import gnutls-3.6.14-6.el8

SOURCES/gnutls-3.6.14-fix-iovec-memory-leak.patch

@@ -0,0 +1,152 @@
+From 6fbff7fc8aabeee2254405f254220bbe8c05c67d Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Fri, 5 Jun 2020 16:26:33 +0200
+Subject: [PATCH] crypto-api: always allocate memory when serializing iovec_t
+
+The AEAD iov interface falls back to serializing the input buffers if
+the low-level cipher doesn't support scatter/gather encryption.
+However, there was a bug in the functions used for the serialization,
+which causes memory leaks under a certain condition (i.e. the number
+of input buffers is 1).
+
+This patch makes the logic of the functions simpler, by removing a
+micro-optimization that tries to minimize the number of calls to
+malloc/free.
+
+The original problem was reported by Marius Steffen in:
+https://bugzilla.samba.org/show_bug.cgi?id=14399
+and the cause was investigated by Alexander Haase in:
+https://gitlab.com/gnutls/gnutls/-/merge_requests/1277
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/crypto-api.c        | 36 +++++++++++-------------------------
+ tests/aead-cipher-vec.c | 33 ++++++++++++++++++---------------
+ 2 files changed, 29 insertions(+), 40 deletions(-)
+
+diff --git a/lib/crypto-api.c b/lib/crypto-api.c
+index 45be64ed1..8524f5ed4 100644
+--- a/lib/crypto-api.c
++++ b/lib/crypto-api.c
+@@ -891,32 +891,23 @@ gnutls_aead_cipher_encrypt(gnutls_aead_cipher_hd_t handle,
+ struct iov_store_st {
+ 	void *data;
+ 	size_t size;
+-	unsigned allocated;
+ };
+ 
+ static void iov_store_free(struct iov_store_st *s)
+ {
+-	if (s->allocated) {
+-		gnutls_free(s->data);
+-		s->allocated = 0;
+-	}
++	gnutls_free(s->data);
+ }
+ 
+ static int iov_store_grow(struct iov_store_st *s, size_t length)
+ {
+-	if (s->allocated || s->data == NULL) {
+-		s->size += length;
+-		s->data = gnutls_realloc(s->data, s->size);
+-		if (s->data == NULL)
+-			return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
+-		s->allocated = 1;
+-	} else {
+-		void *data = s->data;
+-		size_t size = s->size + length;
+-		s->data = gnutls_malloc(size);
+-		memcpy(s->data, data, s->size);
+-		s->size += length;
+-	}
++	void *data;
++
++	s->size += length;
++	data = gnutls_realloc(s->data, s->size);
++	if (data == NULL)
++		return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
++
++	s->data = data;
+ 	return 0;
+ }
+ 
+@@ -926,11 +917,6 @@ copy_from_iov(struct iov_store_st *dst, const giovec_t *iov, int iovcnt)
+ 	memset(dst, 0, sizeof(*dst));
+ 	if (iovcnt == 0) {
+ 		return 0;
+-	} else if (iovcnt == 1) {
+-		dst->data = iov[0].iov_base;
+-		dst->size = iov[0].iov_len;
+-		/* implies: dst->allocated = 0; */
+-		return 0;
+ 	} else {
+ 		int i;
+ 		uint8_t *p;
+@@ -944,11 +930,11 @@ copy_from_iov(struct iov_store_st *dst, const giovec_t *iov, int iovcnt)
+ 
+ 		p = dst->data;
+ 		for (i=0;i<iovcnt;i++) {
+-			memcpy(p, iov[i].iov_base, iov[i].iov_len);
++			if (iov[i].iov_len > 0)
++				memcpy(p, iov[i].iov_base, iov[i].iov_len);
+ 			p += iov[i].iov_len;
+ 		}
+ 
+-		dst->allocated = 1;
+ 		return 0;
+ 	}
+ }
+diff --git a/tests/aead-cipher-vec.c b/tests/aead-cipher-vec.c
+index fba9010d9..6a30a35f7 100644
+--- a/tests/aead-cipher-vec.c
++++ b/tests/aead-cipher-vec.c
+@@ -49,6 +49,7 @@ static void start(const char *name, int algo)
+ 	giovec_t auth_iov[2];
+ 	uint8_t tag[64];
+ 	size_t tag_size = 0;
++	size_t i;
+ 
+ 	key.data = key16;
+ 	key.size = gnutls_cipher_get_key_size(algo);
+@@ -82,21 +83,23 @@ static void start(const char *name, int algo)
+ 	if (ret < 0)
+ 		fail("gnutls_cipher_init: %s\n", gnutls_strerror(ret));
+ 
+-	ret = gnutls_aead_cipher_encryptv2(ch,
+-					   iv.data, iv.size,
+-					   auth_iov, 2,
+-					   iov, 3,
+-					   tag, &tag_size);
+-	if (ret < 0)
+-		fail("could not encrypt data: %s\n", gnutls_strerror(ret));
+-
+-	ret = gnutls_aead_cipher_decryptv2(ch,
+-					   iv.data, iv.size,
+-					   auth_iov, 2,
+-					   iov, 3,
+-					   tag, tag_size);
+-	if (ret < 0)
+-		fail("could not decrypt data: %s\n", gnutls_strerror(ret));
++	for (i = 0; i < 2; i++) {
++		ret = gnutls_aead_cipher_encryptv2(ch,
++						   iv.data, iv.size,
++						   auth_iov, 2,
++						   iov, i + 1,
++						   tag, &tag_size);
++		if (ret < 0)
++			fail("could not encrypt data: %s\n", gnutls_strerror(ret));
++
++		ret = gnutls_aead_cipher_decryptv2(ch,
++						   iv.data, iv.size,
++						   auth_iov, 2,
++						   iov, i + 1,
++						   tag, tag_size);
++		if (ret < 0)
++			fail("could not decrypt data: %s\n", gnutls_strerror(ret));
++	}
+ 
+ 	gnutls_aead_cipher_deinit(ch);
+ }
+-- 
+2.25.4
+

SPECS/gnutls.spec

@@ -1,5 +1,5 @@
 Version:	3.6.14
-Release: 5%{?dist}
+Release: 6%{?dist}
 Patch1:	gnutls-3.2.7-rpath.patch
 Patch2:	gnutls-3.6.4-no-now-guile.patch
 Patch3:	gnutls-3.6.13-enable-intel-cet.patch
@@ -8,6 +8,7 @@ Patch5:	gnutls-3.6.14-fips-mode-check.patch
 Patch6:	gnutls-3.6.14-fips-dh-primes.patch
 Patch7:	gnutls-3.6.14-memcmp.patch
 Patch8:	gnutls-3.6.14-fips-dh-check.patch
+Patch9:	gnutls-3.6.14-fix-iovec-memory-leak.patch
 %bcond_without dane
 %if 0%{?rhel}
 %bcond_with guile
@@ -291,6 +292,9 @@ fi
 %endif
 
 %changelog
+* Mon Aug 24 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-6
+- Fix memory leak when serializing iovec_t (#1844112)
+
 * Sat Jul 18 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-5
 - Perform validation checks on (EC)DH public keys and share secrets (#1855803)