From 1f1734557821d48acba1ecf9d1d37d040927f7d7 Mon Sep 17 00:00:00 2001
From: Jiangtian Feng <fengjiangtian@huawei.com>
Date: Mon, 10 Oct 2022 09:54:44 +0800
Subject: [PATCH] fix CVE-2022-37434

---
 0001-CVE-2022-37434.patch | 35 +++++++++++++++++++++++++++++++++++
 0002-CVE-2022-37434.patch | 32 ++++++++++++++++++++++++++++++++
 mariadb-connector-c.spec  | 12 +++++++++++-
 3 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 0001-CVE-2022-37434.patch
 create mode 100644 0002-CVE-2022-37434.patch

diff --git a/0001-CVE-2022-37434.patch b/0001-CVE-2022-37434.patch
new file mode 100644
index 0000000..1457448
--- /dev/null
+++ b/0001-CVE-2022-37434.patch
@@ -0,0 +1,35 @@
+From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
+From: Mark Adler <fork@madler.net>
+Date: Sat, 30 Jul 2022 15:51:11 -0700
+Subject: [PATCH] Fix a bug when getting a gzip header extra field with
+ inflate().
+ 
+If the extra field was larger than the space the user provided with
+inflateGetHeader(), and if multiple calls of inflate() delivered
+the extra header data, then there could be a buffer overflow of the
+provided space. This commit assures that provided space is not
+exceeded.
+ 
+Conflict:NA
+Reference:https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1
+---
+ zlib/inflate.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+ 
+diff --git a/zlib/inflate.c b/zlib/inflate.c
+index 7be8c6366..7a7289749 100644
+--- a/zlib/inflate.c
++++ b/zlib/inflate.c
+@@ -763,9 +763,10 @@ int flush;
+                 copy = state->length;
+                 if (copy > have) copy = have;
+                 if (copy) {
++                    len = state->head->extra_len - state->length;
+                     if (state->head != Z_NULL &&
+-                        state->head->extra != Z_NULL) {
+-                        len = state->head->extra_len - state->length;
++                        state->head->extra != Z_NULL &&
++                        len < state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);
diff --git a/0002-CVE-2022-37434.patch b/0002-CVE-2022-37434.patch
new file mode 100644
index 0000000..513e101
--- /dev/null
+++ b/0002-CVE-2022-37434.patch
@@ -0,0 +1,32 @@
+From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001
+From: Mark Adler <fork@madler.net>
+Date: Mon, 8 Aug 2022 10:50:09 -0700
+Subject: [PATCH] Fix extra field processing bug that dereferences NULL
+ state->head.
+ 
+The recent commit to fix a gzip header extra field processing bug
+introduced the new bug fixed here.
+ 
+Conflict:NA
+Reference:https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
+---
+ zlib/inflate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+ 
+diff --git a/zlib/inflate.c b/zlib/inflate.c
+index 7a7289749..2a3c4fe98 100644
+--- a/zlib/inflate.c
++++ b/zlib/inflate.c
+@@ -763,10 +763,10 @@ int flush;
+                 copy = state->length;
+                 if (copy > have) copy = have;
+                 if (copy) {
+-                    len = state->head->extra_len - state->length;
+                     if (state->head != Z_NULL &&
+                         state->head->extra != Z_NULL &&
+-                        len < state->head->extra_max) {
++                        (len = state->head->extra_len - state->length) <
++                            state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);
diff --git a/mariadb-connector-c.spec b/mariadb-connector-c.spec
index 791ffca..f2cc877 100644
--- a/mariadb-connector-c.spec
+++ b/mariadb-connector-c.spec
@@ -1,11 +1,14 @@
 Name:           mariadb-connector-c
 Version:        3.1.13
-Release:        1
+Release:        2
 Summary:        MariaDB connector library in C
 License:        LGPLv2+
 URL:            https://github.com/MariaDB/mariadb-connector-c
 Source0:        https://downloads.mariadb.com/Connectors/c/connector-c-%{version}/mariadb-connector-c-%{version}-src.tar.gz
 
+Patch0001:	0001-CVE-2022-37434.patch
+Patch0002:	0002-CVE-2022-37434.patch
+
 BuildRequires:  libcurl-devel zlib-devel openssl-devel
 BuildRequires:  cmake gcc
 Provides:       %{name}-config%{?_isa} %{name}-config
@@ -92,6 +95,13 @@ end
 %{_libdir}/pkgconfig/libmariadb.pc
 
 %changelog
+* Mon Oct 10 2022 Jiangtian Feng <fengjiangtian@huawei.com> -3.1.13-2
+- Type:CVE
+- CVE:CVE-2022-37434
+- SUG:NA
+- DESC: fix CVE-2022-37434
+- fix CVE-2022-37434
+
 * Thu Dec 9 2021 yanglongkang <yanglongkang@huawei.com> - 3.1.13-1
 - update package to 3.1.13