Fix CVE-2023-2602

- Correctly check pthread_create() return value to avoid memory leak
  (CVE-2023-2602)

Resolves: rhbz#2222198

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

libcap-cve-2023-2602.patch

@@ -0,0 +1,36 @@
+commit bc6b36682f188020ee4770fae1d41bde5b2c97bb
+Author: Andrew G. Morgan <morgan@kernel.org>
+Date:   Wed May 3 19:18:36 2023 -0700
+
+    Correct the check of pthread_create()'s return value.
+    
+    This function returns a positive number (errno) on error, so the code
+    wasn't previously freeing some memory in this situation.
+    
+    Discussion:
+    
+      https://stackoverflow.com/a/3581020/14760867
+    
+    Credit for finding this bug in libpsx goes to David Gstir of
+    X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security
+    audit of the libcap source code in April of 2023. The audit
+    was sponsored by the Open Source Technology Improvement Fund
+    (https://ostif.org/).
+    
+    Audit ref: LCAP-CR-23-01 (CVE-2023-2602)
+    
+    Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
+
+diff --git a/psx/psx.c b/psx/psx.c
+index d9c0485..65eb2aa 100644
+--- a/psx/psx.c
++++ b/psx/psx.c
+@@ -516,7 +516,7 @@ int __wrap_pthread_create(pthread_t *thread, const pthread_attr_t *attr,
+     pthread_sigmask(SIG_BLOCK, &sigbit, NULL);
+ 
+     int ret = __real_pthread_create(thread, attr, _psx_start_fn, starter);
+-    if (ret == -1) {
++    if (ret > 0) {
+ 	psx_new_state(_PSX_CREATE, _PSX_IDLE);
+ 	memset(starter, 0, sizeof(*starter));
+ 	free(starter);

libcap.spec

@@ -13,6 +13,7 @@ Patch3: libcap-static-analysis-fix-3.patch
 Patch4: libcap-disable-golang.patch
 Patch5: libcap-fix-ambient-caps.patch
 Patch6: libcap-cve-2023-2603.patch
+Patch7: libcap-cve-2023-2602.patch
 
 BuildRequires: libattr-devel pam-devel perl-interpreter gcc
 BuildRequires: make
@@ -92,6 +93,8 @@ chmod +x %{buildroot}/%{_libdir}/*.so.*
 * Wed Jul 12 2023 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 2.48-9
 - Fix integer overflow in _libcap_strdup() (CVE-2023-2603)
   Resolves: rhbz#2210638
+- Correctly check pthread_create() return value to avoid memory leak (CVE-2023-2602)
+  Resolves: rhbz#2222198
 
 * Fri Jan 28 2022 Zoltan Fridrich <zfridric@redhat.com> - 2.48-8
 - Fix ambient capabilities for non-root users