+ Release:        4%{?dist}

+ # libnsgif: Fix null pointer deref on frameless GIF input

+ # Security fix for CVE-2022-1507

+ # Included in 1.10.2

+ Patch:          https://github.com/hpjansson/chafa/commit/e4b777c7b7.patch

+ 

+ # Version in https://github.com/hpjansson/chafa/blob/1.8.0/libnsgif/README-chafa

+ Provides:       bundled(libnsgif) = 0.2.1^chafa

+ 

+ %autosetup -p1

+ * Fri May 06 2022 Miro Hrončok <mhroncok@redhat.com> - 1.8.0-4

+ - Security fix for CVE-2022-1507

+ - Fixes: rhbz#2080294

+ - Provide bundled libnsgif

+ 

+ From e4b777c7b7c144cd16a0ea96108267b1004fe6c9 Mon Sep 17 00:00:00 2001

+ From: Hans Petter Jansson <hpj@hpjansson.org>

+ Date: Sun, 24 Apr 2022 23:56:53 +0200

+ Subject: [PATCH] libnsgif: Fix null pointer deref on frameless GIF input

+ 

+ A crafted GIF file with no frame data could cause a null pointer

+ dereference leading to denial of service (crash). Reported by

+ @JieyongMa via huntr.dev.

+ ---

+  libnsgif/libnsgif.c | 6 ++++++

+  1 file changed, 6 insertions(+)

+ 

+ diff --git a/libnsgif/libnsgif.c b/libnsgif/libnsgif.c

+ index fc4bda2..fa55d7b 100644

+ --- a/libnsgif/libnsgif.c

+ +++ b/libnsgif/libnsgif.c

+ @@ -595,6 +595,12 @@ gif_internal_decode_frame(gif_animation *gif,

+          unsigned int x, y, decode_y, burst_bytes;

+          register unsigned char colour;

+  

+ +        /* If the GIF has no frame data, frame holders will not be allocated in

+ +         * gif_initialise() */

+ +        if (gif->frames == NULL) {

+ +                return GIF_INSUFFICIENT_DATA;

+ +        }

+ +

+          /* Ensure this frame is supposed to be decoded */

+          if (gif->frames[frame].display == false) {

+                  return GIF_OK;