diff --git a/rpm-4.16.1.3-fix-IMA-sig-len-assumed-const.patch b/rpm-4.16.1.3-fix-IMA-sig-len-assumed-const.patch
index 9be13e7..60058b4 100644
--- a/rpm-4.16.1.3-fix-IMA-sig-len-assumed-const.patch
+++ b/rpm-4.16.1.3-fix-IMA-sig-len-assumed-const.patch
@@ -1,4 +1,4 @@
-From 495f25f7198fb1e0163a7ae55de55576d9dc6fe5 Mon Sep 17 00:00:00 2001
+From 1f63621d098741158b5e1e7158cc570a415d88cd Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Mon, 29 Nov 2021 14:01:39 +0200
Subject: [PATCH] Fix IMA signature lengths assumed constant (#1833,
@@ -22,20 +22,22 @@ not a lot to gain anyhow.
Fixes: #1833
-Combined with 0c1ad364d65c4144ff71c376e0b49fbc322b686d and backported
-for 4.16.1.3. Note that the test case has been removed due to it
-including a binary file (test package) for which we'd have to use -Sgit
-with %autopatch and thus depend on git-core at build time.
-Nevertheless, we do have this BZ covered in our internal test suite, so
-no need for it anyway.
+Backported for 4.16.1.3 and combined with:
+31e9daf823f7052135d1decc0802b6fa775a88c5 (fix-up)
+0c1ad364d65c4144ff71c376e0b49fbc322b686d (python bindings)
+
+Note that the test case has been removed due to it including a binary
+file (test package) for which we'd have to use -Sgit with %autopatch and
+thus depend on git-core at build time. Nevertheless, we do have this BZ
+covered in our internal test suite, so no need for it anyway.
---
- lib/rpmfi.c | 43 ++++++++++++++++++++++++++++++++++---------
- python/rpmfiles-py.c | 18 ++++++++++++++++++
- sign/rpmsignfiles.c | 5 ++++-
- 3 files changed, 56 insertions(+), 10 deletions(-)
+ lib/rpmfi.c | 59 +++++++++++++++++++++++++++++++++-----------
+ python/rpmfiles-py.c | 18 ++++++++++++++
+ sign/rpmsignfiles.c | 5 +++-
+ 3 files changed, 67 insertions(+), 15 deletions(-)
diff --git a/lib/rpmfi.c b/lib/rpmfi.c
-index af428468c..0878d78f2 100644
+index af428468c..ed8927fd5 100644
--- a/lib/rpmfi.c
+++ b/lib/rpmfi.c
@@ -115,7 +115,8 @@ struct rpmfiles_s {
@@ -43,7 +45,7 @@ index af428468c..0878d78f2 100644
int digestalgo; /*!< File digest algorithm */
- int signaturelength; /*!< File signature length */
-+ int *signaturelengths; /*!< File signature length */
++ int *signaturelengths; /*!< File signature lengths */
+ int signaturemaxlen; /*!< Largest file signature length */
unsigned char * digests; /*!< File digests in binary. */
unsigned char * signatures; /*!< File signatures in binary. */
@@ -56,7 +58,7 @@ index af428468c..0878d78f2 100644
+ signature = fi->signatures + (fi->signaturemaxlen * ix);
if (len)
- *len = fi->signaturelength;
-+ *len = fi->signaturelengths[ix];
++ *len = fi->signaturelengths ? fi->signaturelengths[ix] : 0;
}
return signature;
}
@@ -68,7 +70,7 @@ index af428468c..0878d78f2 100644
fi->fcaps = _free(fi->fcaps);
fi->cdict = _free(fi->cdict);
-@@ -1486,15 +1488,38 @@ err:
+@@ -1486,23 +1488,52 @@ err:
}
/* Convert a tag of hex strings to binary presentation */
@@ -83,12 +85,13 @@ index af428468c..0878d78f2 100644
if (headerGet(h, tag, &td, HEADERGET_MINMEM) && rpmtdCount(&td) == num) {
- uint8_t *t = bin = xmalloc(num * len);
const char *s;
-
++ int maxl = 0;
++ int *lens = NULL;
++
+ /* Figure string sizes + max length for allocation purposes */
+ if (lengths) {
-+ int maxl = 0;
-+ int *lens = xmalloc(num * sizeof(*lens));
+ int i = 0;
++ lens = xmalloc(num * sizeof(*lens));
+
+ while ((s = rpmtdNextString(&td))) {
+ lens[i] = strlen(s) / 2;
@@ -99,17 +102,35 @@ index af428468c..0878d78f2 100644
+
+ *lengths = lens;
+ *maxlen = maxl;
-+ len = maxl;
+
+ /* Reinitialize iterator for next round */
+ rpmtdInit(&td);
++ } else {
++ maxl = len;
+ }
-+
-+ uint8_t *t = bin = xmalloc(num * len);
+
++ uint8_t *t = bin = xmalloc(num * maxl);
++ int i = 0;
while ((s = rpmtdNextString(&td))) {
if (*s == '\0') {
- memset(t, 0, len);
-@@ -1570,15 +1595,15 @@ static int rpmfilesPopulate(rpmfiles fi, Header h, rpmfiFlags flags)
+- memset(t, 0, len);
+- t += len;
+- continue;
++ memset(t, 0, maxl);
++ } else {
++ if (lens)
++ len = lens[i];
++ for (int j = 0; j < len; j++, s += 2)
++ t[j] = (rnibble(s[0]) << 4) | rnibble(s[1]);
+ }
+- for (int j = 0; j < len; j++, t++, s += 2)
+- *t = (rnibble(s[0]) << 4) | rnibble(s[1]);
++ t += maxl;
++ i++;
+ }
+ }
+ rpmtdFreeData(&td);
+@@ -1570,15 +1601,15 @@ static int rpmfilesPopulate(rpmfiles fi, Header h, rpmfiFlags flags)
/* grab hex digests from header and store in binary format */
if (!(flags & RPMFI_NOFILEDIGESTS)) {
size_t diglen = rpmDigestLength(fi->digestalgo);
diff --git a/rpm.spec b/rpm.spec
index 9da035d..f598ac7 100644
--- a/rpm.spec
+++ b/rpm.spec
@@ -32,7 +32,7 @@
%global rpmver 4.16.1.3
#global snapver rc1
-%global rel 8
+%global rel 9
%global sover 9
%global srcver %{rpmver}%{?snapver:-%{snapver}}
@@ -606,6 +606,9 @@ fi
%doc doc/librpm/html/*
%changelog
+* Mon Dec 13 2021 Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-9
+- Fix-up IMA signature lengths patch (#2018937)
+
* Thu Dec 09 2021 Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-8
- Support hash v8 databases from BDB < 4.6 (#1965147)
- Ensure ELF files get stripped when debuginfo is disabled (#1999009)