[rpms/libgsasl] f43: Fix CVE-2026-48829

[rpms/libgsasl] f43: Fix CVE-2026-48829

[Peter Lemenkov]

            A new commit has been pushed.

            Repo   : rpms/libgsasl
            Branch : f43
            Commit : 957322061f857452d462c3711d719b6f8d79d1a8
            Author : Peter Lemenkov <lemenkov@gmail.com>
            Date   : 2026-08-07T12:57:29+02:00
            Stats  : +48/-28 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/libgsasl/c/957322061f857452d462c3711d719b6f8d79d1a8?branch=f43

            Log:
            Fix CVE-2026-48829

Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>

---
diff --git a/0001-GSSAPI-server-Boundary-check-gss_wrap-token-read-OOB.patch b/0001-GSSAPI-server-Boundary-check-gss_wrap-token-read-OOB.patch
new file mode 100644
index 0000000..859cf56
--- /dev/null
+++ b/0001-GSSAPI-server-Boundary-check-gss_wrap-token-read-OOB.patch
@@ -0,0 +1,20 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Simon Josefsson <simon@josefsson.org>
+Date: Fri, 15 Jul 2022 16:23:58 +0200
+Subject: [PATCH] GSSAPI server: Boundary check gss_wrap token (read OOB).
+
+
+diff --git a/lib/gssapi/server.c b/lib/gssapi/server.c
+index 4a5dfd7b..a93e454a 100644
+--- a/lib/gssapi/server.c
++++ b/lib/gssapi/server.c
+@@ -225,6 +225,9 @@ _gsasl_gssapi_server_step (Gsasl_session * sctx,
+          FALSE, and responds with the generated output_message.  The
+          client can then consider the server authenticated. */
+ 
++      if (bufdesc2.length < 4)
++	return GSASL_AUTHENTICATION_ERROR;
++
+       if ((((char *) bufdesc2.value)[0] & GSASL_QOP_AUTH) == 0)
+ 	{
+ 	  /* Integrity or privacy unsupported */

diff --git a/0001-fix-gssapi-server-oob.patch b/0001-fix-gssapi-server-oob.patch
deleted file mode 100644
index 850f392..0000000
--- a/0001-fix-gssapi-server-oob.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Simon Josefsson <simon@josefsson.org>
-Date: Fri, 15 Jul 2022 16:23:58 +0200
-Subject: [PATCH] GSSAPI server: Boundary check gss_wrap token (read OOB).
-Origin: upstream, https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d7576371232330bcc30
-
----
- lib/gssapi/server.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/lib/gssapi/server.c b/lib/gssapi/server.c
-index 5410360b..4ebfda47 100644
---- a/lib/gssapi/server.c
-+++ b/lib/gssapi/server.c
-@@ -218,6 +218,9 @@ _gsasl_gssapi_server_step (Gsasl_session * sctx,
-          FALSE, and responds with the generated output_message.  The
-          client can then consider the server authenticated. */
- 
-+      if (bufdesc2.length < 4)
-+	return GSASL_AUTHENTICATION_ERROR;
-+
-       if ((((char *) bufdesc2.value)[0] & GSASL_QOP_AUTH) == 0)
- 	{
- 	  /* Integrity or privacy unsupported */
--- 
-2.30.2
-

diff --git a/0002-Fix-NULL-pointer-dereference-in-DIGEST-MD5-parser.patch b/0002-Fix-NULL-pointer-dereference-in-DIGEST-MD5-parser.patch
new file mode 100644
index 0000000..a9edd66
--- /dev/null
+++ b/0002-Fix-NULL-pointer-dereference-in-DIGEST-MD5-parser.patch
@@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: zhangph <zhangph12138@163.com>
+Date: Wed, 13 May 2026 09:20:31 +0200
+Subject: [PATCH] Fix NULL pointer dereference in DIGEST-MD5 parser
+
+https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html
+
+Signed-off-by: Simon Josefsson <simon@josefsson.org>
+
+diff --git a/lib/digest-md5/getsubopt.c b/lib/digest-md5/getsubopt.c
+index 1a67ec8b..b1a4ce35 100644
+--- a/lib/digest-md5/getsubopt.c
++++ b/lib/digest-md5/getsubopt.c
+@@ -74,7 +74,7 @@ digest_md5_getsubopt (char **optionp,
+ 	&& tokens[cnt][vstart - *optionp] == '\0')
+       {
+ 	/* We found the current option in TOKENS.  */
+-	*valuep = vstart != endp ? vstart + 1 : NULL;
++	*valuep = vstart != endp ? vstart + 1 : (char *) "";
+ 
+ 	while (*valuep && (**valuep == ' ' ||
+ 			   **valuep == '\t' ||

diff --git a/libgsasl.spec b/libgsasl.spec
index d74c38e..2039b54 100644
--- a/libgsasl.spec
+++ b/libgsasl.spec
@@ -1,13 +1,14 @@
 Name:           libgsasl
 Version:        1.10.0
-Release:        16%{?dist}
+Release:        17%{?dist}
 Summary:        GNU SASL library
 License:        LGPL-2.1-or-later
 URL:            https://www.gnu.org/software/gsasl/
 Source0:        https://ftp.gnu.org/gnu/gsasl/%{name}-%{version}.tar.gz
 Source1:        https://ftp.gnu.org/gnu/gsasl/%{name}-%{version}.tar.gz.sig
 Source2:        https://josefsson.org/54265e8c.txt
-Patch:          0001-fix-gssapi-server-oob.patch
+Patch:          0001-GSSAPI-server-Boundary-check-gss_wrap-token-read-OOB.patch
+Patch:          0002-Fix-NULL-pointer-dereference-in-DIGEST-MD5-parser.patch
 BuildRequires:  gcc
 # for %%gpgverify
 BuildRequires:  gnupg2
@@ -60,6 +61,9 @@ find %{buildroot} -name '*.la' -exec rm -f {} ';'
 %{_libdir}/pkgconfig/libgsasl.pc
 
 %changelog
+* Fri Aug  7 2026 Peter Lemenkov <lemenkov@gmail.com> - 1.10.0-17
+- Fix CVE-2026-48829
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.0-16
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild