[rpms/podofo] rawhide: Backport tentative support for openssl-4.x and dependent patches

[rpms/podofo] rawhide: Backport tentative support for openssl-4.x and dependent patches

[Sandro Mani]

A new commit has been pushed.

Repo   : rpms/podofo
Branch : rawhide
Commit : 398c63c7d3fa7d6bea2dc33202a9b77bf9d2d684
Author : Sandro Mani <manisandro@gmail.com>
Date   : 2026-07-21T18:36:38+02:00
Stats  : +103/-1 in 5 file(s)
URL    : https://src.fedoraproject.org/rpms/podofo/c/398c63c7d3fa7d6bea2dc33202a9b77bf9d2d684?branch=rawhide

Log:
Backport tentative support for openssl-4.x and dependent patches

---
diff --git a/5ba0d826d325e5864d6adf4dea951124cf835adf.patch b/5ba0d826d325e5864d6adf4dea951124cf835adf.patch
new file mode 100644
index 0000000..8eeb99f
--- /dev/null
+++ b/5ba0d826d325e5864d6adf4dea951124cf835adf.patch
@@ -0,0 +1,13 @@
+diff -rupN --no-dereference podofo-1.1.1/src/podofo/private/OpenSSLInternal.cpp podofo-1.1.1-new/src/podofo/private/OpenSSLInternal.cpp
+--- podofo-1.1.1/src/podofo/private/OpenSSLInternal.cpp	2026-07-21 18:27:46.761242565 +0200
++++ podofo-1.1.1-new/src/podofo/private/OpenSSLInternal.cpp	2026-07-21 18:27:46.764693313 +0200
+@@ -92,7 +92,8 @@ void ssl::AddSigningCertificateV2(CMS_Si
+     unsigned char* buf = nullptr;
+     MY_ESS_SIGNING_CERT_V2 certV2{ };
+     ASN1_OCTET_STRING hashstr{ };
+-    ASN1_OCTET_STRING_set(&hashstr, (const unsigned char*)hash.data(), (int)hash.size());
++    hashstr.data = (unsigned char*)hash.data();
++    hashstr.length = (int)hash.size();
+     MY_ESS_CERT_ID_V2 certIdV2{ };
+ 
+     certIdV2.hash_alg = x509Algor.get();

diff --git a/aff6aa3866623cdce9dbefaee439dfc17b2d817c.patch b/aff6aa3866623cdce9dbefaee439dfc17b2d817c.patch
new file mode 100644
index 0000000..523a15c
--- /dev/null
+++ b/aff6aa3866623cdce9dbefaee439dfc17b2d817c.patch
@@ -0,0 +1,11 @@
+diff -rupN --no-dereference podofo-1.1.1/src/podofo/private/OpenSSLInternal.cpp podofo-1.1.1-new/src/podofo/private/OpenSSLInternal.cpp
+--- podofo-1.1.1/src/podofo/private/OpenSSLInternal.cpp	2026-06-09 00:17:13.000000000 +0200
++++ podofo-1.1.1-new/src/podofo/private/OpenSSLInternal.cpp	2026-07-21 18:27:46.697742779 +0200
+@@ -165,6 +165,7 @@ void ssl::cmsAddSigningTime(CMS_SignerIn
+         ASN1_TIME_free(ans1time);
+         PODOFO_RAISE_ERROR_INFO(PdfErrorCode::OpenSSLError, "Error setting SigningTime");
+     }
++    ASN1_TIME_free(ans1time);
+ }
+ 
+ void ssl::DoSign(const bufferview& input, const bufferview& pkey,

diff --git a/c45b4b742274ad38011b7804df7f2340b544c29e.patch b/c45b4b742274ad38011b7804df7f2340b544c29e.patch
new file mode 100644
index 0000000..5c0c856
--- /dev/null
+++ b/c45b4b742274ad38011b7804df7f2340b544c29e.patch
@@ -0,0 +1,74 @@
+diff -rupN --no-dereference podofo-1.1.1/src/podofo/private/OpenSSLInternal_CmsDigest.cpp podofo-1.1.1-new/src/podofo/private/OpenSSLInternal_CmsDigest.cpp
+--- podofo-1.1.1/src/podofo/private/OpenSSLInternal_CmsDigest.cpp	2026-06-09 00:17:13.000000000 +0200
++++ podofo-1.1.1-new/src/podofo/private/OpenSSLInternal_CmsDigest.cpp	2026-07-21 18:27:46.831597189 +0200
+@@ -196,7 +196,9 @@ void encodePKCS1(X509_ALGOR* digestAlg,
+     MY_X509_SIG sig;
+     X509_ALGOR algor{ };
+     ASN1_TYPE parameter{ };
+-    ASN1_OCTET_STRING digest{ };
++    unique_ptr<ASN1_OCTET_STRING, decltype(&ASN1_OCTET_STRING_free)> digest(ASN1_OCTET_STRING_new(), ASN1_OCTET_STRING_free);
++    if (digest == nullptr)
++        PODOFO_RAISE_ERROR_INFO(PdfErrorCode::OpenSSLError, "Error ASN1_OCTET_STRING_new: Out of memory");
+ 
+     sig.algor = digestAlg;
+     sig.algor = &algor;
+@@ -205,9 +207,8 @@ void encodePKCS1(X509_ALGOR* digestAlg,
+     parameter.value.ptr = NULL;
+     sig.algor->parameter = &parameter;
+ 
+-    sig.digest = &digest;
+-    sig.digest->data = const_cast<unsigned char*>(hash);
+-    sig.digest->length = hashLen;
++    ASN1_OCTET_STRING_set(digest.get(), hash, (int)hashLen);
++    sig.digest = digest.get();
+ 
+     // This is the expansion of IMPLEMENT_ASN1_FUNCTIONS
+     // NOTE: buf must be a local null pointer otherwise
+diff -rupN --no-dereference podofo-1.1.1/src/podofo/private/OpenSSLInternal.cpp podofo-1.1.1-new/src/podofo/private/OpenSSLInternal.cpp
+--- podofo-1.1.1/src/podofo/private/OpenSSLInternal.cpp	2026-07-21 18:27:46.827805987 +0200
++++ podofo-1.1.1-new/src/podofo/private/OpenSSLInternal.cpp	2026-07-21 18:27:46.831358783 +0200
+@@ -4,6 +4,7 @@
+ #include <podofo/private/PdfDeclarationsPrivate.h>
+ #include "OpenSSLInternal.h"
+ 
++#include <openssl/rsa.h>
+ #if OPENSSL_VERSION_MAJOR >= 3
+ #include <openssl/provider.h>
+ #endif // OPENSSL_VERSION_MAJOR >= 3
+@@ -91,13 +92,14 @@ void ssl::AddSigningCertificateV2(CMS_Si
+ 
+     unsigned char* buf = nullptr;
+     MY_ESS_SIGNING_CERT_V2 certV2{ };
+-    ASN1_OCTET_STRING hashstr{ };
+-    hashstr.data = (unsigned char*)hash.data();
+-    hashstr.length = (int)hash.size();
+-    MY_ESS_CERT_ID_V2 certIdV2{ };
++    unique_ptr<ASN1_OCTET_STRING, decltype(&ASN1_OCTET_STRING_free)> hashstr(ASN1_OCTET_STRING_new(), ASN1_OCTET_STRING_free);
++    if (hashstr == nullptr)
++        PODOFO_RAISE_ERROR_INFO(PdfErrorCode::OpenSSLError, "Error ASN1_OCTET_STRING_new: Out of memory");
++    ASN1_OCTET_STRING_set(hashstr.get(), (const unsigned char*)hash.data(), (int)hash.size());
+ 
++    MY_ESS_CERT_ID_V2 certIdV2{ };
+     certIdV2.hash_alg = x509Algor.get();
+-    certIdV2.hash = &hashstr;
++    certIdV2.hash = hashstr.get();
+     certV2.cert_ids = sk_MY_ESS_CERT_ID_V2_new_null();
+     if (!sk_MY_ESS_CERT_ID_V2_push(certV2.cert_ids, &certIdV2))
+     {
+@@ -159,14 +161,12 @@ unsigned ssl::GetSignedHashSize(EVP_PKEY
+ void ssl::cmsAddSigningTime(CMS_SignerInfo* si, const date::sys_seconds& timestamp)
+ {
+     auto time = chrono::system_clock::to_time_t(timestamp);
+-    auto ans1time = X509_time_adj(nullptr, 0, &time);
++    unique_ptr<ASN1_TIME, decltype(&ASN1_TIME_free)> asn1time(X509_time_adj(nullptr, 0, &time), ASN1_TIME_free);
+     if (CMS_signed_add1_attr_by_NID(si, NID_pkcs9_signingTime,
+-        ans1time->type, ans1time, -1) <= 0)
++        ASN1_STRING_type(asn1time.get()), asn1time.get(), -1) <= 0)
+     {
+-        ASN1_TIME_free(ans1time);
+         PODOFO_RAISE_ERROR_INFO(PdfErrorCode::OpenSSLError, "Error setting SigningTime");
+     }
+-    ASN1_TIME_free(ans1time);
+ }
+ 
+ void ssl::DoSign(const bufferview& input, const bufferview& pkey,

diff --git a/podofo.spec b/podofo.spec
index 5b9881c..34aaae7 100644
--- a/podofo.spec
+++ b/podofo.spec
@@ -20,6 +20,10 @@ Source1:        https://github.com/podofo/podofo-resources/archive/%{podofo_reso
 # Downstream patch for CVE-2019-20093
 # https://sourceforge.net/p/podofo/tickets/75/
 Patch1:         podofo_CVE-2019-20093.patch
+# Backport tentative support for openssl-4.x and dependent patches
+Patch2:         https://github.com/podofo/podofo/commit/aff6aa3866623cdce9dbefaee439dfc17b2d817c.patch
+Patch3:         https://github.com/podofo/podofo/commit/5ba0d826d325e5864d6adf4dea951124cf835adf.patch
+Patch4:         https://github.com/podofo/podofo/commit/c45b4b742274ad38011b7804df7f2340b544c29e.patch
 
 
 BuildRequires:  gcc-c++

diff --git a/podofo_CVE-2019-20093.patch b/podofo_CVE-2019-20093.patch
index 8132568..0b04757 100644
--- a/podofo_CVE-2019-20093.patch
+++ b/podofo_CVE-2019-20093.patch
@@ -1,6 +1,6 @@
 diff -rupN --no-dereference podofo-1.1.1/tools/podofoimgextract/ImageExtractor.cpp podofo-1.1.1-new/tools/podofoimgextract/ImageExtractor.cpp
 --- podofo-1.1.1/tools/podofoimgextract/ImageExtractor.cpp	2026-06-09 00:17:13.000000000 +0200
-+++ podofo-1.1.1-new/tools/podofoimgextract/ImageExtractor.cpp	2026-06-09 10:36:19.565356935 +0200
++++ podofo-1.1.1-new/tools/podofoimgextract/ImageExtractor.cpp	2026-07-21 18:27:46.629255500 +0200
 @@ -88,6 +88,11 @@ void ImageExtractor::ExtractImage(const
          //long lBitsPerComponent = pObject->GetDictionary().GetKey( PdfName("BitsPerComponent" ) )->GetNumber();
          // TODO: Handle colorspaces