnu/libtasn1/%{name}-%{version}.tar.gz
|
| 9 | 9 |
Group: System Environment/Libraries |
| 10 | 10 |
Vendor: VMware, Inc. |
| 11 | 11 |
Distribution: Photon |
| 12 |
+ |
|
| 13 |
+Patch0: CVE-2016-4008.patch |
|
| 14 |
+ |
|
| 12 | 15 |
%description |
| 13 | 16 |
Libtasn1 library provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, |
| 14 | 17 |
and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions. |
| ... | ... |
@@ -24,6 +27,8 @@ developing applications that use libtasn1. |
| 24 | 24 |
|
| 25 | 25 |
%prep |
| 26 | 26 |
%setup -q |
| 27 |
+%patch0 -p1 |
|
| 28 |
+ |
|
| 27 | 29 |
%build |
| 28 | 30 |
./configure \ |
| 29 | 31 |
--prefix=%{_prefix}
|
| ... | ... |
@@ -49,6 +54,8 @@ make -k check |& tee %{_specdir}/%{name}-check-log || %{nocheck}
|
| 49 | 49 |
%{_libdir}/pkgconfig/*.pc
|
| 50 | 50 |
%{_libdir}/*.a
|
| 51 | 51 |
%changelog |
| 52 |
+* Wed Nov 30 2016 Dheeraj Shetty <dheerajs@vmware.com> 4.7-3 |
|
| 53 |
+- Added patch for CVE-2016-4008 |
|
| 52 | 54 |
* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 4.7-2 |
| 53 | 55 |
- GA - Bump release of all rpms |
| 54 | 56 |
* Fri Jan 15 2016 Xiaolin Li <xiaolinl@vmware.com> 4.7-1 |