[rpms/nasm] f43: fix CVE-2026-6067 and CVE-2026-6068

[Dominik 'Rathann' Mierzejewski <dominik@greysector.net>]

            A new commit has been pushed.

            Repo   : rpms/nasm
            Branch : f43
            Commit : 6c995b2e8718376f12937f4067927a24dfc814ae
            Author : Dominik 'Rathann' Mierzejewski <dominik@greysector.net>
            Date   : 2026-07-22T12:37:45+02:00
            Stats  : +148/-2 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/nasm/c/6c995b2e8718376f12937f4067927a24dfc814ae?branch=f43

            Log:
            fix CVE-2026-6067 and CVE-2026-6068

- patch by Nick Clifton (resolves rhbz#2458087, rhbz#2458089)
- backport fix for CVE-2026-6068 (resolves rhbz#2458090)

---
diff --git a/nasm-CVE-2026-6067.patch b/nasm-CVE-2026-6067.patch
new file mode 100644
index 0000000..9557e49
--- /dev/null
+++ b/nasm-CVE-2026-6067.patch
@@ -0,0 +1,16 @@
+diff -up nasm-2.16.03/output/outobj.c.orig nasm-2.16.03/output/outobj.c
+--- nasm-2.16.03/output/outobj.c.orig	2024-04-17 19:04:08.000000000 +0200
++++ nasm-2.16.03/output/outobj.c	2026-06-05 13:38:51.188647432 +0200
+@@ -1641,6 +1641,12 @@ obj_directive(enum directive directive,
+                 /*
+                  * Now p contains a segment name. Find it.
+                  */
++                if (grp->nentries >= GROUP_MAX)
++                {
++                    /* Issue 203 aka CVE-2026-6067. */
++                    nasm_nonfatal("too many segments in a group");
++                    return DIRR_ERROR;
++                }
+                 for (seg = seghead; seg; seg = seg->next)
+                     if (!strcmp(seg->name, p))
+                         break;

diff --git a/nasm-CVE-2026-6068.patch b/nasm-CVE-2026-6068.patch
new file mode 100644
index 0000000..454e18e
--- /dev/null
+++ b/nasm-CVE-2026-6068.patch
@@ -0,0 +1,122 @@
+diff -up nasm-2.16.03/asm/nasm.c.orig nasm-2.16.03/asm/nasm.c
+--- nasm-2.16.03/asm/nasm.c.orig	2024-04-17 19:04:08.000000000 +0200
++++ nasm-2.16.03/asm/nasm.c	2026-07-22 12:12:43.092010343 +0200
+@@ -154,8 +154,8 @@ static unsigned int operating_mode;
+ /* Dependency flags */
+ static bool depend_emit_phony = false;
+ static bool depend_missing_ok = false;
+-static const char *depend_target = NULL;
+-static const char *depend_file = NULL;
++static char *depend_target = NULL;
++static char *depend_file = NULL;
+ struct strlist *depend_list;
+ 
+ static bool want_usage;
+@@ -745,6 +745,8 @@ int main(int argc, char **argv)
+     stdscan_cleanup();
+     src_free();
+     strlist_free(&include_path);
++    nasm_free(depend_file);
++    nasm_free(depend_target);
+ 
+     return terminate_after_phase;
+ }
+@@ -778,7 +780,8 @@ static void copy_filename(const char **d
+ }
+ 
+ /*
+- * Convert a string to a POSIX make-safe form
++ * Convert a string to a POSIX make-safe form; returns a newly allocated
++ * string.
+  */
+ static char *quote_for_pmake(const char *str)
+ {
+@@ -858,7 +861,8 @@ static char *quote_for_pmake(const char
+ }
+ 
+ /*
+- * Convert a string to a Watcom make-safe form
++ * Convert a string to a Watcom make-safe form; returns a newly allocated
++ * string.
+  */
+ static char *quote_for_wmake(const char *str)
+ {
+@@ -1197,20 +1201,20 @@ static bool process_arg(char *p, char *q
+                 case 'D':
+                     operating_mode |= OP_DEPEND;
+                     if (q && (q[0] != '-' || q[1] == '\0')) {
+-                        depend_file = q;
++                        nasm_strdupto(&depend_file, q);
+                         advance = true;
+                     }
+                     break;
+                 case 'F':
+-                    depend_file = q;
++                    nasm_strdupto(&depend_file, q);
+                     advance = true;
+                     break;
+                 case 'T':
+-                    depend_target = q;
++                    nasm_strdupto(&depend_target, q);
+                     advance = true;
+                     break;
+                 case 'Q':
+-                    depend_target = quote_for_make(q);
++                    nasm_strto(&depend_target, quote_for_make(q));
+                     advance = true;
+                     break;
+                 case 'W':
+diff -up nasm-2.16.03/include/nasmlib.h.orig nasm-2.16.03/include/nasmlib.h
+--- nasm-2.16.03/include/nasmlib.h.orig	2024-04-17 19:04:08.000000000 +0200
++++ nasm-2.16.03/include/nasmlib.h	2026-07-22 12:35:23.831994761 +0200
+@@ -72,6 +72,29 @@ char * safe_alloc nasm_strcat(const char
+ char * safe_alloc end_with_null nasm_strcatn(const char *one, ...);
+ 
+ /*
++ * Replace a string in a string pointer variable with a nasm_strdup()
++ * copy of the argument on the right, freeing the contents of the
++ * previous contents of the variable if non-NULL.
++ *
++ * If *str is NULL, simply return the old value of *ptrp.
++ */
++char *nasm_strdupto(char **ptrp, const char *str);
++
++/*
++ * Similar, but the new pointer must already have been heap allocated
++ * by the creating function.
++ */
++static inline char *nasm_strto(char **ptrp, char *str)
++{
++    char *ptr = *ptrp;
++    if (!str)
++        return ptr;
++    if (ptr)
++        nasm_free(ptr);
++    return *ptrp = str;
++}
++
++/*
+  * nasm_[v]asprintf() are variants of the semi-standard [v]asprintf()
+  * functions, except that we return the pointer instead of a count.
+  * The size of the string (including the final NUL!) is available
+diff -up nasm-2.16.03/nasmlib/alloc.c.orig nasm-2.16.03/nasmlib/alloc.c
+--- nasm-2.16.03/nasmlib/alloc.c.orig	2024-04-17 19:04:08.000000000 +0200
++++ nasm-2.16.03/nasmlib/alloc.c	2026-07-22 12:30:43.177278113 +0200
+@@ -118,6 +118,17 @@ char *nasm_strdup(const char *s)
+     return memcpy(p, s, size);
+ }
+ 
++char *nasm_strdupto(char **ptrp, const char *str)
++{
++    char *ptr = *ptrp;
++    if (str) {
++        if (ptr)
++            nasm_free(ptr);
++        *ptrp = ptr = nasm_strdup(str);
++    }
++    return ptr;
++}
++
+ char *nasm_strndup(const char *s, size_t len)
+ {
+     char *p;

diff --git a/nasm.spec b/nasm.spec
index a65896f..f19772f 100644
--- a/nasm.spec
+++ b/nasm.spec
@@ -9,12 +9,15 @@
 Summary: A portable x86 assembler which uses Intel-like syntax
 Name: nasm
 Version: 2.16.03
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: BSD-2-Clause
 URL: http://www.nasm.us
 Source0: https://www.nasm.us/pub/nasm/releasebuilds/%{version}/%{name}-%{version}.tar.xz
 Source1: https://www.nasm.us/pub/nasm/releasebuilds/%{version}/%{name}-%{version}-xdoc.tar.xz
-
+# https://github.com/netwide-assembler/nasm/issues/203
+Patch0: nasm-CVE-2026-6067.patch
+# https://github.com/netwide-assembler/nasm/issues/222
+Patch1: nasm-CVE-2026-6068.patch
 BuildRequires: perl(Env)
 BuildRequires: autoconf
 BuildRequires: automake
@@ -84,6 +87,11 @@ make -C test golden test diff
 %endif
 
 %changelog
+* Wed Jul 22 2026 Dominik Mierzejewski <rpm@greysector.net> - 2.16.03-5
+- fix CVE-2026-6067 (resolves rhbz#2458087, rhbz#2458089)
+  patch by Nick Clifton
+- backport fix for CVE-2026-6068 (resolves rhbz#2458090)
+
 * Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.16.03-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild