PR#3: Backport fix for CVE-2023-43641 - rpms/libcue

Carl George • 7 months ago

dfe7883

file added

+28

		`@@ -0,0 +1,28 @@`
		`+ From d5597d7b6ebc1bbe07158d704b3b62acb11a5783 Mon Sep 17 00:00:00 2001`
		`+ From: Kevin Backhouse <kevinbackhouse@github.com>`
		`+ Date: Wed, 27 Sep 2023 20:22:43 +0100`
		`+ Subject: [PATCH] Check that the array index isn't negative. This fixes`
		`+ CVE-2023-43641.`
		`+`
		`+ Signed-off-by: Kevin Backhouse <kevinbackhouse@github.com>`
		`+ (cherry picked from commit fdf72c8bded8d24cfa0608b8e97f2eed210a920e)`
		`+ ---`
		`+ cd.c \| 2 +-`
		`+ 1 file changed, 1 insertion(+), 1 deletion(-)`
		`+`
		`+ diff --git a/cd.c b/cd.c`
		`+ index cf77a18..4bbea19 100644`
		`+ --- a/cd.c`
		`+ +++ b/cd.c`
		`+ @@ -339,7 +339,7 @@ track_get_rem(const Track* track)`
		`+`
		`+ void track_set_index(Track *track, int i, long ind)`
		`+ {`
		`+ - if (i > MAXINDEX) {`
		`+ + if (i < 0 \|\| i > MAXINDEX) {`
		`+ fprintf(stderr, "too many indexes\n");`
		`+ return;`
		`+ }`
		`+ --`
		`+ 2.41.0`
		`+`

libcue.spec

file modified

+6 -1

		`@@ -3,7 +3,7 @@`

		`Name: libcue`
		`Version: 2.2.1`
		`- Release: 8%{?dist}`
		`+ Release: 9%{?dist}`
		`Summary: Cue sheet parser library`

		`# Files libcue/rem.{c,h} contains a BSD header`
		`@@ -11,6 +11,8 @@`
		`URL: https://github.com/%{upstream}/%{name}`
		`VCS: scm:git:https://github.com/%{upstream}/%{name}.git`
		`Source0: https://github.com/%{upstream}/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz`
		`+ # https://github.com/lipnitsk/libcue/commit/fdf72c8bded8d24cfa0608b8e97f2eed210a920e`
		`+ Patch0: 0001-Check-that-the-array-index-isn-t-negative.-This-fixes-CVE-2023-43641.patch`
		`BuildRequires: bison`
		`BuildRequires: cmake`
		`%if 0%{?rhel} && 0%{?rhel} < 8`
		`@@ -79,6 +81,9 @@`


		`%changelog`
		`+ * Wed Oct 11 2023 Carl George <carlwgeorge@fedoraproject.org> - 2.2.1-9`
		`+ - Backport fix for CVE-2023-43641`
		`+`
		`* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.1-8`
		`- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild`