From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Dominik 'Rathann' Mierzejewski To: git-commits@fedoraproject.org Subject: [rpms/nasm] f43: fix CVE-2026-6067 and CVE-2026-6068 Date: Wed, 22 Jul 2026 15:23:00 GMT Message-ID: <178473378077.1.6830417448455993536.rpms-nasm-6c995b2e8718@fedoraproject.org> List-ID: X-Git-Repo: rpms/nasm X-Git-Branch: f43 X-Git-Rev: 6c995b2e8718376f12937f4067927a24dfc814ae ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvbmFzbQogICAgICAgICAgICBCcmFuY2ggOiBmNDMKICAgICAgICAgICAgQ29t bWl0IDogNmM5OTViMmU4NzE4Mzc2ZjEyOTM3ZjQwNjc5MjdhMjRkZmM4MTRhZQogICAgICAgICAg ICBBdXRob3IgOiBEb21pbmlrICdSYXRoYW5uJyBNaWVyemVqZXdza2kgPGRvbWluaWtAZ3JleXNl Y3Rvci5uZXQ+CiAgICAgICAgICAgIERhdGUgICA6IDIwMjYtMDctMjJUMTI6Mzc6NDUrMDI6MDAK ICAgICAgICAgICAgU3RhdHMgIDogKzE0OC8tMiBpbiAzIGZpbGUocykKICAgICAgICAgICAgVVJM ICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9uYXNtL2MvNmM5OTViMmU4 NzE4Mzc2ZjEyOTM3ZjQwNjc5MjdhMjRkZmM4MTRhZT9icmFuY2g9ZjQzCgogICAgICAgICAgICBM b2c6CiAgICAgICAgICAgIGZpeCBDVkUtMjAyNi02MDY3IGFuZCBDVkUtMjAyNi02MDY4CgotIHBh dGNoIGJ5IE5pY2sgQ2xpZnRvbiAocmVzb2x2ZXMgcmhieiMyNDU4MDg3LCByaGJ6IzI0NTgwODkp Ci0gYmFja3BvcnQgZml4IGZvciBDVkUtMjAyNi02MDY4IChyZXNvbHZlcyByaGJ6IzI0NTgwOTAp CgotLS0KZGlmZiAtLWdpdCBhL25hc20tQ1ZFLTIwMjYtNjA2Ny5wYXRjaCBiL25hc20tQ1ZFLTIw MjYtNjA2Ny5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi45NTU3ZTQ5 Ci0tLSAvZGV2L251bGwKKysrIGIvbmFzbS1DVkUtMjAyNi02MDY3LnBhdGNoCkBAIC0wLDAgKzEs MTYgQEAKK2RpZmYgLXVwIG5hc20tMi4xNi4wMy9vdXRwdXQvb3V0b2JqLmMub3JpZyBuYXNtLTIu MTYuMDMvb3V0cHV0L291dG9iai5jCistLS0gbmFzbS0yLjE2LjAzL291dHB1dC9vdXRvYmouYy5v cmlnCTIwMjQtMDQtMTcgMTk6MDQ6MDguMDAwMDAwMDAwICswMjAwCisrKysgbmFzbS0yLjE2LjAz L291dHB1dC9vdXRvYmouYwkyMDI2LTA2LTA1IDEzOjM4OjUxLjE4ODY0NzQzMiArMDIwMAorQEAg LTE2NDEsNiArMTY0MSwxMiBAQCBvYmpfZGlyZWN0aXZlKGVudW0gZGlyZWN0aXZlIGRpcmVjdGl2 ZSwKKyAgICAgICAgICAgICAgICAgLyoKKyAgICAgICAgICAgICAgICAgICogTm93IHAgY29udGFp bnMgYSBzZWdtZW50IG5hbWUuIEZpbmQgaXQuCisgICAgICAgICAgICAgICAgICAqLworKyAgICAg ICAgICAgICAgICBpZiAoZ3JwLT5uZW50cmllcyA+PSBHUk9VUF9NQVgpCisrICAgICAgICAgICAg ICAgIHsKKysgICAgICAgICAgICAgICAgICAgIC8qIElzc3VlIDIwMyBha2EgQ1ZFLTIwMjYtNjA2 Ny4gKi8KKysgICAgICAgICAgICAgICAgICAgIG5hc21fbm9uZmF0YWwoInRvbyBtYW55IHNlZ21l bnRzIGluIGEgZ3JvdXAiKTsKKysgICAgICAgICAgICAgICAgICAgIHJldHVybiBESVJSX0VSUk9S OworKyAgICAgICAgICAgICAgICB9CisgICAgICAgICAgICAgICAgIGZvciAoc2VnID0gc2VnaGVh ZDsgc2VnOyBzZWcgPSBzZWctPm5leHQpCisgICAgICAgICAgICAgICAgICAgICBpZiAoIXN0cmNt cChzZWctPm5hbWUsIHApKQorICAgICAgICAgICAgICAgICAgICAgICAgIGJyZWFrOwoKZGlmZiAt LWdpdCBhL25hc20tQ1ZFLTIwMjYtNjA2OC5wYXRjaCBiL25hc20tQ1ZFLTIwMjYtNjA2OC5wYXRj aApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi40NTRlMThlCi0tLSAvZGV2L251 bGwKKysrIGIvbmFzbS1DVkUtMjAyNi02MDY4LnBhdGNoCkBAIC0wLDAgKzEsMTIyIEBACitkaWZm IC11cCBuYXNtLTIuMTYuMDMvYXNtL25hc20uYy5vcmlnIG5hc20tMi4xNi4wMy9hc20vbmFzbS5j CistLS0gbmFzbS0yLjE2LjAzL2FzbS9uYXNtLmMub3JpZwkyMDI0LTA0LTE3IDE5OjA0OjA4LjAw MDAwMDAwMCArMDIwMAorKysrIG5hc20tMi4xNi4wMy9hc20vbmFzbS5jCTIwMjYtMDctMjIgMTI6 MTI6NDMuMDkyMDEwMzQzICswMjAwCitAQCAtMTU0LDggKzE1NCw4IEBAIHN0YXRpYyB1bnNpZ25l ZCBpbnQgb3BlcmF0aW5nX21vZGU7CisgLyogRGVwZW5kZW5jeSBmbGFncyAqLworIHN0YXRpYyBi b29sIGRlcGVuZF9lbWl0X3Bob255ID0gZmFsc2U7Cisgc3RhdGljIGJvb2wgZGVwZW5kX21pc3Np bmdfb2sgPSBmYWxzZTsKKy1zdGF0aWMgY29uc3QgY2hhciAqZGVwZW5kX3RhcmdldCA9IE5VTEw7 Cistc3RhdGljIGNvbnN0IGNoYXIgKmRlcGVuZF9maWxlID0gTlVMTDsKKytzdGF0aWMgY2hhciAq ZGVwZW5kX3RhcmdldCA9IE5VTEw7Cisrc3RhdGljIGNoYXIgKmRlcGVuZF9maWxlID0gTlVMTDsK KyBzdHJ1Y3Qgc3RybGlzdCAqZGVwZW5kX2xpc3Q7CisgCisgc3RhdGljIGJvb2wgd2FudF91c2Fn ZTsKK0BAIC03NDUsNiArNzQ1LDggQEAgaW50IG1haW4oaW50IGFyZ2MsIGNoYXIgKiphcmd2KQor ICAgICBzdGRzY2FuX2NsZWFudXAoKTsKKyAgICAgc3JjX2ZyZWUoKTsKKyAgICAgc3RybGlzdF9m cmVlKCZpbmNsdWRlX3BhdGgpOworKyAgICBuYXNtX2ZyZWUoZGVwZW5kX2ZpbGUpOworKyAgICBu YXNtX2ZyZWUoZGVwZW5kX3RhcmdldCk7CisgCisgICAgIHJldHVybiB0ZXJtaW5hdGVfYWZ0ZXJf cGhhc2U7CisgfQorQEAgLTc3OCw3ICs3ODAsOCBAQCBzdGF0aWMgdm9pZCBjb3B5X2ZpbGVuYW1l KGNvbnN0IGNoYXIgKipkCisgfQorIAorIC8qCistICogQ29udmVydCBhIHN0cmluZyB0byBhIFBP U0lYIG1ha2Utc2FmZSBmb3JtCisrICogQ29udmVydCBhIHN0cmluZyB0byBhIFBPU0lYIG1ha2Ut c2FmZSBmb3JtOyByZXR1cm5zIGEgbmV3bHkgYWxsb2NhdGVkCisrICogc3RyaW5nLgorICAqLwor IHN0YXRpYyBjaGFyICpxdW90ZV9mb3JfcG1ha2UoY29uc3QgY2hhciAqc3RyKQorIHsKK0BAIC04 NTgsNyArODYxLDggQEAgc3RhdGljIGNoYXIgKnF1b3RlX2Zvcl9wbWFrZShjb25zdCBjaGFyCisg fQorIAorIC8qCistICogQ29udmVydCBhIHN0cmluZyB0byBhIFdhdGNvbSBtYWtlLXNhZmUgZm9y bQorKyAqIENvbnZlcnQgYSBzdHJpbmcgdG8gYSBXYXRjb20gbWFrZS1zYWZlIGZvcm07IHJldHVy bnMgYSBuZXdseSBhbGxvY2F0ZWQKKysgKiBzdHJpbmcuCisgICovCisgc3RhdGljIGNoYXIgKnF1 b3RlX2Zvcl93bWFrZShjb25zdCBjaGFyICpzdHIpCisgeworQEAgLTExOTcsMjAgKzEyMDEsMjAg QEAgc3RhdGljIGJvb2wgcHJvY2Vzc19hcmcoY2hhciAqcCwgY2hhciAqcQorICAgICAgICAgICAg ICAgICBjYXNlICdEJzoKKyAgICAgICAgICAgICAgICAgICAgIG9wZXJhdGluZ19tb2RlIHw9IE9Q X0RFUEVORDsKKyAgICAgICAgICAgICAgICAgICAgIGlmIChxICYmIChxWzBdICE9ICctJyB8fCBx WzFdID09ICdcMCcpKSB7CistICAgICAgICAgICAgICAgICAgICAgICAgZGVwZW5kX2ZpbGUgPSBx OworKyAgICAgICAgICAgICAgICAgICAgICAgIG5hc21fc3RyZHVwdG8oJmRlcGVuZF9maWxlLCBx KTsKKyAgICAgICAgICAgICAgICAgICAgICAgICBhZHZhbmNlID0gdHJ1ZTsKKyAgICAgICAgICAg ICAgICAgICAgIH0KKyAgICAgICAgICAgICAgICAgICAgIGJyZWFrOworICAgICAgICAgICAgICAg ICBjYXNlICdGJzoKKy0gICAgICAgICAgICAgICAgICAgIGRlcGVuZF9maWxlID0gcTsKKysgICAg ICAgICAgICAgICAgICAgIG5hc21fc3RyZHVwdG8oJmRlcGVuZF9maWxlLCBxKTsKKyAgICAgICAg ICAgICAgICAgICAgIGFkdmFuY2UgPSB0cnVlOworICAgICAgICAgICAgICAgICAgICAgYnJlYWs7 CisgICAgICAgICAgICAgICAgIGNhc2UgJ1QnOgorLSAgICAgICAgICAgICAgICAgICAgZGVwZW5k X3RhcmdldCA9IHE7CisrICAgICAgICAgICAgICAgICAgICBuYXNtX3N0cmR1cHRvKCZkZXBlbmRf dGFyZ2V0LCBxKTsKKyAgICAgICAgICAgICAgICAgICAgIGFkdmFuY2UgPSB0cnVlOworICAgICAg ICAgICAgICAgICAgICAgYnJlYWs7CisgICAgICAgICAgICAgICAgIGNhc2UgJ1EnOgorLSAgICAg ICAgICAgICAgICAgICAgZGVwZW5kX3RhcmdldCA9IHF1b3RlX2Zvcl9tYWtlKHEpOworKyAgICAg ICAgICAgICAgICAgICAgbmFzbV9zdHJ0bygmZGVwZW5kX3RhcmdldCwgcXVvdGVfZm9yX21ha2Uo cSkpOworICAgICAgICAgICAgICAgICAgICAgYWR2YW5jZSA9IHRydWU7CisgICAgICAgICAgICAg ICAgICAgICBicmVhazsKKyAgICAgICAgICAgICAgICAgY2FzZSAnVyc6CitkaWZmIC11cCBuYXNt LTIuMTYuMDMvaW5jbHVkZS9uYXNtbGliLmgub3JpZyBuYXNtLTIuMTYuMDMvaW5jbHVkZS9uYXNt bGliLmgKKy0tLSBuYXNtLTIuMTYuMDMvaW5jbHVkZS9uYXNtbGliLmgub3JpZwkyMDI0LTA0LTE3 IDE5OjA0OjA4LjAwMDAwMDAwMCArMDIwMAorKysrIG5hc20tMi4xNi4wMy9pbmNsdWRlL25hc21s aWIuaAkyMDI2LTA3LTIyIDEyOjM1OjIzLjgzMTk5NDc2MSArMDIwMAorQEAgLTcyLDYgKzcyLDI5 IEBAIGNoYXIgKiBzYWZlX2FsbG9jIG5hc21fc3RyY2F0KGNvbnN0IGNoYXIKKyBjaGFyICogc2Fm ZV9hbGxvYyBlbmRfd2l0aF9udWxsIG5hc21fc3RyY2F0bihjb25zdCBjaGFyICpvbmUsIC4uLik7 CisgCisgLyoKKysgKiBSZXBsYWNlIGEgc3RyaW5nIGluIGEgc3RyaW5nIHBvaW50ZXIgdmFyaWFi bGUgd2l0aCBhIG5hc21fc3RyZHVwKCkKKysgKiBjb3B5IG9mIHRoZSBhcmd1bWVudCBvbiB0aGUg cmlnaHQsIGZyZWVpbmcgdGhlIGNvbnRlbnRzIG9mIHRoZQorKyAqIHByZXZpb3VzIGNvbnRlbnRz IG9mIHRoZSB2YXJpYWJsZSBpZiBub24tTlVMTC4KKysgKgorKyAqIElmICpzdHIgaXMgTlVMTCwg c2ltcGx5IHJldHVybiB0aGUgb2xkIHZhbHVlIG9mICpwdHJwLgorKyAqLworK2NoYXIgKm5hc21f c3RyZHVwdG8oY2hhciAqKnB0cnAsIGNvbnN0IGNoYXIgKnN0cik7CisrCisrLyoKKysgKiBTaW1p bGFyLCBidXQgdGhlIG5ldyBwb2ludGVyIG11c3QgYWxyZWFkeSBoYXZlIGJlZW4gaGVhcCBhbGxv Y2F0ZWQKKysgKiBieSB0aGUgY3JlYXRpbmcgZnVuY3Rpb24uCisrICovCisrc3RhdGljIGlubGlu ZSBjaGFyICpuYXNtX3N0cnRvKGNoYXIgKipwdHJwLCBjaGFyICpzdHIpCisreworKyAgICBjaGFy ICpwdHIgPSAqcHRycDsKKysgICAgaWYgKCFzdHIpCisrICAgICAgICByZXR1cm4gcHRyOworKyAg ICBpZiAocHRyKQorKyAgICAgICAgbmFzbV9mcmVlKHB0cik7CisrICAgIHJldHVybiAqcHRycCA9 IHN0cjsKKyt9CisrCisrLyoKKyAgKiBuYXNtX1t2XWFzcHJpbnRmKCkgYXJlIHZhcmlhbnRzIG9m IHRoZSBzZW1pLXN0YW5kYXJkIFt2XWFzcHJpbnRmKCkKKyAgKiBmdW5jdGlvbnMsIGV4Y2VwdCB0 aGF0IHdlIHJldHVybiB0aGUgcG9pbnRlciBpbnN0ZWFkIG9mIGEgY291bnQuCisgICogVGhlIHNp emUgb2YgdGhlIHN0cmluZyAoaW5jbHVkaW5nIHRoZSBmaW5hbCBOVUwhKSBpcyBhdmFpbGFibGUK K2RpZmYgLXVwIG5hc20tMi4xNi4wMy9uYXNtbGliL2FsbG9jLmMub3JpZyBuYXNtLTIuMTYuMDMv bmFzbWxpYi9hbGxvYy5jCistLS0gbmFzbS0yLjE2LjAzL25hc21saWIvYWxsb2MuYy5vcmlnCTIw MjQtMDQtMTcgMTk6MDQ6MDguMDAwMDAwMDAwICswMjAwCisrKysgbmFzbS0yLjE2LjAzL25hc21s aWIvYWxsb2MuYwkyMDI2LTA3LTIyIDEyOjMwOjQzLjE3NzI3ODExMyArMDIwMAorQEAgLTExOCw2 ICsxMTgsMTcgQEAgY2hhciAqbmFzbV9zdHJkdXAoY29uc3QgY2hhciAqcykKKyAgICAgcmV0dXJu IG1lbWNweShwLCBzLCBzaXplKTsKKyB9CisgCisrY2hhciAqbmFzbV9zdHJkdXB0byhjaGFyICoq cHRycCwgY29uc3QgY2hhciAqc3RyKQorK3sKKysgICAgY2hhciAqcHRyID0gKnB0cnA7CisrICAg IGlmIChzdHIpIHsKKysgICAgICAgIGlmIChwdHIpCisrICAgICAgICAgICAgbmFzbV9mcmVlKHB0 cik7CisrICAgICAgICAqcHRycCA9IHB0ciA9IG5hc21fc3RyZHVwKHN0cik7CisrICAgIH0KKysg ICAgcmV0dXJuIHB0cjsKKyt9CisrCisgY2hhciAqbmFzbV9zdHJuZHVwKGNvbnN0IGNoYXIgKnMs IHNpemVfdCBsZW4pCisgeworICAgICBjaGFyICpwOwoKZGlmZiAtLWdpdCBhL25hc20uc3BlYyBi L25hc20uc3BlYwppbmRleCBhNjU4OTZmLi5mMTk3NzJmIDEwMDY0NAotLS0gYS9uYXNtLnNwZWMK KysrIGIvbmFzbS5zcGVjCkBAIC05LDEyICs5LDE1IEBACiBTdW1tYXJ5OiBBIHBvcnRhYmxlIHg4 NiBhc3NlbWJsZXIgd2hpY2ggdXNlcyBJbnRlbC1saWtlIHN5bnRheAogTmFtZTogbmFzbQogVmVy c2lvbjogMi4xNi4wMwotUmVsZWFzZTogNCV7P2Rpc3R9CitSZWxlYXNlOiA1JXs/ZGlzdH0KIExp Y2Vuc2U6IEJTRC0yLUNsYXVzZQogVVJMOiBodHRwOi8vd3d3Lm5hc20udXMKIFNvdXJjZTA6IGh0 dHBzOi8vd3d3Lm5hc20udXMvcHViL25hc20vcmVsZWFzZWJ1aWxkcy8le3ZlcnNpb259LyV7bmFt ZX0tJXt2ZXJzaW9ufS50YXIueHoKIFNvdXJjZTE6IGh0dHBzOi8vd3d3Lm5hc20udXMvcHViL25h c20vcmVsZWFzZWJ1aWxkcy8le3ZlcnNpb259LyV7bmFtZX0tJXt2ZXJzaW9ufS14ZG9jLnRhci54 egotCisjIGh0dHBzOi8vZ2l0aHViLmNvbS9uZXR3aWRlLWFzc2VtYmxlci9uYXNtL2lzc3Vlcy8y MDMKK1BhdGNoMDogbmFzbS1DVkUtMjAyNi02MDY3LnBhdGNoCisjIGh0dHBzOi8vZ2l0aHViLmNv bS9uZXR3aWRlLWFzc2VtYmxlci9uYXNtL2lzc3Vlcy8yMjIKK1BhdGNoMTogbmFzbS1DVkUtMjAy Ni02MDY4LnBhdGNoCiBCdWlsZFJlcXVpcmVzOiBwZXJsKEVudikKIEJ1aWxkUmVxdWlyZXM6IGF1 dG9jb25mCiBCdWlsZFJlcXVpcmVzOiBhdXRvbWFrZQpAQCAtODQsNiArODcsMTEgQEAgbWFrZSAt QyB0ZXN0IGdvbGRlbiB0ZXN0IGRpZmYKICVlbmRpZgogCiAlY2hhbmdlbG9nCisqIFdlZCBKdWwg MjIgMjAyNiBEb21pbmlrIE1pZXJ6ZWpld3NraSA8cnBtQGdyZXlzZWN0b3IubmV0PiAtIDIuMTYu MDMtNQorLSBmaXggQ1ZFLTIwMjYtNjA2NyAocmVzb2x2ZXMgcmhieiMyNDU4MDg3LCByaGJ6IzI0 NTgwODkpCisgIHBhdGNoIGJ5IE5pY2sgQ2xpZnRvbgorLSBiYWNrcG9ydCBmaXggZm9yIENWRS0y MDI2LTYwNjggKHJlc29sdmVzIHJoYnojMjQ1ODA5MCkKKwogKiBUaHUgSnVsIDI0IDIwMjUgRmVk b3JhIFJlbGVhc2UgRW5naW5lZXJpbmcgPHJlbGVuZ0BmZWRvcmFwcm9qZWN0Lm9yZz4gLSAyLjE2 LjAzLTQKIC0gUmVidWlsdCBmb3IgaHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtpL0ZlZG9y YV80M19NYXNzX1JlYnVpbGQKIAo=