From 719b6720b67d6a294fc82d95c2418e92a5559657 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Nov 26 2018 11:40:28 +0000
Subject: import rh-nginx110-nginx-1.10.2-8.el7.1


---

diff --git a/SOURCES/nginx-1.10.2-CVE-2018-16843.patch b/SOURCES/nginx-1.10.2-CVE-2018-16843.patch
new file mode 100644
index 0000000..ec83bec
--- /dev/null
+++ b/SOURCES/nginx-1.10.2-CVE-2018-16843.patch
@@ -0,0 +1,49 @@
+diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
+index d0cd2ab..8d3eaf8 100644
+--- a/src/http/v2/ngx_http_v2.c
++++ b/src/http/v2/ngx_http_v2.c
+@@ -649,6 +649,7 @@ ngx_http_v2_handle_connection(ngx_http_v2_connection_t *h2c)
+ 
+     h2c->pool = NULL;
+     h2c->free_frames = NULL;
++    h2c->frames = 0;
+     h2c->free_fake_connections = NULL;
+ 
+ #if (NGX_HTTP_SSL)
+@@ -2615,7 +2616,7 @@ ngx_http_v2_get_frame(ngx_http_v2_connection_t *h2c, size_t length,
+ 
+         frame->blocked = 0;
+ 
+-    } else {
++    } else if (h2c->frames < 10000) {
+         pool = h2c->pool ? h2c->pool : h2c->connection->pool;
+ 
+         frame = ngx_pcalloc(pool, sizeof(ngx_http_v2_out_frame_t));
+@@ -2639,6 +2640,15 @@ ngx_http_v2_get_frame(ngx_http_v2_connection_t *h2c, size_t length,
+         frame->last = frame->first;
+ 
+         frame->handler = ngx_http_v2_frame_handler;
++
++        h2c->frames++;
++
++    } else {
++        ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
++                      "http2 flood detected");
++
++        h2c->connection->error = 1;
++        return NULL;
+     }
+ 
+ #if (NGX_DEBUG)
+diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
+index 9e738aa..c22d879 100644
+--- a/src/http/v2/ngx_http_v2.h
++++ b/src/http/v2/ngx_http_v2.h
+@@ -115,6 +115,7 @@ struct ngx_http_v2_connection_s {
+     ngx_http_connection_t           *http_connection;
+ 
+     ngx_uint_t                       processing;
++    ngx_uint_t                       frames;
+ 
+     size_t                           send_window;
+     size_t                           recv_window;
diff --git a/SOURCES/nginx-1.10.2-CVE-2018-16845.patch b/SOURCES/nginx-1.10.2-CVE-2018-16845.patch
new file mode 100644
index 0000000..0a92cd8
--- /dev/null
+++ b/SOURCES/nginx-1.10.2-CVE-2018-16845.patch
@@ -0,0 +1,18 @@
+diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
+index 980bf57..b165d79 100644
+--- a/src/http/modules/ngx_http_mp4_module.c
++++ b/src/http/modules/ngx_http_mp4_module.c
+@@ -896,6 +896,13 @@ ngx_http_mp4_read_atom(ngx_http_mp4_file_t *mp4,
+                 atom_size = ngx_mp4_get_64value(atom_header + 8);
+                 atom_header_size = sizeof(ngx_mp4_atom_header64_t);
+ 
++                if (atom_size < sizeof(ngx_mp4_atom_header64_t)) {
++                    ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++                                  "\"%s\" mp4 atom is too small:%uL",
++                                  mp4->file.name.data, atom_size);
++                    return NGX_ERROR;
++                }
++
+             } else {
+                 ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+                               "\"%s\" mp4 atom is too small:%uL",
diff --git a/SPECS/nginx.spec b/SPECS/nginx.spec
index e175395..eae6994 100644
--- a/SPECS/nginx.spec
+++ b/SPECS/nginx.spec
@@ -39,7 +39,7 @@
 Name:              %{?scl:%scl_prefix}nginx
 Epoch:             1
 Version:           1.10.2
-Release:           8%{?dist}
+Release:           8%{?dist}.1
 
 Summary:           A high performance web server and reverse proxy server
 Group:             System Environment/Daemons
@@ -68,6 +68,8 @@ Source200:         README.dynamic
 # -D_FORTIFY_SOURCE=2 causing warnings to turn into errors.
 Patch0:            nginx-auto-cc-gcc.patch
 Patch1:            nginx-1.10.2-CVE-2017-7529.patch
+Patch2:            nginx-1.10.2-CVE-2018-16843.patch
+Patch3:            nginx-1.10.2-CVE-2018-16845.patch
 
 BuildRequires:     gd-devel
 %if 0%{?with_gperftools}
@@ -170,6 +172,8 @@ Requires:          %{?scl:%scl_prefix}nginx
 %setup -q -n nginx-%{version}
 %patch0 -p0
 %patch1 -p0 -b .CVE-2017-7529
+%patch2 -p1 -b .CVE-2018-16843
+%patch3 -p1 -b .CVE-2018-16845
 cp %{SOURCE200} .
 
 %build
@@ -597,6 +601,12 @@ fi
 %{_libdir}/nginx/modules/ngx_stream_module.so
 
 %changelog
+* Thu Nov 15 2018 Lubos Uhliarik <luhliari@redhat.com> - 1:1.10.2-8.1
+- Resolves: #1648363 - CVE-2018-16845 rh-nginx110-nginx: nginx:
+  Denial of service and memory disclosure via mp4 module
+- Resolves: #1650091 - CVE-2018-16843 rh-nginx110-nginx: nginx:
+  Excessive memory consumption via flaw in HTTP/2 implementation
+
 * Tue Aug 22 2017 Luboš Uhliarik <luhliari@redhat.com> - 1:1.10.2-8
 - Resolves: CVE-2017-7529 rh-nginx110-nginx: nginx: Integer overflow
   in nginx range filter module leading to memory disclosure