From 1b2929cd91ad76a9b46555d01beb8a0f84ccb418 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <stig@stig.io>
Date: Mon, 6 Jun 2022 20:13:07 +0200
Subject: [PATCH 1/2] gnupg: 2.3.4 -> 2.3.6

---
 pkgs/tools/security/gnupg/23.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/23.nix
index d9ad2d0a276fc7d..3687a1e9582e5e5 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null && enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.3.4";
+  version = "2.3.6";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-80aOyvsdf5rXtR/R23rr8XzridLvqKBc8vObTUBUAq4=";
+    sha256 = "sha256-Iff+L8XC8hQYSrBQl37HqOME5Yv64qsJj+xp+Pq9qcE=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

From 3d0e70ae2ad9a6545eb70b067b5c081eba45ee6c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sun, 3 Jul 2022 03:42:49 +0200
Subject: [PATCH 2/2] gnupg: Add patch for CVE-2022-34903

https://www.openwall.com/lists/oss-security/2022/06/30/1
https://dev.gnupg.org/T6027
---
 pkgs/tools/security/gnupg/23.nix              |  3 ++
 ...led-status-messages-in-NOTATION_DATA.patch | 45 +++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch

diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/23.nix
index 3687a1e9582e5e5..b07a3550c76dd7a 100644
--- a/pkgs/tools/security/gnupg/23.nix
+++ b/pkgs/tools/security/gnupg/23.nix
@@ -34,6 +34,9 @@ stdenv.mkDerivation rec {
     ./tests-add-test-cases-for-import-without-uid.patch
     ./allow-import-of-previously-known-keys-even-without-UI.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
+
+    # Patch from upstream 34c649b36013, https://dev.gnupg.org/T6027
+    ./CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
   ];
   postPatch = ''
     sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1
diff --git a/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch b/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
new file mode 100644
index 000000000000000..4383475a1c83db9
--- /dev/null
+++ b/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch
@@ -0,0 +1,45 @@
+commit 34c649b3601383cd11dbc76221747ec16fd68e1b
+Author: Werner Koch <wk@gnupg.org>
+Date:   2022-06-14 11:33:27 +0200
+
+    g10: Fix garbled status messages in NOTATION_DATA
+    
+    * g10/cpr.c (write_status_text_and_buffer): Fix off-by-one
+    --
+    
+    Depending on the escaping and line wrapping the computed remaining
+    buffer length could be wrong.  Fixed by always using a break to
+    terminate the escape detection loop.  Might have happened for all
+    status lines which may wrap.
+    
+    GnuPG-bug-id: T6027
+
+diff --git a/g10/cpr.c b/g10/cpr.c
+index 9bfdd3c34..fa8005d6f 100644
+--- a/g10/cpr.c
++++ b/g10/cpr.c
+@@ -372,20 +372,15 @@ write_status_text_and_buffer (int no, const char *string,
+             }
+           first = 0;
+         }
+-      for (esc=0, s=buffer, n=len; n && !esc; s++, n--)
++      for (esc=0, s=buffer, n=len; n; s++, n--)
+         {
+           if (*s == '%' || *(const byte*)s <= lower_limit
+               || *(const byte*)s == 127 )
+             esc = 1;
+           if (wrap && ++count > wrap)
+-            {
+-              dowrap=1;
+-              break;
+-            }
+-        }
+-      if (esc)
+-        {
+-          s--; n++;
++            dowrap=1;
++          if (esc || dowrap)
++            break;
+         }
+       if (s != buffer)
+         es_fwrite (buffer, s-buffer, 1, statusfp);