From 9ed40ac39c69002adb049f26747fe8c3f6813a16 Mon Sep 17 00:00:00 2001
From: DistroBaker <osci-list@redhat.com>
Date: Mon, 23 Nov 2020 15:05:26 +0000
Subject: [PATCH] Merged update from upstream sources

This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/perl-Convert-ASN1.git#509ce3dde9a6941484e3b90040f1bfcfb5703f1d
---
 Convert-ASN1-0.27-CVE-2013-7488.patch | 45 +++++++++++++++++++++++++++
 perl-Convert-ASN1.spec                |  9 +++++-
 2 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 Convert-ASN1-0.27-CVE-2013-7488.patch

diff --git a/Convert-ASN1-0.27-CVE-2013-7488.patch b/Convert-ASN1-0.27-CVE-2013-7488.patch
new file mode 100644
index 0000000..4bc9a6f
--- /dev/null
+++ b/Convert-ASN1-0.27-CVE-2013-7488.patch
@@ -0,0 +1,45 @@
+From ce148a2e0872b708450005cf0b3a944014aae990 Mon Sep 17 00:00:00 2001
+From: Dana Jacobsen <dana@acm.org>
+Date: Tue, 29 Oct 2013 08:37:48 -0700
+Subject: [PATCH 1/2] Fix unsafe decoding in indef case
+
+Bug: https://github.com/gbarr/perl-Convert-ASN1/pull/15
+---
+ lib/Convert/ASN1/_decode.pm | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/Convert/ASN1/_decode.pm b/lib/Convert/ASN1/_decode.pm
+index e811e8d..eb2b584 100644
+--- a/lib/Convert/ASN1/_decode.pm
++++ b/lib/Convert/ASN1/_decode.pm
+@@ -685,6 +685,7 @@ sub _scan_indef {
+     if((unpack("C",$tag) & 0x1f) == 0x1f) {
+       my $b;
+       do {
++	return if $pos >= $end;
+ 	$tag .= substr($_[0],$pos++,1);
+ 	$b = ord substr($tag,-1);
+       } while($b & 0x80);
+
+From 8125d99e15596fee1b5f904ed74a76bccf54082d Mon Sep 17 00:00:00 2001
+From: Dana Jacobsen <dana@acm.org>
+Date: Tue, 29 Oct 2013 08:53:09 -0700
+Subject: [PATCH 2/2] Add second part of position check
+
+Bug: https://github.com/gbarr/perl-Convert-ASN1/pull/15
+---
+ lib/Convert/ASN1/_decode.pm | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/Convert/ASN1/_decode.pm b/lib/Convert/ASN1/_decode.pm
+index eb2b584..67b95aa 100644
+--- a/lib/Convert/ASN1/_decode.pm
++++ b/lib/Convert/ASN1/_decode.pm
+@@ -679,6 +679,7 @@ sub _scan_indef {
+       $pos += 2;
+       next;
+     }
++    return if $pos >= $end;
+ 
+     my $tag = substr($_[0], $pos++, 1);
+ 
diff --git a/perl-Convert-ASN1.spec b/perl-Convert-ASN1.spec
index 54c3abc..a2e962f 100644
--- a/perl-Convert-ASN1.spec
+++ b/perl-Convert-ASN1.spec
@@ -4,7 +4,7 @@
 Summary:        ASN.1 encode/decode library
 Name:           perl-Convert-ASN1
 Version:        0.27
-Release:        20%{?dist}
+Release:        21%{?dist}
 License:        GPL+ or Artistic
 URL:            https://metacpan.org/release/Convert-ASN1
 Source0:        https://cpan.metacpan.org/authors/id/G/GB/GBARR/Convert-ASN1-%{version}.tar.gz
@@ -13,6 +13,9 @@ Patch0:         Convert-ASN1-0.27-Correct-shebangs-in-tests.patch
 # Allow running tests from a read-only location,
 # <https://github.com/gbarr/perl-Convert-ASN1/pull/40>
 Patch1:         Convert-ASN1-0.27-Use-temporary-output-files-for-tests.patch
+# Fix unsafe decoding in indef case,
+# <https://github.com/gbarr/perl-Convert-ASN1/pull/15>
+Patch2:         Convert-ASN1-0.27-CVE-2013-7488.patch
 BuildArch:      noarch
 BuildRequires:  coreutils
 BuildRequires:  make
@@ -74,6 +77,7 @@ with "%{_libexecdir}/%{name}/test".
 %setup -q -n Convert-ASN1-%{version}
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 chmod +x t/*.t
 
 %build
@@ -105,6 +109,9 @@ make test
 %{_libexecdir}/%{name}
 
 %changelog
+* Mon Nov 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 0.27-21
+- Fix unsafe decoding in indef case (CVE-2013-7488)
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.27-20
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild