From b47e6172c9f0610b0bdd246b821a1c058065f4e9 Mon Sep 17 00:00:00 2001 From: panysh Date: Thu, 14 Jul 2022 17:21:36 +0800 Subject: [PATCH] CVE-2022-33070 --- ...9ce2c34355d36009a8fb1666bed29fa2d4f4.patch | 86 +++++++++++++++++++ protobuf-c.spec | 12 ++- 2 files changed, 97 insertions(+), 1 deletion(-) create mode 100644 6e389ce2c34355d36009a8fb1666bed29fa2d4f4.patch diff --git a/6e389ce2c34355d36009a8fb1666bed29fa2d4f4.patch b/6e389ce2c34355d36009a8fb1666bed29fa2d4f4.patch new file mode 100644 index 0000000..18b757d --- /dev/null +++ b/6e389ce2c34355d36009a8fb1666bed29fa2d4f4.patch @@ -0,0 +1,86 @@ +From 6e389ce2c34355d36009a8fb1666bed29fa2d4f4 Mon Sep 17 00:00:00 2001 +From: "Todd C. Miller" +Date: Mon, 6 Jun 2022 13:57:38 -0600 +Subject: [PATCH] Only shift unsigned values to avoid implementation-specific + behavior. This converts the arithmetic shifts to logical shifts. It is based + in part on a stackoverflow answer by John Schultz, + https://stackoverflow.com/questions/4533076/google-protocol-buffers-zigzag-encoding + +--- + protobuf-c/protobuf-c.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/protobuf-c/protobuf-c.c b/protobuf-c/protobuf-c.c +index ad1bdb1..98052cd 100644 +--- a/protobuf-c/protobuf-c.c ++++ b/protobuf-c/protobuf-c.c +@@ -316,9 +316,8 @@ int32_size(int32_t v) + static inline uint32_t + zigzag32(int32_t v) + { +- // Note: the right-shift must be arithmetic +- // Note: left shift must be unsigned because of overflow +- return ((uint32_t)(v) << 1) ^ (uint32_t)(v >> 31); ++ // Note: Using unsigned types prevents undefined behavior ++ return ((uint32_t)v << 1) ^ -((uint32_t)v >> 31); + } + + /** +@@ -380,9 +379,8 @@ uint64_size(uint64_t v) + static inline uint64_t + zigzag64(int64_t v) + { +- // Note: the right-shift must be arithmetic +- // Note: left shift must be unsigned because of overflow +- return ((uint64_t)(v) << 1) ^ (uint64_t)(v >> 63); ++ // Note: Using unsigned types prevents undefined behavior ++ return ((uint64_t)v << 1) ^ -((uint64_t)v >> 63); + } + + /** +@@ -802,7 +800,8 @@ uint32_pack(uint32_t value, uint8_t *out) + } + + /** +- * Pack a signed 32-bit integer and return the number of bytes written. ++ * Pack a signed 32-bit integer and return the number of bytes written, ++ * passed as unsigned to avoid implementation-specific behavior. + * Negative numbers are encoded as two's complement 64-bit integers. + * + * \param value +@@ -813,14 +812,14 @@ uint32_pack(uint32_t value, uint8_t *out) + * Number of bytes written to `out`. + */ + static inline size_t +-int32_pack(int32_t value, uint8_t *out) ++int32_pack(uint32_t value, uint8_t *out) + { +- if (value < 0) { ++ if ((int32_t)value < 0) { + out[0] = value | 0x80; + out[1] = (value >> 7) | 0x80; + out[2] = (value >> 14) | 0x80; + out[3] = (value >> 21) | 0x80; +- out[4] = (value >> 28) | 0x80; ++ out[4] = (value >> 28) | 0xf0; + out[5] = out[6] = out[7] = out[8] = 0xff; + out[9] = 0x01; + return 10; +@@ -2425,7 +2424,7 @@ static inline int32_t + unzigzag32(uint32_t v) + { + // Note: Using unsigned types prevents undefined behavior +- return (int32_t)((v >> 1) ^ (~(v & 1) + 1)); ++ return (int32_t)((v >> 1) ^ -(v & 1)); + } + + static inline uint32_t +@@ -2467,7 +2466,7 @@ static inline int64_t + unzigzag64(uint64_t v) + { + // Note: Using unsigned types prevents undefined behavior +- return (int64_t)((v >> 1) ^ (~(v & 1) + 1)); ++ return (int64_t)((v >> 1) ^ -(v & 1)); + } + + static inline uint64_t diff --git a/protobuf-c.spec b/protobuf-c.spec index 15e5300..39d7d47 100644 --- a/protobuf-c.spec +++ b/protobuf-c.spec @@ -1,6 +1,6 @@ Name: protobuf-c Version: 1.4.0 -Release: 2 +Release: 2.h1 Summary: This is protobuf-c, a C implementation of the Google Protocol Buffers data serialization format License: BSD-2-Clause URL: https://github.com/protobuf-c/protobuf-c @@ -58,4 +58,14 @@ SUG:NA DESC: upgrade to 1.4.0-1 * Fri Feb 14 2020 Senlin Xia - 1.3.2-2 + +* Thu Jul 14 2022 Panys +- Type:CVE +- SUG :NO +- DESC :fix CVE-2022-33070 - Package init + +%Patch +# CVE-2022-33070 +Patch1 6e389ce2c34355d36009a8fb1666bed29fa2d4f4.patch +%patch1 -p1 -- Gitee