Compare commits

...

No commits in common. "c10s" and "c9-beta" have entirely different histories.

11 changed files with 3 additions and 326 deletions

8
.gitignore vendored
View File

@ -1,7 +1 @@
libotr-3.0.0.tar.gz
libotr-3.1.0.tar.gz
libotr-3.2.0.tar.gz
/libotr-3.2.1.tar.gz
/libotr-4.0.0.tar.gz
/libotr-4.1.0.tar.gz
/libotr-4.1.1.tar.gz
SOURCES/libotr-4.1.1.tar.gz

1
.libotr.metadata Normal file
View File

@ -0,0 +1 @@
3894b82a6c307ad011681ad342d69b18344933ae SOURCES/libotr-4.1.1.tar.gz

View File

@ -2,10 +2,9 @@
Summary: Off-The-Record Messaging library and toolkit
Name: libotr
Version: 4.1.1
Release: 14%{?dist}
Release: 13%{?dist}
License: GPLv2 and LGPLv2
Source0: http://otr.cypherpunks.ca/%{name}-%{version}.tar.gz
Patch1: libotr-4.1.1-ftbfs.patch
Url: http://otr.cypherpunks.ca/
Provides: libotr-toolkit = %{version}
Obsoletes: libotr-toolkit < %{version}
@ -34,7 +33,6 @@ The devel package contains the libotr library and include files.
%prep
%setup -q
%patch1 -p1 -b .ftbfs
%if %{snapshot}
aclocal
@ -74,10 +72,6 @@ rm -rf $RPM_BUILD_ROOT%{_libdir}/*.la
%changelog
* Wed Jul 6 2022 Joe Orton <jorton@redhat.com> - 4.1.1-14
- fix FTBFS
Resolves: rhbz#2100647
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 4.1.1-13
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688

View File

@ -1,8 +0,0 @@
--- !Policy
product_versions:
- rhel-9
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation}
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.acceptance-tier.functional}

View File

@ -1,154 +0,0 @@
diff --git a/src/b64.c b/src/b64.c
index b8736da..9e35251 100644
--- a/src/b64.c
+++ b/src/b64.c
@@ -55,7 +55,7 @@ VERSION HISTORY:
\******************************************************************* */
/* system headers */
-#include <stdlib.h>
+#include <stdio.h>
#include <string.h>
/* libotr headers */
@@ -147,8 +147,9 @@ static size_t decode(unsigned char *out, const char *in, size_t b64len)
* base64 decode data. Skip non-base64 chars, and terminate at the
* first '=', or the end of the buffer.
*
- * The buffer data must contain at least (base64len / 4) * 3 bytes of
- * space. This function will return the number of bytes actually used.
+ * The buffer data must contain at least ((base64len+3) / 4) * 3 bytes
+ * of space. This function will return the number of bytes actually
+ * used.
*/
size_t otrl_base64_decode(unsigned char *data, const char *base64data,
size_t base64len)
@@ -234,13 +235,18 @@ int otrl_base64_otr_decode(const char *msg, unsigned char **bufp,
return -2;
}
+ /* Skip over the "?OTR:" */
+ otrtag += 5;
+ msglen -= 5;
+
/* Base64-decode the message */
- rawlen = ((msglen-5) / 4) * 3; /* maximum possible */
+ rawlen = OTRL_B64_MAX_DECODED_SIZE(msglen); /* maximum possible */
rawmsg = malloc(rawlen);
if (!rawmsg && rawlen > 0) {
return -1;
}
- rawlen = otrl_base64_decode(rawmsg, otrtag+5, msglen-5); /* actual size */
+
+ rawlen = otrl_base64_decode(rawmsg, otrtag, msglen); /* actual size */
*bufp = rawmsg;
*lenp = rawlen;
diff --git a/src/b64.h b/src/b64.h
index 34ef03f..dd0e115 100644
--- a/src/b64.h
+++ b/src/b64.h
@@ -20,6 +20,19 @@
#ifndef __B64_H__
#define __B64_H__
+#include <stdlib.h>
+
+/* Base64 encodes blocks of this many bytes: */
+#define OTRL_B64_DECODED_LEN 3
+/* into blocks of this many bytes: */
+#define OTRL_B64_ENCODED_LEN 4
+
+/* An encoded block of length encoded_len can turn into a maximum of
+ * this many decoded bytes: */
+#define OTRL_B64_MAX_DECODED_SIZE(encoded_len) \
+ (((encoded_len + OTRL_B64_ENCODED_LEN - 1) / OTRL_B64_ENCODED_LEN) \
+ * OTRL_B64_DECODED_LEN)
+
/*
* base64 encode data. Insert no linebreaks or whitespace.
*
@@ -33,8 +46,9 @@ size_t otrl_base64_encode(char *base64data, const unsigned char *data,
* base64 decode data. Skip non-base64 chars, and terminate at the
* first '=', or the end of the buffer.
*
- * The buffer data must contain at least (base64len / 4) * 3 bytes of
- * space. This function will return the number of bytes actually used.
+ * The buffer data must contain at least ((base64len+3) / 4) * 3 bytes
+ * of space. This function will return the number of bytes actually
+ * used.
*/
size_t otrl_base64_decode(unsigned char *data, const char *base64data,
size_t base64len);
diff --git a/src/proto.c b/src/proto.c
index 3f8c987..0374dfe 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -537,13 +537,17 @@ gcry_error_t otrl_proto_data_read_flags(const char *datamsg,
msglen = strlen(otrtag);
}
+ /* Skip over the "?OTR:" */
+ otrtag += 5;
+ msglen -= 5;
+
/* Base64-decode the message */
- rawlen = ((msglen-5) / 4) * 3; /* maximum possible */
+ rawlen = OTRL_B64_MAX_DECODED_SIZE(msglen); /* maximum possible */
rawmsg = malloc(rawlen);
if (!rawmsg && rawlen > 0) {
return gcry_error(GPG_ERR_ENOMEM);
}
- rawlen = otrl_base64_decode(rawmsg, otrtag+5, msglen-5); /* actual size */
+ rawlen = otrl_base64_decode(rawmsg, otrtag, msglen); /* actual size */
bufp = rawmsg;
lenp = rawlen;
@@ -606,14 +610,18 @@ gcry_error_t otrl_proto_accept_data(char **plaintextp, OtrlTLV **tlvsp,
msglen = strlen(otrtag);
}
+ /* Skip over the "?OTR:" */
+ otrtag += 5;
+ msglen -= 5;
+
/* Base64-decode the message */
- rawlen = ((msglen-5) / 4) * 3; /* maximum possible */
+ rawlen = OTRL_B64_MAX_DECODED_SIZE(msglen); /* maximum possible */
rawmsg = malloc(rawlen);
if (!rawmsg && rawlen > 0) {
err = gcry_error(GPG_ERR_ENOMEM);
goto err;
}
- rawlen = otrl_base64_decode(rawmsg, otrtag+5, msglen-5); /* actual size */
+ rawlen = otrl_base64_decode(rawmsg, otrtag, msglen); /* actual size */
bufp = rawmsg;
lenp = rawlen;
diff --git a/toolkit/parse.c b/toolkit/parse.c
index 5f357fc..16718ca 100644
--- a/toolkit/parse.c
+++ b/toolkit/parse.c
@@ -64,7 +64,8 @@ static unsigned char *decode(const char *msg, size_t *lenp)
{
const char *header, *footer;
unsigned char *raw;
-
+ size_t rawlen;
+
/* Find the header */
header = strstr(msg, "?OTR:");
if (!header) return NULL;
@@ -75,8 +76,10 @@ static unsigned char *decode(const char *msg, size_t *lenp)
footer = strchr(header, '.');
if (!footer) footer = header + strlen(header);
- raw = malloc((footer-header) / 4 * 3);
- if (raw == NULL && (footer-header >= 4)) return NULL;
+ rawlen = OTRL_B64_MAX_DECODED_SIZE(footer-header);
+
+ raw = malloc(rawlen);
+ if (raw == NULL && rawlen > 0) return NULL;
*lenp = otrl_base64_decode(raw, header, footer-header);
return raw;

View File

@ -1,33 +0,0 @@
commit 262d0522dea091b9065392563a5a2cd93e7fb17b
Author: Ian Goldberg <iang@cs.uwaterloo.ca>
Date: Sun Oct 13 08:43:49 2013 -0400
Avoid crash even if otrl_proto_query_bestversion is misused
Return 0 instead of crashing from otrl_proto_query_bestversion if passed
an illegal input. Thanks to Conrad Hoffmann <ch@bitfehler.net> for the
report and the patch.
diff --git a/src/proto.c b/src/proto.c
index ce597a2..c2dd24a 100644
--- a/src/proto.c
+++ b/src/proto.c
@@ -294,13 +294,16 @@ unsigned int otrl_proto_query_bestversion(const char *otrquerymsg,
otrtag = strstr(otrquerymsg, "?OTR");
+ if (!otrtag) {
+ return 0;
+ }
otrtag += 4;
- if (otrtag && *otrtag == '?') {
+ if (*otrtag == '?') {
query_versions = (1<<0);
++otrtag;
}
- if (otrtag && *otrtag == 'v') {
+ if (*otrtag == 'v') {
for(++otrtag; *otrtag && *otrtag != '?'; ++otrtag) {
switch(*otrtag) {
case '2':

View File

@ -1,36 +0,0 @@
commit 939e74d3d6b2913beeb2d2718bebaab3f033577b
Author: Andreas Schlick <schlick@lavabit.com>
Date: Tue Dec 18 17:55:24 2012 +0100
Copy lastmessage to the newly created context.
This fixes a case where the first user message
gets lost when OTRL_POLICY_REQUIRE_ENCRYPTION
policy is set because after establishing the
encryption lastmessage remains with the master
context and will not be resent.
[Slightly modified by Ian Goldberg]
diff --git a/src/message.c b/src/message.c
index 7c39529..6b842bc 100644
--- a/src/message.c
+++ b/src/message.c
@@ -1078,9 +1078,14 @@ int otrl_message_receiving(OtrlUserState us, const OtrlMessageAppOps *ops,
/* Copy information from m_context to the new instance context */
context->auth.protocol_version = 3;
context->protocol_version = 3;
-
- if (context_added) {
- context->msgstate = m_context->msgstate;
+ context->msgstate = m_context->msgstate;
+
+ if (m_context->context_priv->may_retransmit) {
+ gcry_free(context->context_priv->lastmessage);
+ context->context_priv->lastmessage = m_context->context_priv->lastmessage;
+ m_context->context_priv->lastmessage = NULL;
+ context->context_priv->may_retransmit = m_context->context_priv->may_retransmit;
+ m_context->context_priv->may_retransmit = 0;
}
if (msgtype == OTRL_MSGTYPE_DH_KEY) {

View File

@ -1,43 +0,0 @@
commit b2967960e594d9e2c84edc5fe331bba531e0def5
Author: Ian Goldberg <iang@cs.uwaterloo.ca>
Date: Wed Jul 17 09:30:52 2013 -0400
Workaround for a crash bug in libgcrypt affecting otr_sesskeys
Passing a private key value of 0 to otr_sesskeys would cause libgcrypt
to crash in gcry_mpi_powm. We reported this libgcrypt bug and it was
then fixed in
http://lists.gnupg.org/pipermail/gcrypt-devel/2013-July/002251.html
but the workaround is simply to use gcry_mpi_new(DH1536_MOD_LEN_BITS)
instead of gcry_mpi_new(0).
Note that this only affected the otr_sesskeys toolkit program, and not
libotr itself.
Thanks to the Mayhem Team at CMU (Alexandre Rebert, Thanassis Avgerinos,
Sang Kil Cha, David Brumley, Manuel Egele) for the report.
diff --git a/toolkit/sesskeys.c b/toolkit/sesskeys.c
index 575e984..d416cde 100644
--- a/toolkit/sesskeys.c
+++ b/toolkit/sesskeys.c
@@ -32,6 +32,7 @@ static const char* DH1536_MODULUS_S = "0x"
"C2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F"
"83655D23DCA3AD961C62F356208552BB9ED529077096966D"
"670C354E4ABC9804F1746C08CA237327FFFFFFFFFFFFFFFF";
+static const int DH1536_MOD_LEN_BITS = 1536;
static const char *DH1536_GENERATOR_S = "0x02";
/* Generate the session id and the two encryption keys from our private
@@ -52,9 +53,9 @@ void sesskeys_gen(unsigned char sessionid[20], unsigned char sendenc[16],
(const unsigned char *)DH1536_MODULUS_S, 0, NULL);
gcry_mpi_scan(&generator, GCRYMPI_FMT_HEX,
(const unsigned char *)DH1536_GENERATOR_S, 0, NULL);
- *our_yp = gcry_mpi_new(0);
+ *our_yp = gcry_mpi_new(DH1536_MOD_LEN_BITS);
gcry_mpi_powm(*our_yp, generator, our_x, modulus);
- secretv = gcry_mpi_new(0);
+ secretv = gcry_mpi_new(DH1536_MOD_LEN_BITS);
gcry_mpi_powm(secretv, their_y, our_x, modulus);
gcry_mpi_release(generator);
gcry_mpi_release(modulus);

View File

@ -1,24 +0,0 @@
commit d748757e581b74e7298df155ad49174cb914102b
Author: David Goulet <dgoulet@ev0ke.net>
Date: Sat Jan 19 15:53:23 2013 -0500
Fix: pass opdata when sending message fragment
The inject_message callback was missing the opdata when sending message
fragments.
Signed-off-by: David Goulet <dgoulet@ev0ke.net>
diff --git a/src/message.c b/src/message.c
index 6b842bc..fe6957c 100644
--- a/src/message.c
+++ b/src/message.c
@@ -441,7 +441,7 @@ fragment:
/* Fragment and send according to policy */
if (!err && messagep && *messagep) {
if (context) {
- err = fragment_and_send(ops, NULL, context, *messagep,
+ err = fragment_and_send(ops, opdata, context, *messagep,
fragPolicy, messagep);
}
}

View File

@ -1,13 +0,0 @@
https://bugzilla.redhat.com/show_bug.cgi?id=2100647
--- libotr-4.1.1/tests/regression/client/client.c.ftbfs
+++ libotr-4.1.1/tests/regression/client/client.c
@@ -27,6 +27,7 @@
#include <syscall.h>
#include <sys/epoll.h>
#include <sys/types.h>
+#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>

View File

@ -1 +0,0 @@
dac5a8778a35f674c046ddf5d97e4d81 libotr-4.1.1.tar.gz