From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Tomas Mraz To: git-commits@fedoraproject.org Subject: [rpms/openssl] rebase_40beta: fix CVE-2013-6449 - crash when version in SSL structure is incorrect Date: Tue, 09 Jun 2026 12:43:12 GMT Message-ID: <178100899208.1.8119215038101463545.rpms-openssl-8978637f3bb0@fedoraproject.org> List-ID: X-Git-Repo: rpms/openssl X-Git-Branch: rebase_40beta X-Git-Rev: 8978637f3bb04da478533bd930fcf94128a4c4fa ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvb3BlbnNzbAogICAgICAgICAgICBCcmFuY2ggOiByZWJhc2VfNDBiZXRhCiAg ICAgICAgICAgIENvbW1pdCA6IDg5Nzg2MzdmM2JiMDRkYTQ3ODUzM2JkOTMwZmNmOTQxMjhhNGM0 ZmEKICAgICAgICAgICAgQXV0aG9yIDogVG9tYXMgTXJheiA8dG1yYXpAZmVkb3JhcHJvamVjdC5v cmc+CiAgICAgICAgICAgIERhdGUgICA6IDIwMTMtMTItMjBUMTQ6MTQ6MTUrMDE6MDAKICAgICAg ICAgICAgU3RhdHMgIDogKzk1Ly0xIGluIDIgZmlsZShzKQogICAgICAgICAgICBVUkwgICAgOiBo dHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL29wZW5zc2wvYy84OTc4NjM3ZjNiYjA0 ZGE0Nzg1MzNiZDkzMGZjZjk0MTI4YTRjNGZhP2JyYW5jaD1yZWJhc2VfNDBiZXRhCgogICAgICAg ICAgICBMb2c6CiAgICAgICAgICAgIGZpeCBDVkUtMjAxMy02NDQ5IC0gY3Jhc2ggd2hlbiB2ZXJz aW9uIGluIFNTTCBzdHJ1Y3R1cmUgaXMgaW5jb3JyZWN0CgotIG1vcmUgRklQUyB2YWxpZGF0aW9u IHJlcXVpcmVtZW50IGNoYW5nZXMKCi0tLQpkaWZmIC0tZ2l0IGEvb3BlbnNzbC0xLjAuMWUtY3Zl LTIwMTMtNjQ0OS5wYXRjaCBiL29wZW5zc2wtMS4wLjFlLWN2ZS0yMDEzLTY0NDkucGF0Y2gKbmV3 IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uZmUyNGJlNQotLS0gL2Rldi9udWxsCisr KyBiL29wZW5zc2wtMS4wLjFlLWN2ZS0yMDEzLTY0NDkucGF0Y2gKQEAgLTAsMCArMSw4OCBAQAor VXNlIHZlcnNpb24gaW4gU1NMX01FVEhPRCBub3QgU1NMIHN0cnVjdHVyZS4KKworV2hlbiBkZWNp ZGluZyB3aGV0aGVyIHRvIHVzZSBUTFMgMS4yIFBSRiBhbmQgcmVjb3JkIGhhc2ggYWxnb3JpdGht cwordXNlIHRoZSB2ZXJzaW9uIG51bWJlciBpbiB0aGUgY29ycmVzcG9uZGluZyBTU0xfTUVUSE9E IHN0cnVjdHVyZQoraW5zdGVhZCBvZiB0aGUgU1NMIHN0cnVjdHVyZS4gVGhlIFNTTCBzdHJ1Y3R1 cmUgdmVyc2lvbiBpcyBzb21ldGltZXMKK2luYWNjdXJhdGUuIE5vdGU6IE9wZW5TU0wgMS4wLjIg YW5kIGxhdGVyIGVmZmVjdGl2ZWx5IGRvIHRoaXMgYWxyZWFkeS4KKyhDVkUtMjAxMy02NDQ5KQor CitBbHNvIHByZXZlbnRpdmVseSBjaGVjayBFVlAgZXJyb3JzIGZvciBoYW5kc2hha2UgZGlnZXN0 cy4KKworZGlmZiAtLWdpdCBhL3NzbC9zM19saWIuYyBiL3NzbC9zM19saWIuYworaW5kZXggYmY4 MzJiYi4uYzRlZjI3MyAxMDA2NDQKKy0tLSBhL3NzbC9zM19saWIuYworKysrIGIvc3NsL3MzX2xp Yi5jCitAQCAtNDI4Niw3ICs0Mjg2LDcgQEAgbmVlZCB0byBnbyB0byBTU0xfU1RfQUNDRVBULgor IGxvbmcgc3NsX2dldF9hbGdvcml0aG0yKFNTTCAqcykKKyAJeworIAlsb25nIGFsZzIgPSBzLT5z My0+dG1wLm5ld19jaXBoZXItPmFsZ29yaXRobTI7CistCWlmIChUTFMxX2dldF92ZXJzaW9uKHMp ID49IFRMUzFfMl9WRVJTSU9OICYmCisrCWlmIChzLT5tZXRob2QtPnZlcnNpb24gPT0gVExTMV8y X1ZFUlNJT04gJiYKKyAJICAgIGFsZzIgPT0gKFNTTF9IQU5EU0hBS0VfTUFDX0RFRkFVTFR8VExT MV9QUkYpKQorIAkJcmV0dXJuIFNTTF9IQU5EU0hBS0VfTUFDX1NIQTI1NiB8IFRMUzFfUFJGX1NI QTI1NjsKKyAJcmV0dXJuIGFsZzI7CitkaWZmIC0tZ2l0IGEvc3NsL3MzX2JvdGguYyBiL3NzbC9z M19ib3RoLmMKK2luZGV4IGVhZDAxYzguLjFlNWRjYWIgMTAwNjQ0CistLS0gYS9zc2wvczNfYm90 aC5jCisrKysgYi9zc2wvczNfYm90aC5jCitAQCAtMTYxLDYgKzE2MSw4IEBAIGludCBzc2wzX3Nl bmRfZmluaXNoZWQoU1NMICpzLCBpbnQgYSwgaW50IGIsIGNvbnN0IGNoYXIgKnNlbmRlciwgaW50 IHNsZW4pCisgCisgCQlpPXMtPm1ldGhvZC0+c3NsM19lbmMtPmZpbmFsX2ZpbmlzaF9tYWMocywK KyAJCQlzZW5kZXIsc2xlbixzLT5zMy0+dG1wLmZpbmlzaF9tZCk7CisrCQlpZiAoaSA9PSAwKQor KwkJCXJldHVybiAwOworIAkJcy0+czMtPnRtcC5maW5pc2hfbWRfbGVuID0gaTsKKyAJCW1lbWNw eShwLCBzLT5zMy0+dG1wLmZpbmlzaF9tZCwgaSk7CisgCQlwKz1pOworZGlmZiAtLWdpdCBhL3Nz bC9zM19wa3QuYyBiL3NzbC9zM19wa3QuYworaW5kZXggODA0MjkxZS4uYzRiYzRlNyAxMDA2NDQK Ky0tLSBhL3NzbC9zM19wa3QuYworKysrIGIvc3NsL3MzX3BrdC5jCitAQCAtMTQ1OSw4ICsxNDU5 LDE0IEBAIGludCBzc2wzX2RvX2NoYW5nZV9jaXBoZXJfc3BlYyhTU0wgKnMpCisgCQlzbGVuPXMt Pm1ldGhvZC0+c3NsM19lbmMtPmNsaWVudF9maW5pc2hlZF9sYWJlbF9sZW47CisgCQl9CisgCist CXMtPnMzLT50bXAucGVlcl9maW5pc2hfbWRfbGVuID0gcy0+bWV0aG9kLT5zc2wzX2VuYy0+Zmlu YWxfZmluaXNoX21hYyhzLAorKwlpID0gcy0+bWV0aG9kLT5zc2wzX2VuYy0+ZmluYWxfZmluaXNo X21hYyhzLAorIAkJc2VuZGVyLHNsZW4scy0+czMtPnRtcC5wZWVyX2ZpbmlzaF9tZCk7CisrCWlm IChpID09IDApCisrCQl7CisrCQlTU0xlcnIoU1NMX0ZfU1NMM19ET19DSEFOR0VfQ0lQSEVSX1NQ RUMsIEVSUl9SX0lOVEVSTkFMX0VSUk9SKTsKKysJCXJldHVybiAwOworKwkJfQorKwlzLT5zMy0+ dG1wLnBlZXJfZmluaXNoX21kX2xlbiA9IGk7CisgCisgCXJldHVybigxKTsKKyAJfQorZGlmZiAt LWdpdCBhL3NzbC90MV9lbmMuYyBiL3NzbC90MV9lbmMuYworaW5kZXggODA5YWQyZS4uNzIwMTVm NSAxMDA2NDQKKy0tLSBhL3NzbC90MV9lbmMuYworKysrIGIvc3NsL3QxX2VuYy5jCitAQCAtOTE1 LDE4ICs5MTUsMTkgQEAgaW50IHRsczFfZmluYWxfZmluaXNoX21hYyhTU0wgKnMsCisgCQlpZiAo bWFzayAmIHNzbF9nZXRfYWxnb3JpdGhtMihzKSkKKyAJCQl7CisgCQkJaW50IGhhc2hzaXplID0g RVZQX01EX3NpemUobWQpOworLQkJCWlmIChoYXNoc2l6ZSA8IDAgfHwgaGFzaHNpemUgPiAoaW50 KShzaXplb2YgYnVmIC0gKHNpemVfdCkocS1idWYpKSkKKysJCQlFVlBfTURfQ1RYICpoZGdzdCA9 IHMtPnMzLT5oYW5kc2hha2VfZGdzdFtpZHhdOworKwkJCWlmICghaGRnc3QgfHwgaGFzaHNpemUg PCAwIHx8IGhhc2hzaXplID4gKGludCkoc2l6ZW9mIGJ1ZiAtIChzaXplX3QpKHEtYnVmKSkpCisg CQkJCXsKKyAJCQkJLyogaW50ZXJuYWwgZXJyb3I6ICdidWYnIGlzIHRvbyBzbWFsbCBmb3IgdGhp cyBjaXBlcnN1aXRlISAqLworIAkJCQllcnIgPSAxOworIAkJCQl9CisgCQkJZWxzZQorIAkJCQl7 CistCQkJCUVWUF9NRF9DVFhfY29weV9leCgmY3R4LHMtPnMzLT5oYW5kc2hha2VfZGdzdFtpZHhd KTsKKy0JCQkJRVZQX0RpZ2VzdEZpbmFsX2V4KCZjdHgscSwmaSk7CistCQkJCWlmIChpICE9ICh1 bnNpZ25lZCBpbnQpaGFzaHNpemUpIC8qIGNhbid0IHJlYWxseSBoYXBwZW4gKi8KKysJCQkJaWYg KCFFVlBfTURfQ1RYX2NvcHlfZXgoJmN0eCwgaGRnc3QpIHx8CisrCQkJCQkhRVZQX0RpZ2VzdEZp bmFsX2V4KCZjdHgscSwmaSkgfHwKKysJCQkJCShpICE9ICh1bnNpZ25lZCBpbnQpaGFzaHNpemUp KQorIAkJCQkJZXJyID0gMTsKKy0JCQkJcSs9aTsKKysJCQkJcSs9aGFzaHNpemU7CisgCQkJCX0K KyAJCQl9CisgCQl9CistLSAKKzEuOC4zLjEKKwoKZGlmZiAtLWdpdCBhL29wZW5zc2wuc3BlYyBi L29wZW5zc2wuc3BlYwppbmRleCAxOTY0OTIwLi41ZmZhNjFmIDEwMDY0NAotLS0gYS9vcGVuc3Ns LnNwZWMKKysrIGIvb3BlbnNzbC5zcGVjCkBAIC0yMSw3ICsyMSw3IEBACiBTdW1tYXJ5OiBVdGls aXRpZXMgZnJvbSB0aGUgZ2VuZXJhbCBwdXJwb3NlIGNyeXB0b2dyYXBoeSBsaWJyYXJ5IHdpdGgg VExTIGltcGxlbWVudGF0aW9uCiBOYW1lOiBvcGVuc3NsCiBWZXJzaW9uOiAxLjAuMWUKLVJlbGVh c2U6IDM1JXs/ZGlzdH0KK1JlbGVhc2U6IDM2JXs/ZGlzdH0KIEVwb2NoOiAxCiAjIFdlIGhhdmUg dG8gcmVtb3ZlIGNlcnRhaW4gcGF0ZW50ZWQgYWxnb3JpdGhtcyBmcm9tIHRoZSBvcGVuc3NsIHNv dXJjZQogIyB0YXJiYWxsIHdpdGggdGhlIGhvYmJsZS1vcGVuc3NsIHNjcmlwdCB3aGljaCBpcyBp bmNsdWRlZCBiZWxvdy4KQEAgLTg0LDYgKzg0LDcgQEAgUGF0Y2g4Mjogb3BlbnNzbC0xLjAuMWUt YmFja3BvcnRzLnBhdGNoCiBQYXRjaDgzOiBvcGVuc3NsLTEuMC4xZS1iYWQtbWFjLnBhdGNoCiBQ YXRjaDg0OiBvcGVuc3NsLTEuMC4xZS10cnVzdGVkLWZpcnN0LnBhdGNoCiBQYXRjaDg1OiBvcGVu c3NsLTEuMC4xZS1hcm0tdXNlLWVsZi1hdXh2LWNhcHMucGF0Y2gKK1BhdGNoODY6IG9wZW5zc2wt MS4wLjFlLWN2ZS0yMDEzLTY0NDkucGF0Y2gKIAogTGljZW5zZTogT3BlblNTTAogR3JvdXA6IFN5 c3RlbSBFbnZpcm9ubWVudC9MaWJyYXJpZXMKQEAgLTIwMyw2ICsyMDQsNyBAQCBjcCAle1NPVVJD RTEyfSAle1NPVVJDRTEzfSBjcnlwdG8vZWMvCiAlcGF0Y2g4MyAtcDEgLWIgLmJhZC1tYWMKICVw YXRjaDg0IC1wMSAtYiAudHJ1c3RlZC1maXJzdAogJXBhdGNoODUgLXAxIC1iIC5hcm1jYXAKKyVw YXRjaDg2IC1wMSAtYiAuaGFzaC1jcmFzaAogCiBzZWQgLWkgJ3MvU0hMSUJfVkVSU0lPTl9OVU1C RVIgIjEuMC4wIi9TSExJQl9WRVJTSU9OX05VTUJFUiAiJXt2ZXJzaW9ufSIvJyBjcnlwdG8vb3Bl bnNzbHYuaAogCkBAIC00NjYsNiArNDY4LDEwIEBAIHJtIC1yZiAkUlBNX0JVSUxEX1JPT1QvJXtf bGliZGlyfS9maXBzY2FuaXN0ZXIuKgogJXBvc3R1biBsaWJzIC1wIC9zYmluL2xkY29uZmlnCiAK ICVjaGFuZ2Vsb2cKKyogRnJpIERlYyAyMCAyMDEzIFRvbcOhxaEgTXLDoXogPHRtcmF6QHJlZGhh dC5jb20+IDEuMC4xZS0zNgorLSBmaXggQ1ZFLTIwMTMtNjQ0OSAtIGNyYXNoIHdoZW4gdmVyc2lv biBpbiBTU0wgc3RydWN0dXJlIGlzIGluY29ycmVjdAorLSBtb3JlIEZJUFMgdmFsaWRhdGlvbiBy ZXF1aXJlbWVudCBjaGFuZ2VzCisKICogV2VkIERlYyAxOCAyMDEzIFRvbcOhxaEgTXLDoXogPHRt cmF6QHJlZGhhdC5jb20+IDEuMC4xZS0zNQogLSBkcm9wIHdlYWsgY2lwaGVycyBmcm9tIHRoZSBk ZWZhdWx0IFRMUyBjaXBoZXJzdWl0ZSBsaXN0CiAtIGFkZCBiYWNrIHNvbWUgc3ltYm9scyB0aGF0 IHdlcmUgZHJvcHBlZCB3aXRoIHVwZGF0ZSB0byAxLjAuMSBicmFuY2gK