T.J. Townsend pushed to branch main at Arch Linux / Packaging / Packages / libcue
Commits: 035bddf1 by T.J. Townsend at 2023-10-09T16:19:32-04:00 upgpkg: 2.2.1-4: fix CVE-2023-43641 - - - - - 3 changed files: - + .SRCINFO - + CVE-2023-43641.patch - PKGBUILD Changes: ===================================== .SRCINFO ===================================== @@ -0,0 +1,15 @@ +pkgbase = libcue + pkgdesc = Parses so-called cue sheets and handles the parsed data + pkgver = 2.2.1 + pkgrel = 4 + url = https://github.com/lipnitsk/libcue/ + arch = x86_64 + license = GPL2 + makedepends = cmake + depends = glibc + source = libcue-2.2.1.tar.gz::https://github.com/lipnitsk/libcue/archive/v2.2.1.tar.gz + source = CVE-2023-43641.patch + sha512sums = 32e476cb09ed2cb2d64aaba1342fb91e77e448391b493a3a794a8d2a6723a0e6097a90b11c6ad82998cb7f270f4f18c2578d7b8575f6929c2a35502e09ebc964 + sha512sums = 7261b8c71a9d384689240eaf71b38360b341fa1751275a6560ae918c7da9c87019819c7ca49571a8bc8ffb38d76f7a002581055dbda932c76b0c26ffd8b2c7b0 + +pkgname = libcue ===================================== CVE-2023-43641.patch ===================================== @@ -0,0 +1,11 @@ +--- a/cd.c ++++ b/cd.c +@@ -339,7 +339,7 @@ track_get_rem(const Track* track) + + void track_set_index(Track *track, int i, long ind) + { +- if (i > MAXINDEX) { ++ if (i < 0 || i > MAXINDEX) { + fprintf(stderr, "too many indexes\n"); + return; + } ===================================== PKGBUILD ===================================== @@ -1,17 +1,25 @@ -# Maintainer: Gaetan Bisson <[email protected]> +# Maintainer: Felix Yan <[email protected]> +# Contributor: Gaetan Bisson <[email protected]> # Contributor: said <atvordhosbn[at]gmail[dot]com> pkgname=libcue pkgver=2.2.1 -pkgrel=3 +pkgrel=4 pkgdesc='Parses so-called cue sheets and handles the parsed data' url='https://github.com/lipnitsk/libcue/' arch=('x86_64') license=('GPL2') -source=("$pkgname-$pkgver.tar.gz::https://github.com/lipnitsk/libcue/archive/v$pkgver.tar.gz";) +source=("$pkgname-$pkgver.tar.gz::https://github.com/lipnitsk/libcue/archive/v$pkgver.tar.gz"; + "CVE-2023-43641.patch") depends=('glibc') makedepends=('cmake') -sha512sums=('32e476cb09ed2cb2d64aaba1342fb91e77e448391b493a3a794a8d2a6723a0e6097a90b11c6ad82998cb7f270f4f18c2578d7b8575f6929c2a35502e09ebc964') +sha512sums=('32e476cb09ed2cb2d64aaba1342fb91e77e448391b493a3a794a8d2a6723a0e6097a90b11c6ad82998cb7f270f4f18c2578d7b8575f6929c2a35502e09ebc964' + '7261b8c71a9d384689240eaf71b38360b341fa1751275a6560ae918c7da9c87019819c7ca49571a8bc8ffb38d76f7a002581055dbda932c76b0c26ffd8b2c7b0') + +prepare() { + cd ${pkgname}-${pkgver} + patch -Np1 -i ../CVE-2023-43641.patch +} build() { cd ${pkgname}-${pkgver} View it on GitLab: https://gitlab.archlinux.org/archlinux/packaging/packages/libcue/-/commit/035bddf10ab0936e41daf829dac0ef3bd56bd2ce -- View it on GitLab: https://gitlab.archlinux.org/archlinux/packaging/packages/libcue/-/commit/035bddf10ab0936e41daf829dac0ef3bd56bd2ce You're receiving this email because of your account on gitlab.archlinux.org.
