Upstream patch for CVE-2019-16163 , backported to 6.9.1 (#1768997)

Another fix backports out of request from PHP maintainer, backported to 6.9.1 (#1728971)

0100-Apply-CVE-2019-13325-fix-to-6.9.1.patch

@@ -0,0 +1,71 @@
+From 6b109db2b53817607394c2ffff7cf29b7788552b Mon Sep 17 00:00:00 2001
+From: Mamoru TASAKA <mtasaka@fedoraproject.org>
+Date: Sat, 13 Jul 2019 14:39:00 +0900
+Subject: [PATCH] Apply CVE-2019-13325 fix to 6.9.1
+
+Manually apply the upstream commit c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c
+into 6.9.1 tree
+---
+ src/regcomp.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/src/regcomp.c b/src/regcomp.c
+index 400368d..53aac40 100644
+--- a/src/regcomp.c
++++ b/src/regcomp.c
+@@ -1116,8 +1116,9 @@ compile_length_bag_node(BagNode* node, regex_t* reg)
+         len += tlen;
+       }
+ 
++      len += SIZE_OP_JUMP + SIZE_OP_ATOMIC_END;
++
+       if (IS_NOT_NULL(Else)) {
+-        len += SIZE_OP_JUMP;
+         tlen = compile_length_tree(Else, reg);
+         if (tlen < 0) return tlen;
+         len += tlen;
+@@ -1259,7 +1260,7 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
+ 
+   case BAG_IF_ELSE:
+     {
+-      int cond_len, then_len, jump_len;
++      int cond_len, then_len, else_len, jump_len;
+       Node* cond = NODE_BAG_BODY(node);
+       Node* Then = node->te.Then;
+       Node* Else = node->te.Else;
+@@ -1276,8 +1277,7 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
+       else
+         then_len = 0;
+ 
+-      jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END;
+-      if (IS_NOT_NULL(Else)) jump_len += SIZE_OP_JUMP;
++      jump_len = cond_len + then_len + SIZE_OP_ATOMIC_END + SIZE_OP_JUMP;
+ 
+       r = add_opcode_rel_addr(reg, OP_PUSH, jump_len);
+       if (r != 0) return r;
+@@ -1292,9 +1292,19 @@ compile_bag_node(BagNode* node, regex_t* reg, ScanEnv* env)
+       }
+ 
+       if (IS_NOT_NULL(Else)) {
+-        int else_len = compile_length_tree(Else, reg);
+-        r = add_opcode_rel_addr(reg, OP_JUMP, else_len);
+-        if (r != 0) return r;
++        else_len = compile_length_tree(Else, reg);
++        if (else_len < 0) return else_len;
++      }
++      else
++        else_len = 0;
++
++      r = add_opcode_rel_addr(reg, OP_JUMP, SIZE_OP_ATOMIC_END + else_len);
++      if (r != 0) return r;
++
++      r = add_opcode(reg, OP_ATOMIC_END);
++      if (r != 0) return r;
++
++      if (IS_NOT_NULL(Else)) {
+         r = compile_tree(Else, reg, env);
+       }
+     }
+-- 
+2.21.0
+

0101-onig_new_deluxe-don-t-free-new-pattern-if-success.patch

@@ -0,0 +1,27 @@
+From 4a8db9d50f8281930678ed6f06692545293f3c9d Mon Sep 17 00:00:00 2001
+From: Mamoru TASAKA <mtasaka@fedoraproject.org>
+Date: Fri, 12 Jul 2019 15:38:43 +0900
+Subject: [PATCH] onig_new_deluxe: don't free new pattern if success
+
+On onig_new_deluxe() success (r == 0), new pattern (cpat) is used in
+einfo->pattern, so don't free this.
+---
+ src/regext.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/regext.c b/src/regext.c
+index fa4b360..920d183 100644
+--- a/src/regext.c
++++ b/src/regext.c
+@@ -196,7 +196,7 @@ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
+   }
+ 
+  err2:
+-  if (cpat != pattern) xfree(cpat);
++  if (r && (cpat != pattern)) xfree(cpat);
+ 
+   return r;
+ }
+-- 
+2.21.0
+

oniguruma-6.9.1-15c4228-bz1755880_2.patch

@@ -0,0 +1,10 @@
+--- onig-6.9.1/src/regexec.c.bz1755880_2	2019-11-12 13:26:41.147788047 +0900
++++ onig-6.9.1/src/regexec.c	2019-11-12 13:39:30.563660266 +0900
+@@ -2800,6 +2800,7 @@
+           DATA_ENSURE(0);
+           q = lowbuf;
+           while (len-- > 0) {
++            if (p >= endp) goto fail;
+             if (*p != *q) goto fail;
+             p++; q++;
+           }

oniguruma-6.9.1-CVE-2019-16163-backport.patch

@@ -0,0 +1,34 @@
+--- onig-6.9.1/src/regparse.c.CVE-2019-16163	2018-12-03 10:35:00.000000000 +0900
++++ onig-6.9.1/src/regparse.c	2019-11-12 13:21:24.925924320 +0900
+@@ -7748,14 +7748,19 @@
+ parse_exp(Node** np, OnigToken* tok, int term, UChar** src, UChar* end,
+           ScanEnv* env, int group_head)
+ {
+-  int r, len, group = 0;
++  int r, len, group;
+   Node* qn;
+   Node** targetp;
++  unsigned int parse_depth;
++
++  group = 0;
+ 
+   *np = NULL;
+   if (tok->type == (enum TokenSyms )term)
+     goto end_of_token;
+ 
++  parse_depth = env->parse_depth;
++
+   switch (tok->type) {
+   case TK_ALT:
+   case TK_EOT:
+@@ -8080,6 +8085,10 @@
+       if (is_invalid_quantifier_target(*targetp))
+         return ONIGERR_TARGET_OF_REPEAT_OPERATOR_INVALID;
+ 
++      parse_depth++;
++      if (parse_depth > ParseDepthLimit)
++        return ONIGERR_PARSE_DEPTH_LIMIT_OVER;
++
+       qn = node_new_quantifier(tok->u.repeat.lower, tok->u.repeat.upper,
+                                r == TK_INTERVAL);
+       CHECK_NULL_RETURN_MEMERR(qn);

oniguruma-d3e4029-bz1755880.patch

@@ -0,0 +1,18 @@
+commit d3e402928b6eb3327f8f7d59a9edfa622fec557b
+Author: K.Kosako <kosako@sofnec.co.jp>
+Date:   Tue Aug 13 13:37:30 2019 +0900
+
+    fix heap-buffer-overflow
+
+diff --git a/src/regexec.c b/src/regexec.c
+index 0753b07..634ee42 100644
+--- a/src/regexec.c
++++ b/src/regexec.c
+@@ -4196,6 +4196,7 @@ str_lower_case_match(OnigEncoding enc, int case_fold_flag,
+     lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf);
+     q = lowbuf;
+     while (lowlen > 0) {
++      if (t >= tend)    return 0;
+       if (*t++ != *q++) return 0;
+       lowlen--;
+     }

oniguruma.spec

@@ -2,13 +2,38 @@
 
 Name:		oniguruma
 Version:	6.9.1
-Release:	1%{?dist}
+Release:	3%{?dist}
 Summary:	Regular expressions library
 
 Group:		System Environment/Libraries
 License:	BSD
 URL:		https://github.com/kkos/oniguruma/
 Source0:	https://github.com/kkos/oniguruma/releases/download/v%{version}/onig-%{version}.tar.gz
+# upstream patches
+# #1728966 CVE-2019-13225
+#Patch10:	0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch
+# The above patch cannot be applied to 6.9.1 cleanly, mainly because
+# of f000bbb7729bd250c6de006880c0cbbeaca6efb3
+# Apply c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c manually into 6.9.1
+Patch100:	0100-Apply-CVE-2019-13325-fix-to-6.9.1.patch
+# #1728971 CVE-2019-13224
+#Patch11:	0011-Fix-CVE-2019-13224-don-t-allow-different-encodings-f.patch
+# Not use Patch11 for F-30 and below, this is almost API change (deprecation of API) in 
+# onig_new_deluxe() and this change should be avoided (if possible) in stable
+# branch
+# Instead use another fix
+Patch101:	0101-onig_new_deluxe-don-t-free-new-pattern-if-success.patch
+# #1768997 CVE-2019-16163
+Patch102:	oniguruma-6.9.1-CVE-2019-16163-backport.patch
+# #1755880 d3e402928b6eb3327f8f7d59a9edfa622fec557b
+Patch103:	oniguruma-d3e4029-bz1755880.patch
+# #1755880 15c4228aa2ffa02140a99912dd3177df0b1841c6
+# Patch14:	oniguruma-15c4228-bz1755880_2.patch <- backport this
+# Note that 15c4228aa2ffa02140a99912dd3177df0b1841c6 has 2 fixes, and
+# currently I (mtasaka) _believe_ that the first one does not apply
+# to oniguruma 6.9.1
+Patch104:	oniguruma-6.9.1-15c4228-bz1755880_2.patch
+
 
 BuildRequires:	gcc
 
@@ -46,6 +71,13 @@ for f in \
 done
 %endif
 
+%patch100 -p1 -b .CVE-2019-13225
+#%%patch11 -p1 -b .CVE-2019-13224
+%patch101 -p1 -b .CVE-2019-13224
+%patch102 -p1 -b .CVE-2019-16163
+%patch103 -p1 -b .bz1755880_1
+%patch104 -p1 -b .bz1755880_2
+
 %build
 %configure \
 	--disable-silent-rules \
@@ -101,6 +133,14 @@ find $RPM_BUILD_ROOT -name '*.la' \
 %{_libdir}/pkgconfig/%{name}.pc	
 
 %changelog
+* Mon Nov 11 2019 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.2-3
+- Upstream patch for CVE-2019-16163 , backported to 6.9.1 (#1768997)
+- Another fix backports out of request from PHP maintainer, backported to 6.9.1 (#1728971)
+
+* Fri Jul 12 2019 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.1-2
+- patch for CVE-2019-13225 based on the upstream and backported into 6.9.1 (#1728966)
+- NON-upstream patch for CVE-2019-13224 (#1728971)
+
 * Wed Dec 12 2018 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.1-1
 - 6.9.1