From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: =?utf-8?b?THVrw6HFoSBaYW9yYWwgPGx6YW9yYWxAcmVkaGF0LmNvbT4=?= To: git-commits@fedoraproject.org Subject: [rpms/coreutils] rawhide: unexpand: fix heap overflows Date: Thu, 11 Jun 2026 09:36:52 GMT Message-ID: <178117061298.1.15338920564930049854.rpms-coreutils-e65fb15ba529@fedoraproject.org> List-ID: X-Git-Repo: rpms/coreutils X-Git-Branch: rawhide X-Git-Rev: e65fb15ba52915c188adce7e7df83813c3993990 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY29yZXV0aWxzCkJy YW5jaCA6IHJhd2hpZGUKQ29tbWl0IDogZTY1ZmIxNWJhNTI5MTVjMTg4YWRjZTdlN2RmODM4MTNj Mzk5Mzk5MApBdXRob3IgOiBMdWvDocWhIFphb3JhbCA8bHphb3JhbEByZWRoYXQuY29tPgpEYXRl ICAgOiAyMDI2LTA2LTExVDExOjM2OjI5KzAyOjAwClN0YXRzICA6ICsxMjIvLTUgaW4gMiBmaWxl KHMpClVSTCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvY29yZXV0aWxz L2MvZTY1ZmIxNWJhNTI5MTVjMTg4YWRjZTdlN2RmODM4MTNjMzk5Mzk5MD9icmFuY2g9cmF3aGlk ZQoKTG9nOgp1bmV4cGFuZDogZml4IGhlYXAgb3ZlcmZsb3dzCgotLS0KZGlmZiAtLWdpdCBhL2Nv cmV1dGlscy05LjExLXVuZXhwYW5kLWhlYXAtb3ZlcmZsb3dzLnBhdGNoIGIvY29yZXV0aWxzLTku MTEtdW5leHBhbmQtaGVhcC1vdmVyZmxvd3MucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5k ZXggMDAwMDAwMC4uM2JhYjUzMgotLS0gL2Rldi9udWxsCisrKyBiL2NvcmV1dGlscy05LjExLXVu ZXhwYW5kLWhlYXAtb3ZlcmZsb3dzLnBhdGNoCkBAIC0wLDAgKzEsMTEzIEBACitGcm9tIGY3ZDVi NzYzZjY5MWIzNjYwM2NkZDJhYzFmYzc5YTZhNzMxYmRkYmYgTW9uIFNlcCAxNyAwMDowMDowMCAy MDAxCitGcm9tOiBQw6FkcmFpZyBCcmFkeSA8UEBkcmFpZ0JyYWR5LmNvbT4KK0RhdGU6IFR1ZSwg MjggQXByIDIwMjYgMjA6MzM6MTAgKzAxMDAKK1N1YmplY3Q6IFtQQVRDSF0gdW5leHBhbmQ6IGZp eCBoZWFwIG92ZXJmbG93CitNSU1FLVZlcnNpb246IDEuMAorQ29udGVudC1UeXBlOiB0ZXh0L3Bs YWluOyBjaGFyc2V0PVVURi04CitDb250ZW50LVRyYW5zZmVyLUVuY29kaW5nOiA4Yml0CisKKyog c3JjL3VuZXhwYW5kLmMgKHVuZXhwYW5kKTogVXNlIHhpbm1hbGxvYygpIHRvIGdyYWNlZnVsbHkK K2hhbmRsZSBvdmVyZmxvdy4gIEFsc28gdXNlIHRoZSBydW50aW1lIGxvY2FsZSBzcGVjaWZpYyBN Ql9DVVJfTUFYCityYXRoZXIgdGhhbiB0aGUgd29yc3QgY2FzZSBNQl9MRU5fTUFYLgorKiB0ZXN0 cy91bmV4cGFuZC9tYi5zaDogQWRkIGEgdGVzdCBjYXNlIHRoYXQgZmFpbHMgaW4gYSBkZWZhdWx0 CitnbGliYyBidWlsZCB3aXRoIGVpdGhlciBNQl9DVVJfTUFYIG9yIE1CX0xFTl9NQVguCitSZXBv cnRlZCBieSBNaWNoYcWCIE1hamNocm93aWN6LgorCisoY2hlcnJ5IHBpY2tlZCBmcm9tIGNvbW1p dCBiNjBhMTU5ZmRjNWJmY2Y5OTg4ZDNhNGNiNmY1M2FiZThhZDVkMzVkKQorLS0tCisgc3JjL3Vu ZXhwYW5kLmMgICAgICAgfCAyICstCisgdGVzdHMvdW5leHBhbmQvbWIuc2ggfCA4ICsrKysrKysr CisgMiBmaWxlcyBjaGFuZ2VkLCA5IGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKKworZGlm ZiAtLWdpdCBhL3NyYy91bmV4cGFuZC5jIGIvc3JjL3VuZXhwYW5kLmMKK2luZGV4IDRmYmY5ZDMu Ljc2MWM4ZWEgMTAwNjQ0CistLS0gYS9zcmMvdW5leHBhbmQuYworKysrIGIvc3JjL3VuZXhwYW5k LmMKK0BAIC0xMzEsNyArMTMxLDcgQEAgdW5leHBhbmQgKHZvaWQpCisgICAvKiBUaGUgd29yc3Qg Y2FzZSBpcyBhIG5vbi1ibGFuayBjaGFyYWN0ZXIsIHRoZW4gb25lIGJsYW5rLCB0aGVuIGEKKyAg ICAgIHRhYiBzdG9wLCB0aGVuIE1BWF9DT0xVTU5fV0lEVEggLSAxIGJsYW5rcywgdGhlbiBhIG5v bi1ibGFuazsgc28KKyAgICAgIGFsbG9jYXRlIE1BWF9DT0xVTU5fV0lEVEggYnl0ZXMgdG8gc3Rv cmUgdGhlIGJsYW5rcy4gICovCistICBwZW5kaW5nX2JsYW5rID0geGltYWxsb2MgKG1heF9jb2x1 bW5fd2lkdGggKiBzaXplb2YgKGNoYXIpICogTUJfTEVOX01BWCk7CisrICBwZW5kaW5nX2JsYW5r ID0geGlubWFsbG9jIChtYXhfY29sdW1uX3dpZHRoLCBNQl9DVVJfTUFYKTsKKyAKKyAgIHdoaWxl ICh0cnVlKQorICAgICB7CitkaWZmIC0tZ2l0IGEvdGVzdHMvdW5leHBhbmQvbWIuc2ggYi90ZXN0 cy91bmV4cGFuZC9tYi5zaAoraW5kZXggNzZhMjY3OS4uMDc2YTFjMSAxMDA3NTUKKy0tLSBhL3Rl c3RzL3VuZXhwYW5kL21iLnNoCisrKysgYi90ZXN0cy91bmV4cGFuZC9tYi5zaAorQEAgLTE3LDYg KzE3LDcgQEAKKyAKKyAuICIke3NyY2Rpcj0ufS90ZXN0cy9pbml0LnNoIjsgcGF0aF9wcmVwZW5k XyAuL3NyYworIHByaW50X3Zlcl8gdW5leHBhbmQgcHJpbnRmCisrZ2V0bGltaXRzXworIAorIHRl c3QgIiRMT0NBTEVfRlJfVVRGOCIgIT0gbm9uZSB8fCBza2lwXyAiRnJlbmNoIFVURi04IGxvY2Fs ZSBub3QgYXZhaWxhYmxlIgorIGV4cG9ydCBMQ19BTEw9IiRMT0NBTEVfRlJfVVRGOCIKK0BAIC0x NjEsNCArMTYyLDExIEBAIEVPRgorIHVuZXhwYW5kIC1hIC4vaW4gLi9pbiA+IG91dCB8fCBmYWls PTEKKyBjb21wYXJlIGV4cCBvdXQgPiAvZGV2L251bGwgMj4mMSB8fCBmYWlsPTEKKyAKKysjIEVu c3VyZSBvdmVyZmxvdyBpcyBoYW5kZWQgZ3JhY2VmdWxseQorKyMgY29yZXV0aWxzIHY5LjExIGlu ZHVjZWQgYSBidWZmZXIgb3ZlcmZsb3cgd2l0aCBtYl9tdWw9NCAob3IgMTYpLgorK2ZvciBtYl9t dWwgaW4gNCA2OyBkbworKyAgcHJpbnRmICcgICBcbicgfCB1bmV4cGFuZCAtdCAkKGV4cHIgJFNJ WkVfTUFYIC8gJG1iX211bCArIDEpIDI+ZXJyOyByZXQ9JD8KKysgIHRlc3QgIiRyZXQiID0gMSB8 fCB0ZXN0ICIkcmV0IiA9IDAgfHwgeyBjYXQgZXJyOyBmYWlsPTE7IH0KKytkb25lCisrCisgRXhp dCAkZmFpbAorLS0gCisyLjU0LjAKKworRnJvbSA1MjhjNzQwODE3ZDIyMzVkZDM3MjY5MjkyYzVl MzE2NzkzNWQyNzYxIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTogYWl6dS1tIDxhaXp1 bXVzaGVlcjJAZ21haWwuY29tPgorRGF0ZTogVHVlLCA5IEp1biAyMDI2IDEyOjM3OjA2ICswNTMw CitTdWJqZWN0OiBbUEFUQ0hdIHVuZXhwYW5kOiBmaXggaGVhcCBvdmVyZmxvdyB3aGVuIGEgd2lk ZSBibGFuayBvdmVyc2hvb3RzIGEKKyB0YWIgc3RvcAorCisqIHNyYy91bmV4cGFuZC5jICh1bmV4 cGFuZCk6IENoZWNrIGlmIHRoZSBjb2x1bW4gaXMgZ3JlYXRlciBvciBlcXVhbCB0bwordGhlIG5l eHRfdGFiX2NvbHVtbi4KKyogdGVzdHMvdW5leHBhbmQvbWIuc2g6IEFkZCBhIHRlc3QgY2FzZS4K K2h0dHBzOi8vZ2l0aHViLmNvbS9jb3JldXRpbHMvY29yZXV0aWxzL3B1bGwvMjg1CitDb3B5cmln aHQtcGFwZXJ3b3JrLWV4ZW1wdDogWWVzCisKKyhjaGVycnkgcGlja2VkIGZyb20gY29tbWl0IDRh ZGU5Y2Y3N2Y2YzdiMzllM2ZkYzVjZTk3YTc3OGY4ZTI5NDY5NGMpCistLS0KKyBzcmMvdW5leHBh bmQuYyAgICAgICB8IDIgKy0KKyB0ZXN0cy91bmV4cGFuZC9tYi5zaCB8IDkgKysrKysrKysrCisg MiBmaWxlcyBjaGFuZ2VkLCAxMCBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCisKK2RpZmYg LS1naXQgYS9zcmMvdW5leHBhbmQuYyBiL3NyYy91bmV4cGFuZC5jCitpbmRleCA3NjFjOGVhLi4z YmRlOTg1IDEwMDY0NAorLS0tIGEvc3JjL3VuZXhwYW5kLmMKKysrKyBiL3NyYy91bmV4cGFuZC5j CitAQCAtMjAxLDcgKzIwMSw3IEBAIHVuZXhwYW5kICh2b2lkKQorICAgICAgICAgICAgICAgICAg ICAgICAgIHsKKyAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbHVtbiArPSBjMzJ3aWR0aCAo Zy5jaCk7CisgCistICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoISAocHJldl9ibGFuayAm JiBjb2x1bW4gPT0gbmV4dF90YWJfY29sdW1uKSkKKysgICAgICAgICAgICAgICAgICAgICAgICAg IGlmICghIChwcmV2X2JsYW5rICYmIGNvbHVtbiA+PSBuZXh0X3RhYl9jb2x1bW4pKQorICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB7CisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg LyogSXQgaXMgbm90IHlldCBrbm93biB3aGV0aGVyIHRoZSBwZW5kaW5nIGJsYW5rcworICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdpbGwgYmUgcmVwbGFjZWQgYnkgdGFicy4gICov CitkaWZmIC0tZ2l0IGEvdGVzdHMvdW5leHBhbmQvbWIuc2ggYi90ZXN0cy91bmV4cGFuZC9tYi5z aAoraW5kZXggMDc2YTFjMS4uODRiYTAzNSAxMDA3NTUKKy0tLSBhL3Rlc3RzL3VuZXhwYW5kL21i LnNoCisrKysgYi90ZXN0cy91bmV4cGFuZC9tYi5zaAorQEAgLTE2OSw0ICsxNjksMTMgQEAgZm9y IG1iX211bCBpbiA0IDY7IGRvCisgICB0ZXN0ICIkcmV0IiA9IDEgfHwgdGVzdCAiJHJldCIgPSAw IHx8IHsgY2F0IGVycjsgZmFpbD0xOyB9CisgZG9uZQorIAorKyMgQSBibGFuayB3aG9zZSBkaXNw bGF5IHdpZHRoIGV4Y2VlZHMgdGhlIHRhYiBkaXN0YW5jZSBtdXN0IG5vdCBvdmVycnVuCisrIyB0 aGUgcGVuZGluZy1ibGFuayBidWZmZXIuICBXaXRoIC10MSBldmVyeSBjb2x1bW4gaXMgYSB0YWIg c3RvcCwgc28gYQorKyMgd2lkdGgtMiBpZGVvZ3JhcGhpYyBzcGFjZSBzdGVwcyBvdmVyIHRoZSBz dG9wIHdpdGhvdXQgbGFuZGluZyBvbiBpdDsKKysjIHRoZSBydW4gb2YgYmxhbmtzIHRoZW4gZ3Jl dyBwZW5kaW5nX2JsYW5rIHdpdGhvdXQgYm91bmQuCisraWRlb19zcGFjZT0kKGVudiBwcmludGYg J1x1MzAwMCcpCisreyB5ZXMgIiRpZGVvX3NwYWNlIiB8IGhlYWQgLW4gNDAwMDAgfCB0ciAtZCAn XG4nOyBlY2hvOyB9IHwKKysgIHVuZXhwYW5kIC10MSA+b3V0IDI+ZXJyOyByZXQ9JD8KKyt0ZXN0 ICIkcmV0IiA9IDAgfHwgeyBjYXQgZXJyOyBmYWlsPTE7IH0KKysKKyBFeGl0ICRmYWlsCistLSAK KzIuNTQuMAorCgpkaWZmIC0tZ2l0IGEvY29yZXV0aWxzLnNwZWMgYi9jb3JldXRpbHMuc3BlYwpp bmRleCAzZGVjYzE3Li4wYzNlNTE2IDEwMDY0NAotLS0gYS9jb3JldXRpbHMuc3BlYworKysgYi9j b3JldXRpbHMuc3BlYwpAQCAtMSw3ICsxLDcgQEAKIFN1bW1hcnk6IEEgc2V0IG9mIGJhc2ljIEdO VSB0b29scyBjb21tb25seSB1c2VkIGluIHNoZWxsIHNjcmlwdHMKIE5hbWU6ICAgIGNvcmV1dGls cwogVmVyc2lvbjogOS4xMQotUmVsZWFzZTogMiV7P2Rpc3R9CitSZWxlYXNlOiAzJXs/ZGlzdH0K ICMgc29tZSB1c2VkIHBhcnRzIG9mIGdudWxpYiBhcmUgdW5kZXIgdmFyaW91cyB2YXJpYW50cyBv ZiBMR1BMCiBMaWNlbnNlOiBHUEwtMy4wLW9yLWxhdGVyIEFORCBHRkRMLTEuMy1uby1pbnZhcmlh bnRzLW9yLWxhdGVyIEFORCBMR1BMLTIuMS1vci1sYXRlciBBTkQgTEdQTC0zLjAtb3ItbGF0ZXIK IFVybDogICAgIGh0dHBzOi8vd3d3LmdudS5vcmcvc29mdHdhcmUvY29yZXV0aWxzLwpAQCAtMzQs NiArMzQsMTEgQEAgUGF0Y2gxMDM6IGNvcmV1dGlscy1weXRob24zLnBhdGNoCiAjIGRmIC0tZGly ZWN0CiBQYXRjaDEwNDogY29yZXV0aWxzLWRmLWRpcmVjdC5wYXRjaAogCisjIHVuZXhwYW5kOiBm aXggaGVhcCBvdmVyZmxvd3MKKyMgaHR0cHM6Ly9jZ2l0LmdpdC5zYXZhbm5haC5nbnUub3JnL2Nn aXQvY29yZXV0aWxzLmdpdC9jb21taXQvP2lkPWI2MGExNTlmZGM1YmZjZjk5ODhkM2E0Y2I2ZjUz YWJlOGFkNWQzNWQKKyMgaHR0cHM6Ly9jZ2l0LmdpdC5zYXZhbm5haC5nbnUub3JnL2NnaXQvY29y ZXV0aWxzLmdpdC9jb21taXQvP2lkPTRhZGU5Y2Y3N2Y2YzdiMzllM2ZkYzVjZTk3YTc3OGY4ZTI5 NDY5NGMKK1BhdGNoMjAwOiBjb3JldXRpbHMtOS4xMS11bmV4cGFuZC1oZWFwLW92ZXJmbG93cy5w YXRjaAorCiAjIChzYikgbGluMThudXgvbHNiIGNvbXBsaWFuY2UgLSBtdWx0aWJ5dGUgZnVuY3Rp b25hbGl0eSBwYXRjaAogUGF0Y2g4MDA6IGNvcmV1dGlscy1pMThuLnBhdGNoCiAKQEAgLTE1OCwx MCArMTYzLDYgQEAgZmluZCB0ZXN0cyAtbmFtZSAnKi5zaCcgLXBlcm0gMDY0NCAtcHJpbnQgLWV4 ZWMgY2htb2QgMDc1NSAne30nICcrJwogIyB3aXRoIGNvcmV1dGlscyA5LjYgYW5kIGJ1bmRsZWQg Z2V0dGV4dCAwLjE5LjIgZnJvbSBnZXR0ZXh0LWNvbW1vbi1kZXZlbC4KIHNlZCAtaSAicy8wLjE5 LjIvJChycG0gLXEgLS1xdWVyeWZvcm1hdCAnJSV7VkVSU0lPTn1cbicgZ2V0dGV4dC1kZXZlbCkv IiBib290c3RyYXAuY29uZiBjb25maWd1cmUuYWMKIAotIyByaGJ6IzI0NjMxNjg6IHJlY2VudCBw ZXJsLUlPLVR0eSAoMS4yNCspIGJyZWFrcyB0aGUgbWlzYy90dHktZW9mLnBsIHRlc3QKLSMgc2tp cCBzZXR0aW5nIHRoZSBjdXN0b20gZW9mIGNoYXIgYXMgd29ya2Fyb3VuZAotc2VkIC1pICdzL3Nl dF90dHlfZW9mX2NoYXIgKCRleHAtPnNsYXZlLCAkZW9mX2NoYXIpOy8vJyB0ZXN0cy9taXNjL3R0 eS1lb2YucGwKLQogJWlmIDAlez9yaGVsfQogIyBUZW1wb3JhcmlseSBkaXNhYmxlIHRlc3QtZ2V0 YWRkcmluZm8gZnJvbSBnbnVsaWIgYmVjYXVzZSBpdCBtYWxmdW5jdGlvbnMgaW4KICMgdGhlIGVu dmlyb25tZW50IHVzZWQgdG8gYm9vdHN0cmFwIFJIRUwuCkBAIC0yODksNiArMjkwLDkgQEAgcm0g LWYgJFJQTV9CVUlMRF9ST09UJXtfaW5mb2Rpcn0vZGlyCiAlbGljZW5zZSBDT1BZSU5HCiAKICVj aGFuZ2Vsb2cKKyogVGh1IEp1biAxMSAyMDI2IEx1a8OhxaEgWmFvcmFsIDxsemFvcmFsQHJlZGhh dC5jb20+IC0gOS4xMS0zCistIHVuZXhwYW5kOiBmaXggaGVhcCBvdmVyZmxvd3MKKwogKiBGcmkg TWF5IDAxIDIwMjYgRGF2aWRlIEJvbGNpb25pIDxkYm9sY2lvbmlAZ21haWwuY29tPiAtIDkuMTEt MgogLSBmaXggY29yZXV0aWxzLnNpbmdsZSBkYW5nbGluZyBzeW1saW5rIChyaGJ6IzI0NjQ2MTgp CiAK