[138488] trunk/dports/devel/libcryptopp

[cal at macports.org]

Revision: 138488
          https://trac.macports.org/changeset/138488
Author:   cal at macports.org
Date:     2015-07-09 14:49:27 -0700 (Thu, 09 Jul 2015)
Log Message:
-----------
libcryptopp: fix CVE-2015-2141

Modified Paths:
--------------
    trunk/dports/devel/libcryptopp/Portfile

Added Paths:
-----------
    trunk/dports/devel/libcryptopp/files/cve-2015-2141.patch

Modified: trunk/dports/devel/libcryptopp/Portfile
===================================================================
--- trunk/dports/devel/libcryptopp/Portfile	2015-07-09 19:51:23 UTC (rev 138487)
+++ trunk/dports/devel/libcryptopp/Portfile	2015-07-09 21:49:27 UTC (rev 138488)
@@ -5,7 +5,7 @@
 
 name                libcryptopp
 version             5.6.2
-revision            2
+revision            3
 categories          devel security
 platforms           darwin
 maintainers         raphael openmaintainer
@@ -26,7 +26,8 @@
 use_zip             yes
 extract.mkdir       yes
 
-patchfiles          patch-GNUmakefile.diff
+patchfiles          patch-GNUmakefile.diff \
+                    cve-2015-2141.patch
 post-patch {
     reinplace "s|@@PREFIX@@|${prefix}|" ${worksrcpath}/GNUmakefile
 }

Added: trunk/dports/devel/libcryptopp/files/cve-2015-2141.patch
===================================================================
--- trunk/dports/devel/libcryptopp/files/cve-2015-2141.patch	                        (rev 0)
+++ trunk/dports/devel/libcryptopp/files/cve-2015-2141.patch	2015-07-09 21:49:27 UTC (rev 138488)
@@ -0,0 +1,36 @@
+Upstream-Status: Backport
+Upstream-URL: https://github.com/weidai11/cryptopp/commit/9425e16437439e68c7d96abef922167d68fafaff
+Fixes: CVE-2015-2141
+
+From 9425e16437439e68c7d96abef922167d68fafaff Mon Sep 17 00:00:00 2001
+From: Jeffrey Walton <noloader at gmail.com>
+Date: Sat, 27 Jun 2015 17:56:01 -0400
+Subject: [PATCH] Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for
+ reporting. Squaring to satisfy Jacobi requirements suggested by JPM.
+
+---
+ rw.cpp | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/rw.cpp b/rw.cpp
+index cdd9f2d..0b9318b 100644
+--- ./rw.cpp
++++ ./rw.cpp
+@@ -126,10 +126,16 @@ Integer InvertibleRWFunction::CalculateInverse(RandomNumberGenerator &rng, const
+ 	DoQuickSanityCheck();
+ 	ModularArithmetic modn(m_n);
+ 	Integer r, rInv;
+-	do {	// do this in a loop for people using small numbers for testing
++
++	// do this in a loop for people using small numbers for testing
++	do {
+ 		r.Randomize(rng, Integer::One(), m_n - Integer::One());
++		// Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for reporting.
++		// Squaring to satisfy Jacobi requirements suggested by JPM.
++		r = modn.Square(r);
+ 		rInv = modn.MultiplicativeInverse(r);
+ 	} while (rInv.IsZero());
++
+ 	Integer re = modn.Square(r);
+ 	re = modn.Multiply(re, x);			// blind
+ 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.macosforge.org/pipermail/macports-changes/attachments/20150709/fc4c6082/attachment.html>