[rpms/gnatcoll] f43: Patched GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164.

A new commit has been pushed.

Repo   : rpms/gnatcoll
Branch : f43
Commit : 0a7cde2990bfa5e18a81ab06d997f0c569b2acb1
Author : Björn Persson <Bjorn@Rombobjörn.se>
Date   : 2026-09-09T14:05:00+02:00
Stats  : +230/-1 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/gnatcoll/c/0a7cde2990bfa5e18a81ab06d997f0c569b2acb1?branch=f43

Log:
Patched GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164.

---
diff --git a/GNATCOLL-CORE-0162.patch b/GNATCOLL-CORE-0162.patch
new file mode 100644
index 0000000..641e4ef
--- /dev/null
+++ b/GNATCOLL-CORE-0162.patch
@@ -0,0 +1,53 @@
+--- a/projects/src/gnatcoll-projects.adb
++++ b/projects/src/gnatcoll-projects.adb
+@@ -8206,8 +8194,6 @@ package body GNATCOLL.Projects is
+       Errors          : Error_Report := null)
+       return Boolean
+    is
+-      P       : Package_Id;
+-      Value   : Variable_Value;
+       GNAT_Version : GNAT.Strings.String_Access;
+ 
+       Shared : constant Shared_Project_Tree_Data_Access :=
+@@ -8335,40 +8321,7 @@ package body GNATCOLL.Projects is
+       end Process_Gnatls;
+ 
+    begin
+-      P := Value_Of
+-        (Name_Ide,
+-         In_Packages => Project.Decl.Packages,
+-         Shared      => Shared);
+-      if P = No_Package then
+-         Trace (Me, "No package IDE, no gnatlist attribute");
+-         return Process_Gnatls (Default_Gnatls);
+-      else
+-         --  Do we have a gnatlist attribute ?
+-         Value := Value_Of
+-           (Get_String ("gnatlist"),
+-            Tree.Data.View.Shared.Packages.Table (P).Decl.Attributes, Shared);
+-
+-         if Value = Nil_Variable_Value then
+-            Trace (Me, "No attribute IDE'gnatlist");
+-            return Process_Gnatls (Default_Gnatls);
+-         else
+-            declare
+-               Gnatls : constant String := Get_Name_String (Value.Value);
+-            begin
+-               if Gnatls = "" then
+-                  return Process_Gnatls (Default_Gnatls);
+-               else
+-                  if Runtime /= Unset or else Target /= Unset then
+-                     Trace (Me, "Error, IDE'Gnatlist attribute cannot be set"
+-                        & " when Runtime or Target is also set");
+-                     return Process_Gnatls (Default_Gnatls);
+-                  end if;
+-
+-                  return Process_Gnatls (Gnatls);
+-               end if;
+-            end;
+-         end if;
+-      end if;
++      return Process_Gnatls (Default_Gnatls);
+    end Set_Path_From_Gnatls_Attribute;
+ 
+    ------------------

diff --git a/GNATCOLL-CORE-0164.patch b/GNATCOLL-CORE-0164.patch
new file mode 100644
index 0000000..948ed76
--- /dev/null
+++ b/GNATCOLL-CORE-0164.patch
@@ -0,0 +1,169 @@
+--- a/core/src/gnatcoll-email.adb
++++ b/core/src/gnatcoll-email.adb
+@@ -148,6 +148,27 @@
+       end if;
+    end Identify_Header;
+ 
++   ----------------
++   -- Strip_Forbidden --
++   ----------------
++
++   function Strip_Forbidden (S : String) return String is
++      Result : String (1 .. S'Length);
++      Last   : Natural := 0;
++   begin
++      for J in S'Range loop
++         --  Take only the good characters and put them in Result
++         if S (J) /= ASCII.CR
++           and then S (J) /= ASCII.LF
++           and then S (J) /= ASCII.NUL
++         then
++            Last := Last + 1;
++            Result (Last) := S (J);
++         end if;
++      end loop;
++      return Result (1 .. Last);
++   end Strip_Forbidden;
++
+    -------------------
+    -- Is_Whitespace --
+    -------------------
+@@ -471,7 +492,7 @@
+ 
+    procedure Set_Envelope_From (Msg : in out Message'Class; From : String) is
+    begin
+-      Msg.Contents.Envelope_From := To_Unbounded_String (From);
++      Msg.Contents.Envelope_From := To_Unbounded_String (Strip_Forbidden(From));
+    end Set_Envelope_From;
+ 
+    -----------------------
+@@ -485,7 +506,7 @@
+    is
+    begin
+       Msg.Contents.Envelope_From := To_Unbounded_String
+-        ("From " & Email & " " & Format_Date (Local_Date, From_Line => True));
++        ("From " & Strip_Forbidden(Email) & " " & Format_Date (Local_Date, From_Line => True));
+    end Set_Envelope_From;
+ 
+    -----------------------
+@@ -555,7 +576,7 @@
+    is
+       V : Charset_String_List.List;
+    begin
+-      Decode_Header (Value,
++      Decode_Header (Strip_Forbidden(Value),
+         Default_Charset => Charset,
+         Result          => V,
+         Where           => Identify_Header (Name));
+@@ -586,7 +607,7 @@
+    is
+       L : Charset_String_List.List;
+    begin
+-      Decode_Header (Value,
++      Decode_Header (Strip_Forbidden(Value),
+         Default_Charset => Charset,
+         Result          => L,
+         Where           => Identify_Header (To_String (H.Contents.Name)));
+@@ -672,42 +693,27 @@
+          --  Fold continuation lines
+ 
+          declare
+-            Str    : String := To_String (Encoded);
+-            Last   : Natural;
++            --  Strip CR, LF and NUL as a safety net for content from parsing.
++            Str           : constant String :=
++                              Strip_Forbidden (To_String (Encoded));
+             Index, Index2 : Integer;
+ 
+-            Offset : Integer := 0;
+-            --  Count of LF characters skipped so far
+-
+          begin
+-            --  Flatten the header on a single line, eliminating newline
+-            --  characters.
+-
+-            for J in Str'Range loop
+-               if Str (J) = ASCII.LF then
+-                  Offset := Offset + 1;
+-               elsif Offset > 0 then
+-                  Str (J - Offset) := Str (J);
+-               end if;
+-            end loop;
+-
+-            Last := Str'Last - Offset;
+-
+-            if Show_Header_Name and then Last <= Max then
+-               if Last = 0 then  --  Empty header
++            if Show_Header_Name and then Str'Length <= Max then
++               if Str'Length = 0 then  --  Empty header
+                   Result := To_Unbounded_String (N & ": ");
+-               elsif Element (Encoded, 1) = ' ' then
+-                  Result := To_Unbounded_String (N & ':' & Str (1 .. Last));
++               elsif Str (Str'First) = ' ' then
++                  Result := To_Unbounded_String (N & ':' & Str);
+                else
+-                  Result := To_Unbounded_String (N & ": " & Str (1 .. Last));
++                  Result := To_Unbounded_String (N & ": " & Str);
+                end if;
+                return;
+ 
+-            elsif not Show_Header_Name and then Last <= Max_Line_Len then
+-               if Offset = 0 then
+-                  Result := Encoded;  --  Save a string copy
++            elsif not Show_Header_Name and then Str'Length <= Max_Line_Len then
++               if Str'Length = Length (Encoded) then
++                  Result := Encoded;  --  Save a string copy (nothing stripped)
+                else
+-                  Result := To_Unbounded_String (Str (1 .. Last));
++                  Result := To_Unbounded_String (Str);
+                end if;
+                return;
+             end if;
+@@ -715,15 +721,15 @@
+             Result := Null_Unbounded_String;
+             Index  := Str'First;
+ 
+-            while Index <= Last loop
++            while Index <= Str'Last loop
+                --  Only split on spaces. To keep Content-Type headers as much
+                --  as possible on a single line, we split on the first blank
+                --  space after the theoretical split point.
+ 
+-               Index2 := Integer'Min (Index + Max - 1, Last);
++               Index2 := Integer'Min (Index + Max - 1, Str'Last);
+                loop
+                   Index2 := Index2 + 1;
+-                  exit when Index2 > Last or else Str (Index2) = ' ';
++                  exit when Index2 > Str'Last or else Str (Index2) = ' ';
+                end loop;
+ 
+                --  Index2 points right after last non-blank character
+@@ -733,7 +739,7 @@
+                --  Do not print a last line containing only white spaces, this
+                --  might confuse mailers.
+ 
+-               if Index2 < Last then
++               if Index2 < Str'Last then
+                   Append (Result, ASCII.LF & ' ');
+                end if;
+ 
+@@ -1902,7 +1908,7 @@
+    is
+       C : Charset_String_List.Cursor := First (H.Contents.Value);
+       Semicolon, Name_Start, Name_End, Val_End : Integer;
+-      Str : constant String := "; " & Param_Name & "=""" & Param_Value & '"';
++      Str : constant String := "; " & Param_Name & "=""" & Strip_Forbidden(Param_Value) & '"';
+    begin
+       Get_Param_Index
+         (H, Param_Name, C, Semicolon, Name_Start, Name_End, Val_End);
+--- a/core/src/gnatcoll-email-parser.adb
++++ b/core/src/gnatcoll-email-parser.adb
+@@ -166,7 +166,7 @@
+         and then Str (Index .. Index + 4) = "From "
+       then
+          Eol := Next_Occurrence (Str (Index .. Stop), ASCII.LF);
+-         Set_Envelope_From (Msg, Str (Index .. Eol - 1));
++         Set_Envelope_From (Msg, RTrim_CR (Str (Index .. Eol - 1)));
+          Index := Eol + 1;
+       end if;
+ 

diff --git a/gnatcoll.spec b/gnatcoll.spec
index 0425be7..63fef93 100644
--- a/gnatcoll.spec
+++ b/gnatcoll.spec
@@ -7,7 +7,7 @@
 Name:           gnatcoll
 Epoch:          2
 Version:        %{upstream_version}
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        The GNAT Components Collection
 Summary(sv):    GNAT Components Collection
 
@@ -31,6 +31,9 @@ Patch:          %{name}-core-doc-examples-dir.patch
 Patch:          %{name}-core-refine-dependencies-gnatcoll.patch
 # [GCC 14.2.1] Fix unsupported use of the Access attribute.
 Patch:          %{name}-core-fix-base64-coder-example.patch
+# security patches, backported and modified to avoid interface changes:
+Patch:          GNATCOLL-CORE-0162.patch
+Patch:          GNATCOLL-CORE-0164.patch
 
 BuildRequires:  gcc-gnat gprbuild make sed
 # A fedora-gnat-project-common that contains the new GPRinstall macro.
@@ -422,6 +425,10 @@ done
 ###############
 
 %changelog
+* Wed Sep 09 2026 Björn Persson <Bjorn@Rombobjörn.se> - 2:25.0.0-6
+- Patched the vulnerabilities GNATCOLL-CORE-0162 and GNATCOLL-CORE-0164 in a way
+  that avoids interface changes.
+
 * Sun Aug 10 2025 Björn Persson <Bjorn@Rombobjörn.se> - 2:25.0.0-5
 - Rebuilt because the ALI of System.OS_Constants changed.