commit 81c522cc373e239432378a11fba40769e15863f0 Author: Sergey Cherevko Date: Tue Jan 30 15:58:37 2024 +0300 import libtommath-1.1.0-4.el8 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..5803bb7 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/libtommath-1.1.0.tar.gz diff --git a/.libtommath.metadata b/.libtommath.metadata new file mode 100644 index 0000000..f8f0095 --- /dev/null +++ b/.libtommath.metadata @@ -0,0 +1 @@ +65132538bb84256f263955e681bc6d77dbd536ad SOURCES/libtommath-1.1.0.tar.gz diff --git a/SOURCES/CVE-2023-36328.patch b/SOURCES/CVE-2023-36328.patch new file mode 100644 index 0000000..00f2215 --- /dev/null +++ b/SOURCES/CVE-2023-36328.patch @@ -0,0 +1,106 @@ +From beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 Mon Sep 17 00:00:00 2001 +From: czurnieden +Date: Tue, 9 May 2023 17:17:12 +0200 +Subject: [PATCH] Fix possible integer overflow + +[fsumsal] Slightly altered to make it work with libtommath-1.1.0 + +--- + bn_mp_2expt.c | 4 ++++ + bn_mp_grow.c | 4 ++++ + bn_mp_init_size.c | 5 +++++ + bn_mp_mul_2d.c | 4 ++++ + bn_s_mp_mul_digs.c | 4 ++++ + bn_s_mp_mul_high_digs.c | 4 ++++ + 8 files changed, 33 insertions(+) + +diff --git a/bn_mp_2expt.c b/bn_mp_2expt.c +index 0ae3df1bf..23de0c3c5 100644 +--- a/bn_mp_2expt.c ++++ b/bn_mp_2expt.c +@@ -12,6 +12,10 @@ mp_err mp_2expt(mp_int *a, int b) + { + int res; + ++ if (b < 0) { ++ return MP_VAL; ++ } ++ + /* zero a as per default */ + mp_zero(a); + +diff --git a/bn_mp_grow.c b/bn_mp_grow.c +index 9e904c547..2b1682651 100644 +--- a/bn_mp_grow.c ++++ b/bn_mp_grow.c +@@ -9,6 +9,10 @@ mp_err mp_grow(mp_int *a, int size) + int i; + mp_digit *tmp; + ++ if (size < 0) { ++ return MP_VAL; ++ } ++ + /* if the alloc size is smaller alloc more ram */ + if (a->alloc < size) { + /* ensure there are always at least MP_PREC digits extra on top */ +diff --git a/bn_mp_init_size.c b/bn_mp_init_size.c +index d62268721..99573833f 100644 +--- a/bn_mp_init_size.c ++++ b/bn_mp_init_size.c +@@ -6,6 +6,10 @@ + { + int x; + ++ if (size < 0) { ++ return MP_VAL; ++ } ++ + /* pad size so there are always extra digits */ + size += (MP_PREC * 2) - (size % MP_PREC); + +diff --git a/bn_mp_mul_2d.c b/bn_mp_mul_2d.c +index 87354de20..bfeaf2eb2 100644 +--- a/bn_mp_mul_2d.c ++++ b/bn_mp_mul_2d.c +@@ -9,6 +9,10 @@ mp_err mp_mul_2d(const mp_int *a, int b, mp_int *c) + mp_digit d; + int res; + ++ if (b < 0) { ++ return MP_VAL; ++ } ++ + /* copy */ + if (a != c) { + if ((res = mp_copy(a, c)) != MP_OKAY) { +diff --git a/bn_s_mp_mul_digs.c b/bn_s_mp_mul_digs.c +index 64509d4cb..3682b4980 100644 +--- a/bn_s_mp_mul_digs.c ++++ b/bn_s_mp_mul_digs.c +@@ -16,6 +16,10 @@ mp_err s_mp_mul_digs(const mp_int *a, const mp_int *b, mp_int *c, int digs) + mp_word r; + mp_digit tmpx, *tmpt, *tmpy; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* can we use the fast multiplier? */ + if ((digs < (int)MP_WARRAY) && + (MIN(a->used, b->used) < +diff --git a/bn_s_mp_mul_high_digs.c b/bn_s_mp_mul_high_digs.c +index 2bb2a5098..c9dd355f8 100644 +--- a/bn_s_mp_mul_high_digs.c ++++ b/bn_s_mp_mul_high_digs.c +@@ -15,6 +15,10 @@ mp_err s_mp_mul_high_digs(const mp_int *a, const mp_int *b, mp_int *c, int digs) + mp_word r; + mp_digit tmpx, *tmpt, *tmpy; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* can we use the fast multiplier? */ + #ifdef BN_FAST_S_MP_MUL_HIGH_DIGS_C + if (((a->used + b->used + 1) < (int)MP_WARRAY) diff --git a/SPECS/libtommath.spec b/SPECS/libtommath.spec new file mode 100644 index 0000000..fa56366 --- /dev/null +++ b/SPECS/libtommath.spec @@ -0,0 +1,166 @@ +## START: Set by rpmautospec +## (rpmautospec version 0.3.5) +## RPMAUTOSPEC: autorelease, autochangelog +%define autorelease(e:s:pb:n) %{?-p:0.}%{lua: + release_number = 4; + base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); + print(release_number + base_release_number - 1); +}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} +## END: Set by rpmautospec + +Name: libtommath +Version: 1.1.0 +Release: %autorelease +Summary: A portable number theoretic multiple-precision integer library +License: Public Domain +URL: http://www.libtom.net/ + +Source0: https://github.com/libtom/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz + +Patch: CVE-2023-36328.patch + +BuildRequires: ghostscript +BuildRequires: libtiff-tools +BuildRequires: libtool +BuildRequires: texlive-dvips-bin +BuildRequires: ghostscript-tools-dvipdf +BuildRequires: texlive-latex-bin-bin +BuildRequires: texlive-makeindex-bin +BuildRequires: texlive-mfware-bin +BuildRequires: texlive-updmap-map +BuildRequires: tex(cmr10.tfm) +BuildRequires: tex(fancyhdr.sty) +BuildRequires: tex(hyphen.tex) + +%description +A free open source portable number theoretic multiple-precision integer library +written entirely in C. (phew!). The library is designed to provide a simple to +work with API that provides fairly efficient routines that build out of the box +without configuration. + +%package devel +Summary: Development files for %{name} +Requires: %{name}%{?_isa} = %{version}-%{release} + +%description devel +The %{name}-devel package contains libraries and header files for developing +applications that use %{name}. + +%package doc +Summary: Documentation files for %{name} +BuildArch: noarch +Provides: %{name}-doc = %{version}-%{release} +Obsoletes: %{name}-doc < 0.42-1 + +%description doc +The %{name}-doc package contains PDF documentation for using %{name}. + +%prep +%autosetup -p1 +# Fix permissions on installed library +sed -i -e 's/644 $(LIBNAME)/755 $(LIBNAME)/g' makefile.shared +# Fix pkgconfig path +sed -i \ + -e 's|^prefix=.*|prefix=%{_prefix}|g' \ + -e 's|^libdir=.*|libdir=%{_libdir}|g' \ + %{name}.pc.in + +%build +%set_build_flags +%make_build V=1 CFLAGS="$CFLAGS -I./" -f makefile.shared +make V=1 -f makefile poster manual docs + +%install +%make_install V=1 CFLAGS="$CFLAGS -I./" PREFIX=%{_prefix} LIBPATH=%{_libdir} -f makefile.shared + +find %{buildroot} -name '*.la' -delete +find %{buildroot} -name '*.a' -delete + +%ldconfig_scriptlets + +%files +%license LICENSE +%{_libdir}/*.so.* + +%files devel +%{_includedir}/*.h +%{_libdir}/*.so +%{_libdir}/pkgconfig/*.pc + +%files doc +%doc doc/bn.pdf doc/poster.pdf doc/tommath.pdf + +%changelog +* Fri Jan 26 2024 Sergey Cherevko - 1.1.0-%autorelease +- Rebuilt for MSVSphere 8.9 + +* Sat Sep 02 2023 Frantisek Sumsal - 1.1.0-4 +- Fix CVE-2023-36328 (#2236877,#2236878) + +* Wed Oct 16 2019 Simone Caronni - 1.1.0-1 +- Update to 1.1.0. + +* Thu Jul 25 2019 Fedora Release Engineering - 1.0.1-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sun Jun 02 2019 Leigh Scott - 1.0.1-9 +- Disable parallel build for docs + +* Tue May 14 2019 Scott Talbert - 1.0.1-8 +- Add BR texlive-updmap-map to fix FTBFS when building docs (#1675313) + +* Fri Feb 01 2019 Fedora Release Engineering - 1.0.1-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Fri Jul 13 2018 Fedora Release Engineering - 1.0.1-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Apr 05 2018 Rafael Santos - 1.0.1-5 +- Resolves #1548832 - Fix Fedora build flags injection + +* Sun Feb 25 2018 Florian Weimer - 1.0.1-4 +- Add BuildRequires: ghostscript-tools-dvipdf + +* Wed Feb 07 2018 Fedora Release Engineering - 1.0.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Sat Feb 03 2018 Igor Gnatenko - 1.0.1-2 +- Switch to %%ldconfig_scriptlets + +* Mon Sep 11 2017 Simone Caronni - 1.0.1-1 +- Update to 1.0.1. +- Trim changelog. +- Clean up SPEC file. +- Remove RHEL 6 support. + +* Thu Aug 03 2017 Fedora Release Engineering - 1.0-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 1.0-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Sun Jun 25 2017 Simone Caronni - 1.0-7 +- Update URL (#1463608, #1463547). + +* Fri Feb 10 2017 Fedora Release Engineering - 1.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Tue Feb 23 2016 Simone Caronni - 1.0-4 +- Fix installs with non-standard buildroots (#1299860). + +* Tue Feb 23 2016 Simone Caronni - 1.0-3 +- Remove useless latex build requirements. + +* Tue Feb 23 2016 Simone Caronni - 1.0-2 +- Use proper source URL. +- Cleanup SPEC file. + +* Tue Feb 23 2016 Simone Caronni - 1.0-1 +- Fix FTBFS (#1307741). +- Update to 1.0. +- Update URL. +- Use license macro. + +* Thu Feb 04 2016 Fedora Release Engineering - 0.42.0-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild +