Resolves: #1809991 - CVE-2019-18609, integer overflow

(cherry picked from commit 1b7c5c4387)

.gitignore

@@ -1,2 +1,10 @@
+clog
 /6fb87d6eb01b.tar.bz2
 /fb6fca832fd2.tar.bz2
+/alanxz-rabbitmq-c-0.2-69-g2059570.tar.gz
+/db13342f2443.tar.bz2
+/rabbitmq-c-v0.3.0.tar.gz
+/rabbitmq-c-0.4.1.tar.gz
+/rabbitmq-c-0.5.0.tar.gz
+/rabbitmq-c-0.5.1.tar.gz
+/rabbitmq-c-0.5.2.tar.gz

librabbitmq.spec

@@ -1,27 +1,27 @@
-%global   client_tag  fb6fca832fd2
-%global   codegen_tag 6fb87d6eb01b
+# spec file for librabbitmq
+#
+# Copyright (c) 2012-2014 Remi Collet
+# License: CC-BY-SA
+# http://creativecommons.org/licenses/by-sa/3.0/
+#
+# Please, preserve the changelog entries
+#
 
 Name:      librabbitmq
-Summary:   Client library and command line tools for AMPQ
-Version:   0.1
-Release:   0.2.hg%{client_tag}%{?dist}
-License:   MPLv1.1 or GPLv2+
+Summary:   Client library for AMQP
+Version:   0.5.2
+Release:   2%{?dist}
+License:   MIT
 Group:     System Environment/Libraries
-URL:       http://www.rabbitmq.com/
+URL:       https://github.com/alanxz/rabbitmq-c
 
-Source0:   http://hg.rabbitmq.com/rabbitmq-c/archive/%{client_tag}.tar.bz2
-Source1:   http://hg.rabbitmq.com/rabbitmq-codegen/archive/%{codegen_tag}.tar.bz2
+Source0:   https://github.com/alanxz/rabbitmq-c/releases/download/v%{version}/rabbitmq-c-%{version}.tar.gz
+Patch0:    rabbitmq-c-0.5.2-CVE-2019-18609.patch
 
-
-BuildRoot:     %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: libtool
-BuildRequires: python-simplejson
+BuildRequires: openssl-devel
 # For tools
-%if 0%{?rhel} == 5
-BuildRequires: popt
-%else
 BuildRequires: popt-devel
-%endif
 # For man page
 BuildRequires: xmlto
 
@@ -30,13 +30,6 @@ BuildRequires: xmlto
 This is a C-language AMQP client library for use with AMQP servers
 speaking protocol versions 0-9-1.
 
-It also provides several command line tools:
-amqp-consume        Consume messages from a queue on an AMQP server
-amqp-declare-queue  Declare a queue on an AMQP server
-amqp-delete-queue   Delete a queue from an AMQP server
-amqp-get            Get a message from a queue on an AMQP server
-amqp-publish        Publish a message on an AMQP server
-
 
 %package devel
 Summary:    Header files and development libraries for %{name}
@@ -45,68 +38,113 @@ Requires:   %{name}%{?_isa} = %{version}-%{release}
 
 %description devel
 This package contains the header files and development libraries
-for %{name}. 
+for %{name}.
+
+
+%package tools
+Summary:    Example tools built using the librabbitmq package
+Group:      Development/Libraries
+Requires:   %{name}%{?_isa} = %{version}
+
+%description tools
+This package contains example tools built using %{name}.
+
+It provides:
+amqp-consume        Consume messages from a queue on an AMQP server
+amqp-declare-queue  Declare a queue on an AMQP server
+amqp-delete-queue   Delete a queue from an AMQP server
+amqp-get            Get a message from a queue on an AMQP server
+amqp-publish        Publish a message on an AMQP server
 
 
 %prep
-%setup -qc -a 1
-
-mv rabbitmq-c-%{client_tag}        rabbitmq-c
-
-mv rabbitmq-codegen-%{codegen_tag} rabbitmq-codegen
-ln rabbitmq-codegen/amqp-rabbitmq-0.9.1.json rabbitmq-codegen/amqp-0.9.1.json
+%setup -q -n rabbitmq-c-%{version}
+%patch0 -p1 -b .CVE-2019-18609
 
 # Copy sources to be included in -devel docs.
-cp -pr rabbitmq-c/examples examples
+cp -pr examples Examples
 
 
 %build
-cd rabbitmq-c
 autoreconf -i
-%configure
+%configure \
+   --enable-tools \
+   --enable-docs  \
+   --with-ssl=openssl
+
+# rpath removal
+sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
+sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
+
 make %{_smp_mflags}
 
 
 %install
-rm -rf %{buildroot}
-cd rabbitmq-c
 make install  DESTDIR="%{buildroot}"
 
-rm %{buildroot}%{_libdir}/%{name}.{a,la}
+rm %{buildroot}%{_libdir}/%{name}.la
 
 
 %check
-cd rabbitmq-c
+: check .pc is usable
+grep @ %{buildroot}%{_libdir}/pkgconfig/librabbitmq.pc && exit 1
+
+: upstream tests
+export LD_LIBRARY_PATH=%{buildroot}%{_libdir}
 make check
 
 
-%clean
-rm -rf %{buildroot}
-
-
 %post -p /sbin/ldconfig
 
-
 %postun -p /sbin/ldconfig
- 
+
 
 %files
-%defattr (-,root,root,-) 
-%doc rabbitmq-c/{AUTHORS,COPYING,README,THANKS,TODO,LICENSE*}
-%{_libdir}/%{name}.so.*
-%{_bindir}/amqp*
-%{_mandir}/man1/amqp*
-%{_mandir}/man7/%{name}*
+%{!?_licensedir:%global license %%doc}
+%license LICENSE-MIT
+%{_libdir}/%{name}.so.1*
 
 
 %files devel
-%defattr (-,root,root,-) 
-%doc examples
+%doc AUTHORS THANKS TODO *.md
+%doc Examples
 %{_libdir}/%{name}.so
 %{_includedir}/amqp*
+%{_libdir}/pkgconfig/librabbitmq.pc
+
+%files tools
+%{_bindir}/amqp-*
+%doc %{_mandir}/man1/amqp-*.1*
+%doc %{_mandir}/man7/librabbitmq-tools.7*
 
 
 %changelog
+* Thu Apr 02 2020 Than Ngo <than@redhat.com> - 0.5.2-2
+- Resolves: #1809991 - CVE-2019-18609, integer overflow
+
+* Mon Sep 15 2014 Remi Collet <remi@fedoraproject.org> - 0.5.2-1
+- update to 0.5.2
+
+* Wed Aug 13 2014 Remi Collet <remi@fedoraproject.org> - 0.5.1-1
+- update to 0.5.1
+- fix license handling
+- move all documentation in devel subpackage
+
+* Tue Apr 15 2014 Remi Collet <remi@fedoraproject.org> - 0.5.0-2
+- upstream patch for missing function
+
+* Mon Feb 17 2014 Remi Collet <remi@fedoraproject.org> - 0.5.0-1
+- update to 0.5.0
+- open https://github.com/alanxz/rabbitmq-c/issues/169 (version is 0.5.1-pre)
+- open https://github.com/alanxz/rabbitmq-c/issues/170 (amqp_get_server_properties)
+- drop BR python-simplejson
+- add ssl support
+
+* Thu Aug  1 2013 Remi Collet <remi@fedoraproject.org> - 0.3.0-1
+- update to 0.3.0
+- create sub-package for tools
+- License is now MIT
+
 * Sun Mar 11 2012 Remi Collet <remi@fedoraproject.org> - 0.1-0.2.hgfb6fca832fd2
 - add %%check (per review comment)
 

rabbitmq-c-0.5.2-CVE-2019-18609.patch

@@ -0,0 +1,28 @@
+diff -up rabbitmq-c-0.5.2/librabbitmq/amqp_connection.c.me rabbitmq-c-0.5.2/librabbitmq/amqp_connection.c
+--- rabbitmq-c-0.5.2/librabbitmq/amqp_connection.c.me	2020-04-02 14:53:17.103227801 +0200
++++ rabbitmq-c-0.5.2/librabbitmq/amqp_connection.c	2020-04-02 14:55:12.931800875 +0200
+@@ -276,11 +276,21 @@ int amqp_handle_input(amqp_connection_st
+   case CONNECTION_STATE_HEADER: {
+     amqp_channel_t channel;
+     amqp_pool_t *channel_pool;
+-    /* frame length is 3 bytes in */
++    uint32_t frame_size;
++
+     channel = amqp_d16(raw_frame, 1);
+ 
+-    state->target_size
+-      = amqp_d32(raw_frame, 3) + HEADER_SIZE + FOOTER_SIZE;
++    /* frame length is 3 bytes in */
++    frame_size = amqp_d32(raw_frame, 3);
++    /* To prevent the target_size calculation below from overflowing, check
++     * that the stated frame_size is smaller than a signed 32-bit. Given
++     * the library only allows configuring frame_max as an int32_t, and
++     * frame_size is uint32_t, the math below is safe from overflow. */
++    if (frame_size >= INT32_MAX) {
++      return AMQP_STATUS_BAD_AMQP_DATA;
++    }
++
++    state->target_size = frame_size + HEADER_SIZE + FOOTER_SIZE;
+ 
+     if ((size_t)state->frame_max < state->target_size) {
+       return AMQP_STATUS_BAD_AMQP_DATA;

sources

@@ -1,2 +1 @@
-c96d5397911fa4029a03d8d40d90158a  6fb87d6eb01b.tar.bz2
-45c682111c87e70c3f9f5f000760ac60  fb6fca832fd2.tar.bz2
+aa8d4d0b949f508c0da25a9c20bd7da7  rabbitmq-c-0.5.2.tar.gz