diff --git a/.cvsignore b/.cvsignore deleted file mode 100644 index 1049786..0000000 --- a/.cvsignore +++ /dev/null @@ -1 +0,0 @@ -xml-security-c-1.5.1.tar.gz diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7b14dd5 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +xml-security-c-1.5.1.tar.gz +/xml-security-c-1.6.0.tar.gz diff --git a/Makefile b/Makefile deleted file mode 100644 index 141709e..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: xml-security-c -# $Id$ -NAME := xml-security-c -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/import.log b/import.log deleted file mode 100644 index dab2ea9..0000000 --- a/import.log +++ /dev/null @@ -1 +0,0 @@ -xml-security-c-1_4_0-2_fc10:HEAD:xml-security-c-1.4.0-2.src.rpm:1243882665 diff --git a/sources b/sources index 62c55a2..3dc7e91 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -2c47c4ec12e8d6abe967aa5e5e99000c xml-security-c-1.5.1.tar.gz +b66046f074f5483e3b0081c5303e320c xml-security-c-1.6.0.tar.gz diff --git a/xml-security-c-1.6.0-CVE-2011-2516.patch b/xml-security-c-1.6.0-CVE-2011-2516.patch new file mode 100644 index 0000000..ac4bd69 --- /dev/null +++ b/xml-security-c-1.6.0-CVE-2011-2516.patch @@ -0,0 +1,261 @@ +Index: xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.cpp +=================================================================== +--- xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.cpp (revision 1125751) ++++ xsec/enc/OpenSSL/OpenSSLCryptoKeyRSA.cpp (revision 1125752) +@@ -189,21 +189,20 @@ + "OpenSSL:RSA - Attempt to validate signature with empty key"); + } + +- unsigned char sigVal[1024]; +- int sigValLen; +- +- EVP_ENCODE_CTX m_dctx; +- int rc; +- +- char * cleanedBase64Signature; ++ char* cleanedBase64Signature; + unsigned int cleanedBase64SignatureLen = 0; + + cleanedBase64Signature = + XSECCryptoBase64::cleanBuffer(base64Signature, sigLen, cleanedBase64SignatureLen); + ArrayJanitor j_cleanedBase64Signature(cleanedBase64Signature); + ++ int sigValLen; ++ unsigned char* sigVal = new unsigned char[sigLen + 1]; ++ ArrayJanitor j_sigVal(sigVal); ++ ++ EVP_ENCODE_CTX m_dctx; + EVP_DecodeInit(&m_dctx); +- rc = EVP_DecodeUpdate(&m_dctx, ++ int rc = EVP_DecodeUpdate(&m_dctx, + sigVal, + &sigValLen, + (unsigned char *) cleanedBase64Signature, +Index: xsec/enc/OpenSSL/OpenSSLCryptoKeyEC.cpp +=================================================================== +--- xsec/enc/OpenSSL/OpenSSLCryptoKeyEC.cpp (revision 1125751) ++++ xsec/enc/OpenSSL/OpenSSLCryptoKeyEC.cpp (revision 1125752) +@@ -158,8 +158,9 @@ + XSECCryptoBase64::cleanBuffer(base64Signature, sigLen, cleanedBase64SignatureLen); + ArrayJanitor j_cleanedBase64Signature(cleanedBase64Signature); + +- unsigned char sigVal[512]; + int sigValLen; ++ unsigned char* sigVal = new unsigned char[sigLen + 1]; ++ ArrayJanitor j_sigVal(sigVal); + + EVP_ENCODE_CTX m_dctx; + EVP_DecodeInit(&m_dctx); +@@ -237,14 +238,13 @@ + } + + // Now turn the signature into a base64 string ++ unsigned char* rawSigBuf = new unsigned char[(BN_num_bits(dsa_sig->r) + BN_num_bits(dsa_sig->s)) / 8]; ++ ArrayJanitor j_sigbuf(rawSigBuf); + +- unsigned char rawSigBuf[256]; +- unsigned int rawLen; ++ unsigned int rawLen = BN_bn2bin(dsa_sig->r, rawSigBuf); + +- rawLen = BN_bn2bin(dsa_sig->r, rawSigBuf); ++ if (rawLen <= 0) { + +- if (rawLen <= 0) { +- + throw XSECCryptoException(XSECCryptoException::ECError, + "OpenSSL:EC - Error converting signature to raw buffer"); + +@@ -252,7 +252,7 @@ + + unsigned int rawLenS = BN_bn2bin(dsa_sig->s, (unsigned char *) &rawSigBuf[rawLen]); + +- if (rawLenS <= 0) { ++ if (rawLenS <= 0) { + + throw XSECCryptoException(XSECCryptoException::ECError, + "OpenSSL:EC - Error converting signature to raw buffer"); +Index: xsec/enc/OpenSSL/OpenSSLCryptoKeyDSA.cpp +=================================================================== +--- xsec/enc/OpenSSL/OpenSSLCryptoKeyDSA.cpp (revision 1125751) ++++ xsec/enc/OpenSSL/OpenSSLCryptoKeyDSA.cpp (revision 1125752) +@@ -164,15 +164,16 @@ + "OpenSSL:DSA - Attempt to validate signature with empty key"); + } + +- char * cleanedBase64Signature; ++ char* cleanedBase64Signature; + unsigned int cleanedBase64SignatureLen = 0; + + cleanedBase64Signature = + XSECCryptoBase64::cleanBuffer(base64Signature, sigLen, cleanedBase64SignatureLen); + ArrayJanitor j_cleanedBase64Signature(cleanedBase64Signature); + +- unsigned char sigVal[512]; + int sigValLen; ++ unsigned char* sigVal = new unsigned char[sigLen + 1]; ++ ArrayJanitor j_sigVal(sigVal); + + EVP_ENCODE_CTX m_dctx; + EVP_DecodeInit(&m_dctx); +@@ -276,11 +277,11 @@ + + // Now turn the signature into a base64 string + +- unsigned char rawSigBuf[256]; +- unsigned int rawLen; ++ unsigned char* rawSigBuf = new unsigned char[(BN_num_bits(dsa_sig->r) + BN_num_bits(dsa_sig->s)) / 8]; ++ ArrayJanitor j_sigbuf(rawSigBuf); ++ ++ unsigned int rawLen = BN_bn2bin(dsa_sig->r, rawSigBuf); + +- rawLen = BN_bn2bin(dsa_sig->r, rawSigBuf); +- + if (rawLen <= 0) { + + throw XSECCryptoException(XSECCryptoException::DSAError, +Index: xsec/dsig/DSIGAlgorithmHandlerDefault.cpp +=================================================================== +--- xsec/dsig/DSIGAlgorithmHandlerDefault.cpp (revision 1125751) ++++ xsec/dsig/DSIGAlgorithmHandlerDefault.cpp (revision 1125752) +@@ -45,6 +45,7 @@ + + XERCES_CPP_NAMESPACE_USE + ++#define MAXB64BUFSIZE 2048 + + // -------------------------------------------------------------------------------- + // Some useful utility functions +@@ -56,10 +57,10 @@ + unsigned int rawLen, + unsigned int maxCompare = 0) { + // Decode a base64 buffer and then compare the result to a raw buffer +- // Compare at most maxCompare bits (if maxComare > 0) ++ // Compare at most maxCompare bits (if maxCompare > 0) + // Note - whilst the other parameters are bytes, maxCompare is bits + +- unsigned char outputStr[1024]; ++ unsigned char outputStr[MAXB64BUFSIZE]; + unsigned int outputLen = 0; + + XSECCryptoBase64 * b64 = XSECPlatformUtils::g_cryptoProvider->base64(); +@@ -74,8 +75,8 @@ + Janitor j_b64(b64); + + b64->decodeInit(); +- outputLen = b64->decode((unsigned char *) b64Str, (unsigned int) strlen((char *) b64Str), outputStr, 1024); +- outputLen += b64->decodeFinish(&outputStr[outputLen], 1024 - outputLen); ++ outputLen = b64->decode((unsigned char *) b64Str, (unsigned int) strlen((char *) b64Str), outputStr, MAXB64BUFSIZE); ++ outputLen += b64->decodeFinish(&outputStr[outputLen], MAXB64BUFSIZE - outputLen); + + // Compare + +@@ -147,7 +148,7 @@ + // Translate the rawbuffer (at most maxBits or rawLen - whichever is smaller) + // to a base64 string + +- unsigned char b64Str[1024]; ++ unsigned char b64Str[MAXB64BUFSIZE]; + unsigned int outputLen = 0; + + XSECCryptoBase64 * b64 = XSECPlatformUtils::g_cryptoProvider->base64(); +@@ -178,8 +179,8 @@ + size = rawLen; + + b64->encodeInit(); +- outputLen = b64->encode((unsigned char *) raw, rawLen, b64Str, 1024); +- outputLen += b64->encodeFinish(&b64Str[outputLen], 1024 - outputLen); ++ outputLen = b64->encode((unsigned char *) raw, rawLen, b64Str, MAXB64BUFSIZE - 1); ++ outputLen += b64->encodeFinish(&b64Str[outputLen], MAXB64BUFSIZE - outputLen - 1); + b64Str[outputLen] = '\0'; + + // Copy out +@@ -383,7 +384,10 @@ + + // Now check the calculated hash + +- char b64Buf[1024]; ++ // For now, use a fixed length buffer, but expand it, ++ // and detect if the signature size exceeds what we can ++ // handle. ++ char b64Buf[MAXB64BUFSIZE]; + unsigned int b64Len; + safeBuffer b64SB; + +@@ -403,7 +407,7 @@ + hash, + hashLen, + (char *) b64Buf, +- 1024); ++ MAXB64BUFSIZE); + + if (b64Len <= 0) { + +@@ -411,7 +415,13 @@ + "Unknown error occured during a DSA Signing operation"); + + } ++ else if (b64Len >= MAXB64BUFSIZE) { + ++ throw XSECException(XSECException::AlgorithmMapperError, ++ "DSA Signing operation exceeded size of buffer"); ++ ++ } ++ + if (b64Buf[b64Len-1] == '\n') + b64Buf[b64Len-1] = '\0'; + else +@@ -433,7 +443,7 @@ + hash, + hashLen, + (char *) b64Buf, +- 1024, ++ MAXB64BUFSIZE, + hm); + + if (b64Len <= 0) { +@@ -442,7 +452,13 @@ + "Unknown error occured during a RSA Signing operation"); + + } ++ else if (b64Len >= MAXB64BUFSIZE) { + ++ throw XSECException(XSECException::AlgorithmMapperError, ++ "RSA Signing operation exceeded size of buffer"); ++ ++ } ++ + // Clean up some "funnies" and make sure the string is NULL terminated + + if (b64Buf[b64Len-1] == '\n') +@@ -466,7 +482,7 @@ + hash, + hashLen, + (char *) b64Buf, +- 1024); ++ MAXB64BUFSIZE); + + if (b64Len <= 0) { + +@@ -474,7 +490,13 @@ + "Unknown error occured during an ECDSA Signing operation"); + + } ++ else if (b64Len >= MAXB64BUFSIZE) { + ++ throw XSECException(XSECException::AlgorithmMapperError, ++ "ECDSA Signing operation exceeded size of buffer"); ++ ++ } ++ + if (b64Buf[b64Len-1] == '\n') + b64Buf[b64Len-1] = '\0'; + else +@@ -504,7 +526,7 @@ + hashLen, + outputLength); + +- strncpy(b64Buf, (char *) b64SB.rawBuffer(), 1024); ++ strncpy(b64Buf, (char *) b64SB.rawBuffer(), MAXB64BUFSIZE); + break; + + default : diff --git a/xml-security-c.spec b/xml-security-c.spec index 0882ac4..18980c8 100644 --- a/xml-security-c.spec +++ b/xml-security-c.spec @@ -1,17 +1,21 @@ Name: xml-security-c -Version: 1.5.1 -Release: 2%{?dist} +Version: 1.6.0 +Release: 3%{?dist} Summary: C++ Implementation of W3C security standards for XML Group: System Environment/Libraries License: ASL 2.0 URL: http://santuario.apache.org/c/ Source: http://santuario.apache.org/dist/c-library/%{name}-%{version}.tar.gz +Patch0: xml-security-c-1.6.0-CVE-2011-2516.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: xerces-c-devel xalan-c-devel openssl-devel BuildRequires: pkgconfig +# xerces-c-devel is not available for PPC EL6 (#699707) +ExcludeArch: ppc ppc64 + %description The xml-security-c library is a C++ implementation of the XML Digital Signature specification. The library makes use of the Apache XML project's Xerces-C XML @@ -36,6 +40,7 @@ XML Digital Signatures. %prep %setup -q +%patch0 -p0 # Remove bogus "-O2" from CXXFLAGS to avoid overriding RPM_OPT_FLAGS. sed -i -e 's/-O2 -DNDEBUG/-DNDEBUG/g' configure @@ -45,7 +50,7 @@ make %{?_smp_mflags} %check # Verify that what was compiled actually works. -./bin/xtest +./xsec/xtest %install rm -rf $RPM_BUILD_ROOT @@ -77,12 +82,18 @@ rm -rf $RPM_BUILD_ROOT %{_includedir}/xsec %{_libdir}/libxml-security-c.so -# Upstream does not provide any docs (yet!) -# %doc CHANGELOG.txt +%doc CHANGELOG.txt LICENSE.txt NOTICE.txt INSTALL %changelog -* Fri Aug 21 2009 Tomas Mraz - 1.5.1-2 -- rebuilt with new openssl +* Wed Oct 23 2013 Antti Andreimann - 1.6.0-3 +- Rebuild for xalan-c 110 to 111 .so bump + +* Fri Jul 08 2011 Antti Andreimann - 1.6.0-2 +- Backported a patch to fix CVE-2011-2516 (#719698) + +* Tue Apr 26 2011 Antti Andreimann - 1.6.0-1 +- Do not build on PPC64 due to missing dependencies (#699707) +- New upstream release * Tue Jul 28 2009 Antti Andreimann 1.5.1-1 - New upstream relase (#513078)