backported fix for stack overflow in DER decoder

Resolves: rhbz#1138218

.gitignore

@@ -13,3 +13,7 @@ libtasn1-2.7.tar.gz
 /libtasn1-3.5.tar.gz.sig
 /libtasn1-3.6.tar.gz
 /libtasn1-3.6.tar.gz.sig
+/libtasn1-3.7.tar.gz
+/libtasn1-3.7.tar.gz.sig
+/libtasn1-3.8.tar.gz
+/libtasn1-3.8.tar.gz.sig

libtasn1-3.8-ltostr.patch

@@ -0,0 +1,13 @@
+diff --git a/lib/parser_aux.h b/lib/parser_aux.h
+index 1f1aec2..7b2dfd4 100644
+--- a/lib/parser_aux.h
++++ b/lib/parser_aux.h
+@@ -52,7 +52,7 @@ void _asn1_delete_list (void);
+ 
+ void _asn1_delete_list_and_nodes (void);
+ 
+-#define LTOSTR_MAX_SIZE 20
++#define LTOSTR_MAX_SIZE 22
+ char *_asn1_ltostr (long v, char *str);
+ 
+ asn1_node _asn1_find_up (asn1_node node);

libtasn1-3.8-octet-string.patch

@@ -0,0 +1,20 @@
+diff -ur libtasn1-3.8.orig/lib/decoding.c libtasn1-3.8/lib/decoding.c
+--- libtasn1-3.8.orig/lib/decoding.c	2014-08-23 09:26:09.000000000 +0200
++++ libtasn1-3.8/lib/decoding.c	2014-09-04 10:38:51.964592251 +0200
+@@ -720,6 +720,7 @@
+ {
+   int len2, len3, counter, tot_len, indefinite;
+   int result;
++  int orig_der_len = der_len;
+ 
+   counter = 0;
+ 
+@@ -777,7 +778,7 @@
+ 	  asn1_length_der (tot_len, temp, &len2);
+ 	  _asn1_set_value (node, temp, len2);
+ 
+-	  ret = _asn1_extract_der_octet (node, der, der_len);
++	  ret = _asn1_extract_der_octet (node, der, orig_der_len);
+ 	  if (ret != ASN1_SUCCESS)
+ 	    return ret;
+ 

libtasn1.spec

@@ -1,7 +1,7 @@
 Summary:	The ASN.1 library used in GNUTLS
 Name:		libtasn1
-Version:	3.6
-Release:	1%{?dist}
+Version:	3.8
+Release:	3%{?dist}
 
 # The libtasn1 library is LGPLv2+, utilities are GPLv3+
 License:	GPLv3+ and LGPLv2+
@@ -10,6 +10,8 @@ URL:		http://www.gnu.org/software/libtasn1/
 Source0:	http://ftp.gnu.org/gnu/libtasn1/%name-%version.tar.gz
 Source1:	http://ftp.gnu.org/gnu/libtasn1/%name-%version.tar.gz.sig
 Patch1:		libtasn1-3.4-rpath.patch
+Patch2:		libtasn1-3.8-octet-string.patch
+Patch3:		libtasn1-3.8-ltostr.patch
 BuildRequires:	bison, pkgconfig
 %ifarch %ix86 x86_64 ppc ppc64
 BuildRequires:	valgrind
@@ -52,6 +54,8 @@ data.
 %setup -q
 
 %patch1 -p1 -b .rpath
+%patch2 -p1 -b .octet-string
+%patch3 -p1 -b .ltostr
 
 %build
 %configure --disable-static --disable-silent-rules
@@ -104,6 +108,18 @@ test "$1" = 0 -a -f %_infodir/%name.info.gz && \
 
 
 %changelog
+* Mon Mar 30 2015 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.8-3
+- backported fix for stack overflow in DER decoder
+
+* Thu Sep 04 2014 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.8-2
+- added bug fix for octet string decoding (#1138218)
+
+* Mon Aug 25 2014 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.8-1
+- new upstream release
+
+* Mon Jun 30 2014 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.7-1
+- new upstream release
+
 * Mon May 26 2014 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6-1
 - new upstream release
 

sources

@@ -1,2 +1,2 @@
-8d734e02c19c48c7e26fff179be9c443  libtasn1-3.6.tar.gz.sig
-6ed38e161e11013054f2a2bb4c4da449  libtasn1-3.6.tar.gz
+17fdbe2fa5412aae167ba80c23dbf7c3  libtasn1-3.8.tar.gz
+2cd981e1e74f25fe04c0db8e4ea62cf6  libtasn1-3.8.tar.gz.sig