From 8fc3ae3df743ab3344f341bd012c45e414e57698 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Feb 08 2022 14:34:56 +0000
Subject: import aide-0.15.1-13.el7_9.1


---

diff --git a/SOURCES/aide-0.16-CVE-2021-45417.patch b/SOURCES/aide-0.16-CVE-2021-45417.patch
new file mode 100644
index 0000000..7e6dcc4
--- /dev/null
+++ b/SOURCES/aide-0.16-CVE-2021-45417.patch
@@ -0,0 +1,123 @@
+diff --git a/include/base64.h b/include/base64.h
+index 0ff7116..381ef5d 100644
+--- a/include/base64.h
++++ b/include/base64.h
+@@ -36,7 +36,6 @@
+ #include <assert.h>
+ #include "types.h"
+ 
+-#define B64_BUF 16384
+ #define FAIL -1
+ #define SKIP -2
+ 
+diff --git a/src/base64.c b/src/base64.c
+index fd01bac..1b0f301 100644
+--- a/src/base64.c
++++ b/src/base64.c
+@@ -85,11 +85,9 @@ FAIL, FAIL, FAIL, FAIL, FAIL, FAIL, FAIL, FAIL
+ };
+ 
+ /* Returns NULL on error */
+-/* FIXME Possible buffer overflow on outputs larger than B64_BUF */
+ char* encode_base64(byte* src,size_t ssize)
+ {
+   char* outbuf;
+-  char* retbuf;
+   int pos;
+   int i, l, left;
+   unsigned long triple;
+@@ -101,7 +99,10 @@ char* encode_base64(byte* src,size_t ssize)
+     error(210,"\n");
+     return NULL;
+   }
+-  outbuf = (char *)malloc(sizeof(char)*B64_BUF);
++
++  /* length of encoded base64 string (padded) */
++  size_t length = sizeof(char)* ((ssize + 2) / 3) * 4;
++  outbuf = (char *)malloc(length + 1);
+   
+   /* Initialize working pointers */
+   inb = src;
+@@ -162,20 +163,14 @@ char* encode_base64(byte* src,size_t ssize)
+       inb++;
+   }
+   
+-  /* outbuf is not completely used so we use retbuf */
+-  retbuf=(char*)malloc(sizeof(char)*(pos+1));
+-  memcpy(retbuf,outbuf,pos);
+-  retbuf[pos]='\0';
+-  free(outbuf);
++  outbuf[pos]='\0';
+ 
+-  return retbuf;
++  return outbuf;
+ }
+ 
+-/* FIXME Possible buffer overflow on outputs larger than B64_BUF */
+ byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
+ {
+   byte* outbuf;
+-  byte* retbuf;
+   char* inb;
+   int i;
+   int l;
+@@ -188,10 +183,18 @@ byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
+   if (!ssize||src==NULL)
+     return NULL;
+ 
++  /* exit on unpadded input */
++  if (ssize % 4) {
++    error(3, "decode_base64: '%s' has invalid length (missing padding characters?)", src);
++    return NULL;
++  }
++
++  /* calculate length of decoded string, substract padding chars if any (ssize is >= 4) */
++  size_t length = sizeof(byte) * ((ssize / 4) * 3)- (src[ssize-1] == '=') - (src[ssize-2] == '=');
+ 
+   /* Initialize working pointers */
+   inb = src;
+-  outbuf = (byte *)malloc(sizeof(byte)*B64_BUF);
++  outbuf = (byte *)malloc(length + 1);
+ 
+   l = 0;
+   triple = 0;
+@@ -243,15 +246,11 @@ byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
+       inb++;
+     }
+   
+-  retbuf=(byte*)malloc(sizeof(byte)*(pos+1));
+-  memcpy(retbuf,outbuf,pos);
+-  retbuf[pos]='\0';
+-  
+-  free(outbuf);
++  outbuf[pos]='\0';
+ 
+   if (ret_len) *ret_len = pos;
+   
+-  return retbuf;
++  return outbuf;
+ }
+ 
+ size_t length_base64(char* src,size_t ssize)
+diff --git a/src/db.c b/src/db.c
+index 858240d..62c4faa 100644
+--- a/src/db.c
++++ b/src/db.c
+@@ -664,13 +664,15 @@ db_line* db_char2line(char** ss,int db){
+ 
+ time_t base64totime_t(char* s){
+   
++  if(strcmp(s,"0")==0){
++      return 0;
++  }
+   byte* b=decode_base64(s,strlen(s),NULL);
+   char* endp;
+   
+-  if (b==NULL||strcmp(s,"0")==0) {
++  if (b==NULL) {
+     
+     /* Should we print error here? */
+-    free(b);
+     
+     return 0;
+   } else {
diff --git a/SPECS/aide.spec b/SPECS/aide.spec
index 600dfe4..ff8607f 100644
--- a/SPECS/aide.spec
+++ b/SPECS/aide.spec
@@ -4,7 +4,7 @@
 Summary: Intrusion detection environment
 Name: aide
 Version: 0.15.1
-Release: 13%{?dist}
+Release: 13%{?dist}.1
 URL: http://sourceforge.net/projects/aide
 License: GPLv2+
 Group: Applications/System
@@ -21,6 +21,10 @@ Patch3: aide-0.15.1-prelinkwarn.patch
 Patch4: aide-0.15-syslog-format.patch
 Patch5: aide-0.15-error-messages.patch
 
+# 2041952 - CVE-2021-45417 aide: heap-based buffer overflow on outputs larger than B64_BUF
+Patch6: aide-0.16-CVE-2021-45417.patch
+
+
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-buildroot-%(%{__id_u} -n)
 BuildRequires: mktemp
 %ifnarch aarch64 ppc64le
@@ -51,6 +55,8 @@ checker and intrusion detection program.
 %patch3 -p1 -b .prelinkwarn
 %patch4 -p1 -b .syslog-format
 %patch5 -p1 -b .error-messages
+%patch6 -p1 -b .cve
+
 
 %build
 %configure --with-config_file=%{_sysconfdir}/aide.conf \
@@ -103,6 +109,10 @@ rm -rf $RPM_BUILD_ROOT
 
 
 %changelog
+* Tue Jan 25 2022 Radovan Sroka <rsroka@redhat.com> - 0.15.1.1
+- backported fix for CVE-2021-45417
+  resolves: rhbz#2041952
+
 * Mon Mar 20 2017 Radovan Sroka <rsroka@redhat.com> - 0.15.1-13
 - RHEL 7.4 ERRATUM
   Resolves: rhbz#1400548