Fix CVE-2023-36328 (#2236877,#2236878)

[skip changelog]

.gitignore

@@ -4,3 +4,4 @@ ltm-0.41.tar.bz2
 /libtommath-1.0.tar.gz
 /libtommath-1.0.1.tar.gz
 /libtommath-1.1.0.tar.gz
+/libtommath-1.2.0.tar.gz

CVE-2023-36328.patch

@@ -3,15 +3,15 @@ From: czurnieden <czurnieden@gmx.de>
 Date: Tue, 9 May 2023 17:17:12 +0200
 Subject: [PATCH] Fix possible integer overflow
 
-[fsumsal] Slightly altered to make it work with libtommath-1.1.0
-
 ---
  bn_mp_2expt.c                | 4 ++++
  bn_mp_grow.c                 | 4 ++++
  bn_mp_init_size.c            | 5 +++++
  bn_mp_mul_2d.c               | 4 ++++
  bn_s_mp_mul_digs.c           | 4 ++++
+ bn_s_mp_mul_digs_fast.c      | 4 ++++
  bn_s_mp_mul_high_digs.c      | 4 ++++
+ bn_s_mp_mul_high_digs_fast.c | 4 ++++
  8 files changed, 33 insertions(+)
 
 diff --git a/bn_mp_2expt.c b/bn_mp_2expt.c
@@ -20,7 +20,7 @@ index 0ae3df1bf..23de0c3c5 100644
 +++ b/bn_mp_2expt.c
 @@ -12,6 +12,10 @@ mp_err mp_2expt(mp_int *a, int b)
  {
-    int     res;
+    mp_err    err;
  
 +   if (b < 0) {
 +      return MP_VAL;
@@ -43,29 +43,30 @@ index 9e904c547..2b1682651 100644
 +
     /* if the alloc size is smaller alloc more ram */
     if (a->alloc < size) {
-       /* ensure there are always at least MP_PREC digits extra on top */
+       /* reallocate the array a->dp
 diff --git a/bn_mp_init_size.c b/bn_mp_init_size.c
 index d62268721..99573833f 100644
 --- a/bn_mp_init_size.c
 +++ b/bn_mp_init_size.c
-@@ -6,6 +6,10 @@
+@@ -6,6 +6,11 @@
+ /* init an mp_init for a given size */
+ mp_err mp_init_size(mp_int *a, int size)
  {
-    int x;
- 
++
 +   if (size < 0) {
 +      return MP_VAL;
 +   }
 +
-    /* pad size so there are always extra digits */
-    size += (MP_PREC * 2) - (size % MP_PREC);
+    size = MP_MAX(MP_MIN_PREC, size);
  
+    /* alloc mem */
 diff --git a/bn_mp_mul_2d.c b/bn_mp_mul_2d.c
 index 87354de20..bfeaf2eb2 100644
 --- a/bn_mp_mul_2d.c
 +++ b/bn_mp_mul_2d.c
 @@ -9,6 +9,10 @@ mp_err mp_mul_2d(const mp_int *a, int b, mp_int *c)
     mp_digit d;
-    int      res;
+    mp_err   err;
  
 +   if (b < 0) {
 +      return MP_VAL;
@@ -73,7 +74,7 @@ index 87354de20..bfeaf2eb2 100644
 +
     /* copy */
     if (a != c) {
-       if ((res = mp_copy(a, c)) != MP_OKAY) {
+       if ((err = mp_copy(a, c)) != MP_OKAY) {
 diff --git a/bn_s_mp_mul_digs.c b/bn_s_mp_mul_digs.c
 index 64509d4cb..3682b4980 100644
 --- a/bn_s_mp_mul_digs.c
@@ -87,14 +88,29 @@ index 64509d4cb..3682b4980 100644
 +   }
 +
     /* can we use the fast multiplier? */
-    if ((digs < (int)MP_WARRAY) &&
-        (MIN(a->used, b->used) <
+    if ((digs < MP_WARRAY) &&
+        (MP_MIN(a->used, b->used) < MP_MAXFAST)) {
+diff --git a/bn_s_mp_mul_digs_fast.c b/bn_s_mp_mul_digs_fast.c
+index b2a287b02..3c4176a87 100644
+--- a/bn_s_mp_mul_digs_fast.c
++++ b/bn_s_mp_mul_digs_fast.c
+@@ -26,6 +26,10 @@ mp_err s_mp_mul_digs_fast(const mp_int *a, const mp_int *b, mp_int *c, int digs)
+    mp_digit W[MP_WARRAY];
+    mp_word  _W;
+ 
++   if (digs < 0) {
++      return MP_VAL;
++   }
++
+    /* grow the destination as required */
+    if (c->alloc < digs) {
+       if ((err = mp_grow(c, digs)) != MP_OKAY) {
 diff --git a/bn_s_mp_mul_high_digs.c b/bn_s_mp_mul_high_digs.c
 index 2bb2a5098..c9dd355f8 100644
 --- a/bn_s_mp_mul_high_digs.c
 +++ b/bn_s_mp_mul_high_digs.c
 @@ -15,6 +15,10 @@ mp_err s_mp_mul_high_digs(const mp_int *a, const mp_int *b, mp_int *c, int digs)
-    mp_word r;
+    mp_word  r;
     mp_digit tmpx, *tmpt, *tmpy;
  
 +   if (digs < 0) {
@@ -102,5 +118,20 @@ index 2bb2a5098..c9dd355f8 100644
 +   }
 +
     /* can we use the fast multiplier? */
- #ifdef BN_FAST_S_MP_MUL_HIGH_DIGS_C
-    if (((a->used + b->used + 1) < (int)MP_WARRAY)
+    if (MP_HAS(S_MP_MUL_HIGH_DIGS_FAST)
+        && ((a->used + b->used + 1) < MP_WARRAY)
+diff --git a/bn_s_mp_mul_high_digs_fast.c b/bn_s_mp_mul_high_digs_fast.c
+index a2c4fb692..4ce7f590c 100644
+--- a/bn_s_mp_mul_high_digs_fast.c
++++ b/bn_s_mp_mul_high_digs_fast.c
+@@ -19,6 +19,10 @@ mp_err s_mp_mul_high_digs_fast(const mp_int *a, const mp_int *b, mp_int *c, int
+    mp_digit W[MP_WARRAY];
+    mp_word  _W;
+ 
++   if (digs < 0) {
++      return MP_VAL;
++   }
++
+    /* grow the destination as required */
+    pa = a->used + b->used;
+    if (c->alloc < pa) {

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: libtommath
-# $Id$
-NAME := libtommath
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

changelog

@@ -1,3 +1,31 @@
+* Tue Jan 04 2022 Frantisek Sumsal <frantisek@sumsal.cz> - 1.2.0-7
+- Initial EPEL 9 build for BZ#2029481
+- Temporarily skip building docs due to work around BZ#2031879
+
+* Mon Dec 13 2021 Frantisek Sumsal <frantisek@sumsal.cz> - 1.2.0-6
+- Add a couple of missing BRs (texlive-kpathsea and texlive-metafont)
+
+* Wed Nov 03 2021 Frantisek Sumsal <frantisek@sumsal.cz> - 1.2.0-5
+- Drop an obsoleted texlive-updmap-map build dependency (#1999507, #1987664)
+- (see: #1965446)
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Mon Jan 25 2021 Than Ngo <than@redhat.com> - 1.2.0-3
+- Add missing BRs
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Thu Apr 09 2020 Gerd Pokorra <gp@zimt.uni-siegen.de> - 1.2.0-1
+- Update to 1.2.0.
+- Remove poster make tag
+- Add BuildRequires texlive-appendix
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
 * Wed Oct 16 2019 Simone Caronni <negativo17@gmail.com> - 1.1.0-1
 - Update to 1.1.0.
 

libtommath.spec

@@ -1,5 +1,5 @@
 Name:           libtommath
-Version:        1.1.0
+Version:        1.2.0
 Release:        %autorelease
 Summary:        A portable number theoretic multiple-precision integer library
 License:        Public Domain
@@ -9,18 +9,8 @@ Source0:        https://github.com/libtom/%{name}/archive/v%{version}.tar.gz#/%{
 
 Patch:          CVE-2023-36328.patch
 
-BuildRequires:  ghostscript
-BuildRequires:  libtiff-tools
+BuildRequires:  make
 BuildRequires:  libtool
-BuildRequires:  texlive-dvips-bin
-BuildRequires:  ghostscript-tools-dvipdf
-BuildRequires:  texlive-latex-bin-bin
-BuildRequires:  texlive-makeindex-bin
-BuildRequires:  texlive-mfware-bin
-BuildRequires:  texlive-updmap-map
-BuildRequires:  tex(cmr10.tfm)
-BuildRequires:  tex(fancyhdr.sty)
-BuildRequires:  tex(hyphen.tex)
 
 %description
 A free open source portable number theoretic multiple-precision integer library
@@ -36,15 +26,6 @@ Requires:       %{name}%{?_isa} = %{version}-%{release}
 The %{name}-devel package contains libraries and header files for developing
 applications that use %{name}.
 
-%package        doc
-Summary:        Documentation files for %{name}
-BuildArch:      noarch
-Provides:       %{name}-doc = %{version}-%{release}
-Obsoletes:      %{name}-doc < 0.42-1
-
-%description    doc
-The %{name}-doc package contains PDF documentation for using %{name}.
-
 %prep
 %autosetup -p1
 # Fix permissions on installed library
@@ -58,7 +39,6 @@ sed -i \
 %build
 %set_build_flags
 %make_build V=1 CFLAGS="$CFLAGS -I./" -f makefile.shared
-make V=1 -f makefile poster manual docs
 
 %install
 %make_install V=1 CFLAGS="$CFLAGS -I./" PREFIX=%{_prefix} LIBPATH=%{_libdir} -f makefile.shared
@@ -77,8 +57,5 @@ find %{buildroot} -name '*.a' -delete
 %{_libdir}/*.so
 %{_libdir}/pkgconfig/*.pc
 
-%files doc
-%doc doc/bn.pdf doc/poster.pdf doc/tommath.pdf
-
 %changelog
 %autochangelog

sources

@@ -1 +1 @@
-SHA512 (libtommath-1.1.0.tar.gz) = 264942414033be70fb73590ec65912a3e8c6ee9c00fb0ce5b684a861af4804b6ccfb8d01821cc5c61348768b44c9c11fd58af0b54d654366329b01b56c644ea7
+SHA512 (libtommath-1.2.0.tar.gz) = 500bce4467d6cdb0b014e6c66d3b994a8d63b51475db6c3cd77c15c8368fbab4e3b5c458fcd5b35838b74c457a33c15b42d2356964f5ef2a0bd31fd544735c9a