Accepting request 1159787 from home:gary_lin:branches:Base:System

- Add pesign-bsc1221694-fix-reversed-calloc-arguments.patch to
  fix the parameters for calloc() (bsc#1221694)

OBS-URL: https://build.opensuse.org/request/show/1159787
OBS-URL: https://build.opensuse.org/package/show/Base:System/pesign?expand=0&rev=81

pesign-bsc1221694-fix-reversed-calloc-arguments.patch

@@ -0,0 +1,41 @@
+From 1f9e2fa0b4d872fdd01ca3ba81b04dfb1211a187 Mon Sep 17 00:00:00 2001
+From: Stephen Gallagher <sgallagh@redhat.com>
+Date: Fri, 2 Feb 2024 09:32:48 -0500
+Subject: [PATCH] Fix reversed calloc() arguments
+
+The prototype is "void *calloc(size_t nelem, size_t elsize);"
+
+These two instances had them reversed, almost certainly leading to
+buffer overflow issues. This was detected by
+-Werror=calloc-transposed-args on gcc.
+
+Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
+---
+ src/pesigcheck.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/pesigcheck.c b/src/pesigcheck.c
+index 6dc67f7..8119cf1 100644
+--- a/src/pesigcheck.c
++++ b/src/pesigcheck.c
+@@ -240,7 +240,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
+ 
+ 	cert_iter iter;
+ 
+-	reasonps = calloc(sizeof(struct reason), 512);
++	reasonps = calloc(512, sizeof(struct reason));
+ 	if (!reasonps)
+ 		err(1, "check_signature");
+ 
+@@ -281,7 +281,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
+ 
+ 			num_reasons += 16;
+ 
+-			new_reasons = calloc(sizeof(struct reason), num_reasons);
++			new_reasons = calloc(num_reasons, sizeof(struct reason));
+ 			if (!new_reasons)
+ 				err(1, "check_signature");
+ 			reasonps = new_reasons;
+-- 
+2.35.3
+

pesign.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Wed Mar 20 08:44:54 UTC 2024 - Gary Ching-Pang Lin <glin@suse.com>
+
+- Add pesign-bsc1221694-fix-reversed-calloc-arguments.patch to
+  fix the parameters for calloc() (bsc#1221694)
+
 -------------------------------------------------------------------
 Thu Nov  2 03:20:49 UTC 2023 - Gary Ching-Pang Lin <glin@suse.com>
 

pesign.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package pesign
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -39,6 +39,7 @@ Patch7:         pesign-bsc1202933-Remove-pesign-authorize.patch
 Patch8:         pesign-bsc1202933-Make-etc-pki-pesign-writeable.patch
 Patch9:         pesign-fix-cert-match-check.patch
 Patch10:        pesign-fix-efikeygen-segfault.patch
+Patch11:        pesign-bsc1221694-fix-reversed-calloc-arguments.patch
 BuildRequires:  efivar-devel >= 38
 BuildRequires:  libuuid-devel
 BuildRequires:  mandoc