From 55958c1edbba8cc735c8f49041fad76946b5bc80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 20 Sep 2022 12:03:33 +0200
Subject: [PATCH] Fix CVE-2022-38177

5961.	[security]	Fix memory leak in ECDSA verify processing.
			(CVE-2022-38177) [GL #3487]

Resolves: CVE-2022-38177
---
 bind-9.16-CVE-2022-38177.patch | 27 +++++++++++++++++++++++++++
 bind.spec                      |  3 +++
 2 files changed, 30 insertions(+)
 create mode 100644 bind-9.16-CVE-2022-38177.patch

diff --git a/bind-9.16-CVE-2022-38177.patch b/bind-9.16-CVE-2022-38177.patch
new file mode 100644
index 0000000..e510079
--- /dev/null
+++ b/bind-9.16-CVE-2022-38177.patch
@@ -0,0 +1,27 @@
+From df8222fb189708199a185f73543b6e0602c1c72f Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 20 Sep 2022 11:21:45 +0200
+Subject: [PATCH 3/4] Fix CVE-2022-38177
+
+5961.	[security]	Fix memory leak in ECDSA verify processing.
+			(CVE-2022-38177) [GL #3487]
+---
+ lib/dns/opensslecdsa_link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
+index ce4c8c4..3847896 100644
+--- a/lib/dns/opensslecdsa_link.c
++++ b/lib/dns/opensslecdsa_link.c
+@@ -228,7 +228,7 @@ opensslecdsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
+ 	}
+ 
+ 	if (sig->length != siglen) {
+-		return (DST_R_VERIFYFAILURE);
++		DST_RET(DST_R_VERIFYFAILURE);
+ 	}
+ 
+ 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &dgstlen)) {
+-- 
+2.37.3
+
diff --git a/bind.spec b/bind.spec
index 0742f91..0da82c0 100644
--- a/bind.spec
+++ b/bind.spec
@@ -106,6 +106,7 @@ Patch172:bind-9.16-CVE-2022-0396.patch
 Patch173:bind-9.16-CVE-2021-25220.patch
 Patch174:bind-9.16-CVE-2021-25220-test.patch
 Patch175:bind-9.16-CVE-2022-3080.patch
+Patch176:bind-9.16-CVE-2022-38177.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -410,6 +411,7 @@ in HTML and PDF format.
 %patch173 -p1 -b .CVE-2021-25220
 %patch174 -p1 -b .CVE-2021-25220-test
 %patch175 -p1 -b .CVE-2022-3080
+%patch176 -p1 -b .CVE-2022-38177
 
 %if %{with PKCS11}
 %patch135 -p1 -b .config-pkcs11
@@ -1134,6 +1136,7 @@ fi;
 %changelog
 * Thu Sep 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-5
 - Fix possible serve-stale related crash (CVE-2022-3080)
+- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
 
 * Thu Jul 14 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-4
 - Export bind-doc package (#2104863)