Fixes #507 in LibTomCrypt

[jbech-linaro]

@werew FYI and btw, we tend to use "Signed-off-by" tags in patches in our tree, so I wonder, is it OK if I add the following to the commit message?

Signed-off-by: Luigi Coniglio <[email protected]>>

Fix a vulnerability in der_decode_utf8_string as specified here:
libtom/libtomcrypt#507

Patch created by @werew and manually picked from:
libtom/libtomcrypt@25c26a3

[jenswi-linaro]

It would at least be preferable to have a Signed-off-by.
@werew, can you confirm that
Signed-off-by: Luigi Coniglio <[email protected]>
is fine with you?

[jforissier]

I'd rather have a clearer subject, too, such as "libtomcrypt: fix vulnerability in der_decode_utf8_string()".

+1 for the S-o-b, although I think having Joakim as the author and first S-o-b could be OK, since it is clearly mentioned in the commit text who the original author is (and the S-o-b exactly means that you acknowledge that the patch is suitable for inclusion in OP-TEE).

Last thing: we will want that to be merged in the import branch first (well, order does not really matter actually).

[werew]

@jbech-linaro @jenswi-linaro yes, having a Signed-off-by tag is fine with me, go ahead.

[jbech-linaro]

@jforissier wrote: Last thing: we will want that to be merged in the import branch first (well, order does not really matter actually).

I can do that, but why is that necessary?

@werew wrote: @jbech-linaro @jenswi-linaro yes, having a Signed-off-by tag is fine with me, go ahead.

Thanks!

[jbech-linaro]

I'd rather have a clearer subject, too, such as "libtomcrypt: fix vulnerability in der_decode_utf8_string()".

I wanted to keep it close to the original message, so it should be somewhat easy to identify. I can extend the subject a bit.

[jenswi-linaro]

@jforissier wrote: Last thing: we will want that to be merged in the import branch first (well, order does not really matter actually).

I can do that, but why is that necessary?

Actually I think it's best to do it on the import branch first in order to refer to that commit when cherry-picking for master. That's how we keep track of local modifications.

[jforissier]

I wanted to keep it close to the original message, so it should be somewhat easy to identify. I can extend the subject a bit.

Fair enough, I would also keep the original text in general but TBH this commit subject is quite useless when seen by itself (such as when browsing git log --oneline). That's why I'd rather have a better subject and keep the original subject / link to LTC issue etc. in the commit text.

[jbech-linaro]

• Import branch PR: Fixes #507 in LTC - vulnerability in der_decode_utf8_string #3321
• Signed-off-by, added (seen after the import PR has been merged)
• Commit subject, changed slightly (seen after the import PR has been merged)

[jbech-linaro]

Same patch (force) pushed here as we just merged to the import branch.