rpms/iniparser
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix for CVE-2023-33461 (BZ#2211622)

Browse Source 
Signed-off-by: David Cantrell <dcantrell@redhat.com>
This commit is contained in:
David Cantrell 2023-06-14 11:36:28 -04:00
parent 5af30568a3
commit b27961c65b
2 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
iniparser-4.1-CVE-2023-33461.patch Normal file
View File

@ -0,0 +1,30 @@
diff -up iniparser-4.1/src/iniparser.c.orig iniparser-4.1/src/iniparser.c
--- iniparser-4.1/src/iniparser.c.orig 2017-11-02 05:09:15.000000000 -0400
+++ iniparser-4.1/src/iniparser.c 2023-06-14 11:32:33.773972538 -0400
@@ -456,7 +456,7 @@ long int iniparser_getlongint(const dict
const char * str ;
str = iniparser_getstring(d, key, INI_INVALID_KEY);
- if (str==INI_INVALID_KEY) return notfound ;
+ if (str==NULL || str==INI_INVALID_KEY) return notfound ;
return strtol(str, NULL, 0);
}
@@ -511,7 +511,7 @@ double iniparser_getdouble(const diction
const char * str ;
str = iniparser_getstring(d, key, INI_INVALID_KEY);
- if (str==INI_INVALID_KEY) return notfound ;
+ if (str==NULL || str==INI_INVALID_KEY) return notfound ;
return atof(str);
}
@@ -553,7 +553,7 @@ int iniparser_getboolean(const dictionar
const char * c ;
c = iniparser_getstring(d, key, INI_INVALID_KEY);
- if (c==INI_INVALID_KEY) return notfound ;
+ if (c==NULL || c==INI_INVALID_KEY) return notfound ;
if (c[0]=='y' || c[0]=='Y' || c[0]=='1' || c[0]=='t' || c[0]=='T') {
ret = 1 ;
} else if (c[0]=='n' || c[0]=='N' || c[0]=='0' || c[0]=='f' || c[0]=='F') {

8
iniparser.spec
View File

@ -3,13 +3,15 @@
Name: iniparser
Version: 4.1
Release: 11%{?dist}
Release: 12%{?dist}
Summary: C library for parsing "INI-style" files
License: MIT
URL: https://github.com/ndevilla/%{name}
Source0: https://github.com/ndevilla/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
Patch0: iniparser-4.1-CVE-2023-33461.patch
BuildRequires: gcc
BuildRequires: make
@ -28,6 +30,7 @@ you will need to install %{name}-devel.
%prep
%setup -q
%patch -P 0 -p1
%build
# remove library rpath from Makefile
@ -70,6 +73,9 @@ make check
%{_includedir}/*.h
%changelog
* Wed Jun 14 2023 David Cantrell <dcantrell@redhat.com> - 4.1-12
- Fix for CVE-2023-33461 (BZ#2211622)
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.1-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild