SOURCES/FCGI-0.82-Fix-size_t-overflow-in-Malloc-argument-in-ReadParams.patch

@@ -1,83 +0,0 @@
-From 7c476394e799f39f749d7a7a50f62e5d3ec8db61 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
-Date: Mon, 19 May 2025 13:49:32 +0200
-Subject: [PATCH] Fix size_t overflow in Malloc() argument in ReadParams()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There were still two issues after commit
-b0eabcaf4d4f371514891a52115c746815c2ff15 (Update fcgiapp.c, Fixing an
-integer overflow (CVE-2025-23016)):
-
-* Signed int overflow in "nameLen + valueLen + 2" expression.
-
-* Sizes of size_t and int types are in general unrelated.
-
-This fix resolves both of the issues.
-
-Related to CVE-2025-23016.
-Resolve #67.
-<https://github.com/FastCGI-Archives/fcgi2/pull/77>
-
-Signed-off-by: Petr Písař <ppisar@redhat.com>
----
- libfcgi/fcgiapp.c | 13 ++++++++++---
- 1 file changed, 10 insertions(+), 3 deletions(-)
-
-diff --git a/fcgiapp.c b/fcgiapp.c
-index 99c3630..0cd3dd1 100644
---- a/fcgiapp.c
-+++ b/fcgiapp.c
-@@ -18,6 +18,7 @@
- #include <memory.h>     /* for memchr() */
- #include <stdarg.h>
- #include <stdio.h>
-+#include <stdint.h>
- #include <stdlib.h>
- #include <string.h>
- #include <sys/types.h>
-@@ -1160,6 +1161,7 @@ char *FCGX_GetParam(const char *name, FCGX_ParamArray envp)
- static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
- {
-     int nameLen, valueLen;
-+    size_t totalLen;
-     unsigned char lenBuff[3];
-     char *nameValue;
- 
-@@ -1175,7 +1177,7 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
- 	    }
-             nameLen = ((nameLen & 0x7f) << 24) + (lenBuff[0] << 16)
-                     + (lenBuff[1] << 8) + lenBuff[2];
--	    if (nameLen >= INT_MAX) {
-+	    if (nameLen >= INT_MAX || nameLen >= SIZE_MAX) {
-                 SetError(stream, FCGX_PARAMS_ERROR);
-                 return -1;
- 	    }
-@@ -1191,16 +1193,21 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
- 	    }
-             valueLen = ((valueLen & 0x7f) << 24) + (lenBuff[0] << 16)
-                     + (lenBuff[1] << 8) + lenBuff[2];
--	    if (valueLen >= INT_MAX) {
-+	    if (valueLen >= INT_MAX || valueLen >= SIZE_MAX) {
-                 SetError(stream, FCGX_PARAMS_ERROR);
-                 return -1;
- 	    }
-         }
-+        totalLen = (size_t)nameLen + (size_t)valueLen + 2u;
-+        if (totalLen < (size_t)nameLen || totalLen < (size_t)valueLen) {
-+            SetError(stream, FCGX_PARAMS_ERROR);
-+            return -1;
-+        }
-         /*
-          * nameLen and valueLen are now valid; read the name and value
-          * from stream and construct a standard environment entry.
-          */
--        nameValue = (char *)Malloc(nameLen + valueLen + 2);
-+        nameValue = (char *)Malloc(totalLen);
-         if(FCGX_GetStr(nameValue, nameLen, stream) != nameLen) {
-             SetError(stream, FCGX_PARAMS_ERROR);
-             free(nameValue);
--- 
-2.49.0
-

SOURCES/FCGI-0.82-Update-fcgiapp.c.patch

@@ -1,46 +0,0 @@
-From b0eabcaf4d4f371514891a52115c746815c2ff15 Mon Sep 17 00:00:00 2001
-From: Pycatchown <39068868+Pycatchown@users.noreply.github.com>
-Date: Tue, 8 Apr 2025 17:39:30 +0200
-Subject: [PATCH] Update fcgiapp.c
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fixing an integer overflow (CVE-2025-23016)
-
-<https://github.com/FastCGI-Archives/fcgi2/pull/74>
-
-Signed-off-by: Petr Písař <ppisar@redhat.com>
----
- libfcgi/fcgiapp.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/fcgiapp.c b/fcgiapp.c
-index 4ffe318..99c3630 100644
---- a/fcgiapp.c
-+++ b/fcgiapp.c
-@@ -1175,6 +1175,10 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
- 	    }
-             nameLen = ((nameLen & 0x7f) << 24) + (lenBuff[0] << 16)
-                     + (lenBuff[1] << 8) + lenBuff[2];
-+	    if (nameLen >= INT_MAX) {
-+                SetError(stream, FCGX_PARAMS_ERROR);
-+                return -1;
-+	    }
-         }
-         if((valueLen = FCGX_GetChar(stream)) == EOF) {
-             SetError(stream, FCGX_PARAMS_ERROR);
-@@ -1187,6 +1191,10 @@ static int ReadParams(Params *paramsPtr, FCGX_Stream *stream)
- 	    }
-             valueLen = ((valueLen & 0x7f) << 24) + (lenBuff[0] << 16)
-                     + (lenBuff[1] << 8) + lenBuff[2];
-+	    if (valueLen >= INT_MAX) {
-+                SetError(stream, FCGX_PARAMS_ERROR);
-+                return -1;
-+	    }
-         }
-         /*
-          * nameLen and valueLen are now valid; read the name and value
--- 
-2.49.0
-

SPECS/perl-FCGI.spec

@@ -3,19 +3,11 @@ Summary:        FastCGI Perl bindings
 # needed to properly replace/obsolete fcgi-perl
 Epoch:          1
 Version:        0.78
-Release:        12%{?dist}
+Release:        11%{?dist}
 # same as fcgi
 License:        OML
 
 Source0:        https://cpan.metacpan.org/authors/id/E/ET/ETHER/FCGI-%{version}.tar.gz 
-# 1/2 Fix CVE-2025-40907 in the bundled fcgi library, bug #2366847,
-# <https://github.com/perl-catalyst/FCGI/issues/14>, copied from fcgi2 library
-# <https://github.com/FastCGI-Archives/fcgi2/issues/67>.
-Patch1:         FCGI-0.82-Update-fcgiapp.c.patch
-# 2/2 Fix CVE-2025-40907 in the bundled fcgi library, bug #2366847,
-# <https://github.com/perl-catalyst/FCGI/issues/14>, copied from fcgi2 library
-# <https://github.com/FastCGI-Archives/fcgi2/issues/67>.
-Patch2:         FCGI-0.82-Fix-size_t-overflow-in-Malloc-argument-in-ReadParams.patch
 URL:            https://metacpan.org/release/FCGI
 BuildRequires:  findutils
 BuildRequires:  gcc
@@ -47,7 +39,7 @@ Requires:       perl(XSLoader)
 %{summary}.
 
 %prep
-%autosetup -p1 -n FCGI-%{version}
+%setup -q -n FCGI-%{version}
 find . -type f -exec chmod -c -x {} +
 
 %build
@@ -69,9 +61,6 @@ make test
 %{_mandir}/man3/*.3*
 
 %changelog
-* Thu May 29 2025 Jitka Plesnikova <jplesnik@redhat.com> - 1:0.78-12
-- Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters)
-
 * Fri Mar 29 2019 Jitka Plesnikova <jplesnik@redhat.com> - 1:0.78-11
 - Rebuild with enable hardening (bug #1636329)