rel 2; CVE thing probably

diff --git a/integer-underflow.patch b/integer-underflow.patch
new file mode 100644 (file)
index 0000000..e13f364
--- /dev/null
+++ b/integer-underflow.patch
@@ -0,0 +1,26 @@
+From c93823faef044150e1b232928d225ff5ff297e6c Mon Sep 17 00:00:00 2001
+From: Simon Arlott <sa.me.uk>
+Date: Sat, 30 Sep 2023 12:18:51 +0100
+Subject: [PATCH] Fix integer underflow
+
+---
+ src/libspf2/spf_compile.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/libspf2/spf_compile.c b/src/libspf2/spf_compile.c
+index b08ffe2..d401028 100644
+--- a/src/libspf2/spf_compile.c
++++ b/src/libspf2/spf_compile.c
+@@ -455,7 +455,11 @@ SPF_c_parse_var(SPF_response_t *spf_response, SPF_data_var_t *data,
+                       /* Magic numbers for x/Nc in gdb. */                                    \
+                       data->ds.__unused0 = 0xba; data->ds.__unused1 = 0xbe;   \
+                       dst = SPF_data_str( data );                                                             \
+-                      ds_avail = _avail - sizeof(SPF_data_t);                                 \
++                      if ((_avail) < sizeof(SPF_data_t))                                              \
++                              return SPF_response_add_error_ptr(spf_response,         \
++                                                                      SPF_E_BIG_STRING, NULL, src,    \
++                                                              "Out of memory for string literal");\
++                      ds_avail = (_avail) - sizeof(SPF_data_t);                               \
+                       ds_len = 0;                                                                                             \
+               } while(0)
+ 

diff --git a/libspf2.spec b/libspf2.spec
index c99eed0e5f60ed696ff1bfbeaa322de223fcddb4..5d1f41f0cb195996d0b5e7907cc2124e7394c48a 100644 (file)
--- a/libspf2.spec
+++ b/libspf2.spec
@@ -5,7 +5,7 @@ Summary:        Implementation of the SPF specification
 Summary(pl.UTF-8):     Implementacja specyfikacji SPF
 Name:          libspf2
 Version:       1.2.11
-Release:       1
+Release:       2
 License:       LGPL
 Group:         Libraries
 # Source0:     http://www.libspf2.org/spf/%{name}-%{version}.tar.gz
@@ -13,6 +13,8 @@ Source0:      https://github.com/shevek/libspf2/tarball/4915c30#/%{name}.tar.gz
 # Source0-md5: ad5f1b48e4f2b5561df99ca7cbf30e92
 Patch0:                %{name}-link.patch
 Patch1:                0001-remove-libreplace-unneeded-on-Linux.patch
+# https://github.com/shevek/libspf2/pull/44
+Patch2:         integer-underflow.patch
 URL:           http://www.libspf2.org/
 BuildRequires: autoconf >= 2.59
 BuildRequires: automake
@@ -74,6 +76,7 @@ Statyczna biblioteka libspf2.
 %setup -q -n shevek-libspf2-4915c30
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 %build
 %{__libtoolize}