From b27961c65b3b5024c0d0645dcc56c1a2a69d1db2 Mon Sep 17 00:00:00 2001
From: David Cantrell <dcantrell@redhat.com>
Date: Wed, 14 Jun 2023 11:36:28 -0400
Subject: [PATCH] Fix for CVE-2023-33461 (BZ#2211622)

Signed-off-by: David Cantrell <dcantrell@redhat.com>
---
 iniparser-4.1-CVE-2023-33461.patch | 30 ++++++++++++++++++++++++++++++
 iniparser.spec                     |  8 +++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 iniparser-4.1-CVE-2023-33461.patch

diff --git a/iniparser-4.1-CVE-2023-33461.patch b/iniparser-4.1-CVE-2023-33461.patch
new file mode 100644
index 0000000..3598e79
--- /dev/null
+++ b/iniparser-4.1-CVE-2023-33461.patch
@@ -0,0 +1,30 @@
+diff -up iniparser-4.1/src/iniparser.c.orig iniparser-4.1/src/iniparser.c
+--- iniparser-4.1/src/iniparser.c.orig	2017-11-02 05:09:15.000000000 -0400
++++ iniparser-4.1/src/iniparser.c	2023-06-14 11:32:33.773972538 -0400
+@@ -456,7 +456,7 @@ long int iniparser_getlongint(const dict
+     const char * str ;
+ 
+     str = iniparser_getstring(d, key, INI_INVALID_KEY);
+-    if (str==INI_INVALID_KEY) return notfound ;
++    if (str==NULL || str==INI_INVALID_KEY) return notfound ;
+     return strtol(str, NULL, 0);
+ }
+ 
+@@ -511,7 +511,7 @@ double iniparser_getdouble(const diction
+     const char * str ;
+ 
+     str = iniparser_getstring(d, key, INI_INVALID_KEY);
+-    if (str==INI_INVALID_KEY) return notfound ;
++    if (str==NULL || str==INI_INVALID_KEY) return notfound ;
+     return atof(str);
+ }
+ 
+@@ -553,7 +553,7 @@ int iniparser_getboolean(const dictionar
+     const char * c ;
+ 
+     c = iniparser_getstring(d, key, INI_INVALID_KEY);
+-    if (c==INI_INVALID_KEY) return notfound ;
++    if (c==NULL || c==INI_INVALID_KEY) return notfound ;
+     if (c[0]=='y' || c[0]=='Y' || c[0]=='1' || c[0]=='t' || c[0]=='T') {
+         ret = 1 ;
+     } else if (c[0]=='n' || c[0]=='N' || c[0]=='0' || c[0]=='f' || c[0]=='F') {
diff --git a/iniparser.spec b/iniparser.spec
index 2a2199f..9b1021c 100644
--- a/iniparser.spec
+++ b/iniparser.spec
@@ -3,13 +3,15 @@
 
 Name:		iniparser
 Version:	4.1
-Release:	11%{?dist}
+Release:	12%{?dist}
 Summary:	C library for parsing "INI-style" files
 
 License:	MIT
 URL:		https://github.com/ndevilla/%{name}
 Source0:	https://github.com/ndevilla/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
 
+Patch0:	iniparser-4.1-CVE-2023-33461.patch
+
 BuildRequires:	gcc
 BuildRequires: make
 
@@ -28,6 +30,7 @@ you will need to install %{name}-devel.
 
 %prep
 %setup -q
+%patch -P 0 -p1
 
 %build
 # remove library rpath from Makefile
@@ -70,6 +73,9 @@ make check
 %{_includedir}/*.h
 
 %changelog
+* Wed Jun 14 2023 David Cantrell <dcantrell@redhat.com> - 4.1-12
+- Fix for CVE-2023-33461 (BZ#2211622)
+
 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.1-11
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild