From 9fe2d204529994d2d17ee67af24ad694b45dca0f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Veronika=20Hanul=C3=ADkov=C3=A1?= Date: Thu, 14 Nov 2024 14:40:59 +0100 Subject: [PATCH] opensc-0.26.0-1 Resolves: RHEL-64698 --- .gitignore | 1 + opensc-0.25.1-sast.patch | 186 --------------------------------------- opensc.spec | 14 ++- sources | 2 +- 4 files changed, 8 insertions(+), 195 deletions(-) delete mode 100644 opensc-0.25.1-sast.patch diff --git a/.gitignore b/.gitignore index b1ad97f..9697c08 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /opensc-0.24.0.tar.gz /opensc-0.25.0.tar.gz /opensc-0.25.1.tar.gz +/opensc-0.26.0.tar.gz diff --git a/opensc-0.25.1-sast.patch b/opensc-0.25.1-sast.patch deleted file mode 100644 index 4e8b220..0000000 --- a/opensc-0.25.1-sast.patch +++ /dev/null @@ -1,186 +0,0 @@ -From 86eabd42ea7c93d23258c70ea79ea3ed4f3110f8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Veronika=20Hanul=C3=ADkov=C3=A1?= -Date: Wed, 22 May 2024 09:55:04 +0200 -Subject: [PATCH 1/4] card-piv: Fix integer overflow - ---- - src/libopensc/card-piv.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/libopensc/card-piv.c b/src/libopensc/card-piv.c -index c3a305799..ca071c58e 100644 ---- a/src/libopensc/card-piv.c -+++ b/src/libopensc/card-piv.c -@@ -3408,11 +3408,11 @@ piv_put_data(sc_card_t *card, int tag, const u8 *buf, size_t buf_len) - SC_FUNC_CALLED(card->ctx, SC_LOG_DEBUG_VERBOSE); - - tag_len = piv_objects[tag].tag_len; -- sbuflen = sc_asn1_put_tag(0x5c, piv_objects[tag].tag_value, tag_len, NULL, 0, NULL); -- if (sbuflen <= 0) { -+ r = sc_asn1_put_tag(0x5c, piv_objects[tag].tag_value, tag_len, NULL, 0, NULL); -+ if (r <= 0) { - LOG_FUNC_RETURN(card->ctx, SC_ERROR_INTERNAL); - } -- sbuflen += buf_len; -+ sbuflen = r + buf_len; - if (!(sbuf = malloc(sbuflen))) { - LOG_FUNC_RETURN(card->ctx, SC_ERROR_OUT_OF_MEMORY); - } --- -2.44.0 - - -From 6923b97d59f8a5a636223a36465912e0c640a534 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Veronika=20Hanul=C3=ADkov=C3=A1?= -Date: Wed, 22 May 2024 10:11:46 +0200 -Subject: [PATCH 2/4] iso7816.c: Check length of file_ref to prevent buffer - overrun - ---- - src/libopensc/iso7816.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/libopensc/iso7816.c b/src/libopensc/iso7816.c -index 73893e941..98c059bdc 100644 ---- a/src/libopensc/iso7816.c -+++ b/src/libopensc/iso7816.c -@@ -1003,7 +1003,7 @@ iso7816_set_security_env(struct sc_card *card, - *p++ = env->algorithm_ref & 0xFF; - } - if (env->flags & SC_SEC_ENV_FILE_REF_PRESENT) { -- if (env->file_ref.len > 0xFF) -+ if (env->file_ref.len > SC_MAX_PATH_SIZE) - return SC_ERROR_INVALID_ARGUMENTS; - if (sizeof(sbuf) - (p - sbuf) < env->file_ref.len + 2) - return SC_ERROR_OFFSET_TOO_LARGE; --- -2.44.0 - - -From 6ceb50e271f4b67ec934aae5f8383475e1bd58ea Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Veronika=20Hanul=C3=ADkov=C3=A1?= -Date: Thu, 23 May 2024 10:04:08 +0200 -Subject: [PATCH 3/4] iso7816.c: Check length of key_ref_len to prevent buffer - overrun - ---- - src/libopensc/iso7816.c | 2 +- - src/libopensc/opensc.h | 2 +- - src/libopensc/types.h | 1 + - 3 files changed, 3 insertions(+), 2 deletions(-) - -diff --git a/src/libopensc/iso7816.c b/src/libopensc/iso7816.c -index 98c059bdc..d7e044993 100644 ---- a/src/libopensc/iso7816.c -+++ b/src/libopensc/iso7816.c -@@ -1021,7 +1021,7 @@ iso7816_set_security_env(struct sc_card *card, - *p++ = 0x83; - else - *p++ = 0x84; -- if (env->key_ref_len > 0xFF) -+ if (env->key_ref_len > SC_MAX_KEYREF_SIZE) - return SC_ERROR_INVALID_ARGUMENTS; - *p++ = env->key_ref_len & 0xFF; - memcpy(p, env->key_ref, env->key_ref_len); -diff --git a/src/libopensc/opensc.h b/src/libopensc/opensc.h -index cbcb3bebb..5faf590ae 100644 ---- a/src/libopensc/opensc.h -+++ b/src/libopensc/opensc.h -@@ -251,7 +251,7 @@ typedef struct sc_security_env { - - unsigned long algorithm_ref; - struct sc_path file_ref; -- unsigned char key_ref[8]; -+ unsigned char key_ref[SC_MAX_KEYREF_SIZE]; - size_t key_ref_len; - struct sc_path target_file_ref; /* target key file in unwrap operation */ - -diff --git a/src/libopensc/types.h b/src/libopensc/types.h -index 7eea3fa82..304725a67 100644 ---- a/src/libopensc/types.h -+++ b/src/libopensc/types.h -@@ -50,6 +50,7 @@ typedef unsigned char u8; - #define SC_MAX_CRTS_IN_SE 12 - #define SC_MAX_SE_NUM 8 - #define SC_MAX_PKCS15_EMULATORS 48 -+#define SC_MAX_KEYREF_SIZE 8 - - /* When changing this value, pay attention to the initialization of the ASN1 - * static variables that use this macro, like, for example, --- -2.44.0 - - -From 42d4950b9804a6c057586e0e6cb614205818c411 Mon Sep 17 00:00:00 2001 -From: Jakub Jelen -Date: Thu, 9 May 2024 18:53:15 +0200 -Subject: [PATCH 4/4] pkcs15init: Avoid memory leaks - ---- - src/pkcs15init/pkcs15-lib.c | 23 +++++++++++++++-------- - 1 file changed, 15 insertions(+), 8 deletions(-) - -diff --git a/src/pkcs15init/pkcs15-lib.c b/src/pkcs15init/pkcs15-lib.c -index 0dc62af4a..dbb5748b2 100644 ---- a/src/pkcs15init/pkcs15-lib.c -+++ b/src/pkcs15init/pkcs15-lib.c -@@ -1888,8 +1888,10 @@ sc_pkcs15init_store_public_key(struct sc_pkcs15_card *p15card, struct sc_profile - key.u.rsa.modulus.data = NULL; - key.u.rsa.exponent.data = NULL; - // copy RSA params -- if (!(key.u.rsa.modulus.data = malloc(keyargs->key.u.rsa.modulus.len))) -- LOG_TEST_RET(ctx, SC_ERROR_OUT_OF_MEMORY, "Failed to copy RSA public key parameters"); -+ if (!(key.u.rsa.modulus.data = malloc(keyargs->key.u.rsa.modulus.len))) { -+ r = SC_ERROR_OUT_OF_MEMORY; -+ LOG_TEST_GOTO_ERR(ctx, r, "Failed to copy RSA public key parameters"); -+ } - memcpy(key.u.rsa.modulus.data, keyargs->key.u.rsa.modulus.data, keyargs->key.u.rsa.modulus.len); - if (!(key.u.rsa.exponent.data = malloc(keyargs->key.u.rsa.exponent.len))) { - r = SC_ERROR_OUT_OF_MEMORY; -@@ -1902,8 +1904,10 @@ sc_pkcs15init_store_public_key(struct sc_pkcs15_card *p15card, struct sc_profile - case SC_ALGORITHM_GOSTR3410: - key.u.gostr3410.xy.data = NULL; - // copy GOSTR params -- if (!(key.u.gostr3410.xy.data = malloc(keyargs->key.u.gostr3410.xy.len))) -- LOG_TEST_RET(ctx, SC_ERROR_OUT_OF_MEMORY, "Failed to copy GOSTR public key parameters"); -+ if (!(key.u.gostr3410.xy.data = malloc(keyargs->key.u.gostr3410.xy.len))) { -+ r = SC_ERROR_OUT_OF_MEMORY; -+ LOG_TEST_GOTO_ERR(ctx, r, "Failed to copy GOSTR public key parameters"); -+ } - memcpy(key.u.gostr3410.xy.data, keyargs->key.u.gostr3410.xy.data, keyargs->key.u.gostr3410.xy.len); - keybits = SC_PKCS15_GOSTR3410_KEYSIZE; - type = SC_PKCS15_TYPE_PUBKEY_GOSTR3410; -@@ -1912,14 +1916,15 @@ sc_pkcs15init_store_public_key(struct sc_pkcs15_card *p15card, struct sc_profile - type = SC_PKCS15_TYPE_PUBKEY_EC; - - r = sc_copy_ec_params(&key.u.ec.params, &keyargs->key.u.ec.params); -- LOG_TEST_RET(ctx, r, "Failed to copy EC public key parameters"); -+ LOG_TEST_GOTO_ERR(ctx, r, "Failed to copy EC public key parameters"); - r = sc_pkcs15_fix_ec_parameters(ctx, &key.u.ec.params); - LOG_TEST_GOTO_ERR(ctx, r, "Failed to fix EC public key parameters"); - - keybits = key.u.ec.params.field_length; - break; - default: -- LOG_TEST_RET(ctx, SC_ERROR_NOT_SUPPORTED, "Unsupported key algorithm."); -+ r = SC_ERROR_NOT_SUPPORTED; -+ LOG_TEST_GOTO_ERR(ctx, r, "Unsupported key algorithm."); - } - - if ((usage = keyargs->usage) == 0) { -@@ -1933,8 +1938,10 @@ sc_pkcs15init_store_public_key(struct sc_pkcs15_card *p15card, struct sc_profile - - /* Set up the pkcs15 object. */ - object = sc_pkcs15init_new_object(type, label, &keyargs->auth_id, NULL); -- if (object == NULL) -- LOG_TEST_RET(ctx, SC_ERROR_OUT_OF_MEMORY, "Cannot allocate new public key object"); -+ if (object == NULL) { -+ r = SC_ERROR_OUT_OF_MEMORY; -+ LOG_TEST_GOTO_ERR(ctx, r, "Cannot allocate new public key object"); -+ } - - key_info = (struct sc_pkcs15_pubkey_info *) object->data; - key_info->usage = usage; --- -2.44.0 - diff --git a/opensc.spec b/opensc.spec index d4ce50a..1350212 100644 --- a/opensc.spec +++ b/opensc.spec @@ -1,6 +1,6 @@ Name: opensc -Version: 0.25.1 -Release: 5%{?dist} +Version: 0.26.0 +Release: 1%{?dist} Summary: Smart card library and applications License: LGPL-2.1-or-later AND BSD-3-Clause @@ -10,11 +10,6 @@ Source1: opensc.module Patch1: opensc-0.19.0-pinpad.patch # File caching by default (#2000626) Patch8: %{name}-0.22.0-file-cache.patch -# https://github.com/OpenSC/OpenSC/pull/3153/commits/27033005fc41c86f3b7d436ab74774bad2bc4727 -# https://github.com/OpenSC/OpenSC/pull/3153/commits/2761afdecabddd8ab4ab5e079d046611168ce7b0 -# https://github.com/OpenSC/OpenSC/pull/3153/commits/c6d4881228e359cf4da24003608890367366be26 -# https://github.com/OpenSC/OpenSC/pull/3143/commits/d3ae13af0b198f2cfbc254cc23f66d3790d76c0c -Patch9: %{name}-0.25.1-sast.patch BuildRequires: make BuildRequires: pcsc-lite-devel @@ -58,7 +53,6 @@ every software/card that does so, too. %setup -q %patch 1 -p1 -b .pinpad %patch 8 -p1 -b .file-cache -%patch 9 -p1 -b .sast XFAIL_TESTS="test-pkcs11-tool-test-threads.sh test-pkcs11-tool-test.sh" @@ -198,6 +192,10 @@ rm %{buildroot}%{_mandir}/man1/opensc-notify.1* %changelog +* Thu Nov 14 2024 Veronika Hanulikova - 0.26.0-1 +- Rebase to new upstream release (RHEL-64698) +- Change expected test failures in FIPS mode + * Tue Oct 29 2024 Troy Dawson - 0.25.1-5 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 diff --git a/sources b/sources index 78bcdf2..7a070e5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (opensc-0.25.1.tar.gz) = 6277abb31f903af68b4c19f549fc881b69d7aa9a55ba39936386118eadde86b62853ba2906cd165d9b1ad9090e1aa4d2b236bf19650aa228ed776b3f4d9f8805 +SHA512 (opensc-0.26.0.tar.gz) = 99d88e6f83eb8b6d349bd88d51df652bc44973ac9397d516ad503c256d664a842698093b4e50e0877ece5f05151b5575fc39220620c82c7a000c971f8c98449f