Auto sync2gitlab import of rsync-3.1.3-19.el8.src.rpm

rsync-3.1.3-cve-2022-37434.patch

@@ -0,0 +1,16 @@
+diff --git a/zlib/inflate.c b/zlib/inflate.c
+index e43abd9..bd33c19 100644
+--- a/zlib/inflate.c
++++ b/zlib/inflate.c
+@@ -740,8 +740,9 @@ int flush;
+                 if (copy > have) copy = have;
+                 if (copy) {
+                     if (state->head != Z_NULL &&
+-                        state->head->extra != Z_NULL) {
+-                        len = state->head->extra_len - state->length;
++                        state->head->extra != Z_NULL &&
++                        (len = state->head->extra_len - state->length) <
++			    state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);

rsync.spec

@@ -9,7 +9,7 @@
 Summary: A program for synchronizing files over a network
 Name: rsync
 Version: 3.1.3
-Release: 17%{?dist}
+Release: 19%{?dist}
 Group: Applications/Internet
 URL: http://rsync.samba.org/
 
@@ -38,6 +38,8 @@ Patch7: rsync-3.1.3-skip-compress.patch
 Patch8: rsync-3.1.3-xattr.patch
 Patch9: rsync-3.1.3-cve-2018-25032.patch
 Patch10: rsync-3.1.3-sparse-block.patch
+Patch11: rsync-3.1.3-cve-2022-29154.patch
+Patch12: rsync-3.1.3-cve-2022-37434.patch
 
 %description
 Rsync uses a reliable algorithm to bring remote and host files into
@@ -86,6 +88,8 @@ patch -p1 -i patches/copy-devices.diff
 %patch8 -p1 -b .xattr
 %patch9 -p1 -b .cve-2018-25032
 %patch10 -p1 -b .spars-block
+%patch11 -p1 -b .cve-2022-29154
+%patch12 -p1 -b .cve-2022-37434
 
 %build
 %configure
@@ -132,6 +136,12 @@ chmod -x support/*
 %systemd_postun_with_restart rsyncd.service
 
 %changelog
+* Thu Aug 18 2022 Michal Ruprich <mruprich@redhat.com> - 3.1.3-19
+- Resolves: #2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field
+
+* Mon Aug 15 2022 Michal Ruprich <mruprich@redhat.com> - 3.1.3-18
+- Resolves: #2111175 - remote arbitrary files write inside the directories of connecting peers
+
 * Mon Aug 08 2022 Michal Ruprich <mruprich@redhat.com> - 3.1.3-17
 - Related: #2043753 - New option should not be sent to the server every time