From 562df69a6c7a8b628524c31f69f7746a1f727023635d83fcb64bb82b4ca01dc5 Mon Sep 17 00:00:00 2001 From: Gary Ching-Pang Lin Date: Wed, 20 Mar 2024 08:54:24 +0000 Subject: [PATCH] Accepting request 1159787 from home:gary_lin:branches:Base:System - Add pesign-bsc1221694-fix-reversed-calloc-arguments.patch to fix the parameters for calloc() (bsc#1221694) OBS-URL: https://build.opensuse.org/request/show/1159787 OBS-URL: https://build.opensuse.org/package/show/Base:System/pesign?expand=0&rev=81 --- ...221694-fix-reversed-calloc-arguments.patch | 41 +++++++++++++++++++ pesign.changes | 6 +++ pesign.spec | 3 +- 3 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 pesign-bsc1221694-fix-reversed-calloc-arguments.patch diff --git a/pesign-bsc1221694-fix-reversed-calloc-arguments.patch b/pesign-bsc1221694-fix-reversed-calloc-arguments.patch new file mode 100644 index 0000000..c65a479 --- /dev/null +++ b/pesign-bsc1221694-fix-reversed-calloc-arguments.patch @@ -0,0 +1,41 @@ +From 1f9e2fa0b4d872fdd01ca3ba81b04dfb1211a187 Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Fri, 2 Feb 2024 09:32:48 -0500 +Subject: [PATCH] Fix reversed calloc() arguments + +The prototype is "void *calloc(size_t nelem, size_t elsize);" + +These two instances had them reversed, almost certainly leading to +buffer overflow issues. This was detected by +-Werror=calloc-transposed-args on gcc. + +Signed-off-by: Stephen Gallagher +--- + src/pesigcheck.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/pesigcheck.c b/src/pesigcheck.c +index 6dc67f7..8119cf1 100644 +--- a/src/pesigcheck.c ++++ b/src/pesigcheck.c +@@ -240,7 +240,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, + + cert_iter iter; + +- reasonps = calloc(sizeof(struct reason), 512); ++ reasonps = calloc(512, sizeof(struct reason)); + if (!reasonps) + err(1, "check_signature"); + +@@ -281,7 +281,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, + + num_reasons += 16; + +- new_reasons = calloc(sizeof(struct reason), num_reasons); ++ new_reasons = calloc(num_reasons, sizeof(struct reason)); + if (!new_reasons) + err(1, "check_signature"); + reasonps = new_reasons; +-- +2.35.3 + diff --git a/pesign.changes b/pesign.changes index f274e1f..71bcd1f 100644 --- a/pesign.changes +++ b/pesign.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Wed Mar 20 08:44:54 UTC 2024 - Gary Ching-Pang Lin + +- Add pesign-bsc1221694-fix-reversed-calloc-arguments.patch to + fix the parameters for calloc() (bsc#1221694) + ------------------------------------------------------------------- Thu Nov 2 03:20:49 UTC 2023 - Gary Ching-Pang Lin diff --git a/pesign.spec b/pesign.spec index 0cff7c3..1f21516 100644 --- a/pesign.spec +++ b/pesign.spec @@ -1,7 +1,7 @@ # # spec file for package pesign # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2024 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -39,6 +39,7 @@ Patch7: pesign-bsc1202933-Remove-pesign-authorize.patch Patch8: pesign-bsc1202933-Make-etc-pki-pesign-writeable.patch Patch9: pesign-fix-cert-match-check.patch Patch10: pesign-fix-efikeygen-segfault.patch +Patch11: pesign-bsc1221694-fix-reversed-calloc-arguments.patch BuildRequires: efivar-devel >= 38 BuildRequires: libuuid-devel BuildRequires: mandoc