From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Benjamin A. Beasley To: git-commits@fedoraproject.org Subject: [rpms/stb] f44: Patch stb_sprintf: security fix for CVE-2026-79516 Date: Thu, 10 Sep 2026 09:26:59 GMT Message-ID: <178903241950.1.759981198858959724.rpms-stb-d6aead5f22e6@fedoraproject.org> List-ID: X-Git-Repo: rpms/stb X-Git-Branch: f44 X-Git-Rev: d6aead5f22e6f229075e9ba720c28601b9b28408 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvc3RiCiAgICAgICAgICAgIEJyYW5jaCA6IGY0NAogICAgICAgICAgICBDb21t aXQgOiBkNmFlYWQ1ZjIyZTZmMjI5MDc1ZTliYTcyMGMyODYwMWI5YjI4NDA4CiAgICAgICAgICAg IEF1dGhvciA6IEJlbmphbWluIEEuIEJlYXNsZXkgPGNvZGVAbXVzaWNpbm15YnJhaW4ubmV0Pgog ICAgICAgICAgICBEYXRlICAgOiAyMDI2LTA5LTEwVDEwOjA4OjQyKzAxOjAwCiAgICAgICAgICAg IFN0YXRzICA6ICs1MS8tMCBpbiAyIGZpbGUocykKICAgICAgICAgICAgVVJMICAgIDogaHR0cHM6 Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9zdGIvYy9kNmFlYWQ1ZjIyZTZmMjI5MDc1ZTli YTcyMGMyODYwMWI5YjI4NDA4P2JyYW5jaD1mNDQKCiAgICAgICAgICAgIExvZzoKICAgICAgICAg ICAgUGF0Y2ggc3RiX3NwcmludGY6IHNlY3VyaXR5IGZpeCBmb3IgQ1ZFLTIwMjYtNzk1MTYKCi0g Rml4ZXMgUkhCWiMyNTMxMjkxOyBGaXhlcyBSSEJaIzI1MzEyOTAKCi0tLQpkaWZmIC0tZ2l0IGEv MTk5NS5wYXRjaCBiLzE5OTUucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAw MC4uMWUyNzljZAotLS0gL2Rldi9udWxsCisrKyBiLzE5OTUucGF0Y2gKQEAgLTAsMCArMSwzOSBA QAorRnJvbSAxZmQ3ZmY5ZmRiOTdmMzAxMjY0MjI2MzAyYTRkNzBiMTA3NGE2YjY2IE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQorRnJvbTogQnJhbmRvbiBCYXJyYW50ZSA8YWV0aGVyYWlAYWV0aGVy c3lzdGVtcy5uZXQ+CitEYXRlOiBTdW4sIDYgU2VwIDIwMjYgMTk6MDQ6MzkgLTA0MDAKK1N1Ympl Y3Q6IFtQQVRDSF0gc3RiX3NwcmludGY6IGRvbid0IHdyaXRlIGJ1ZlstMV0gb24gc25wcmludGYo YnVmLCAwLCAuLi4pCisgKGZpeGVzICMxOTYzKQorCitUaGUgdG9wIGdhdGUgaW4gU1RCX1NQUklO VEZfREVDT1JBVEUodnNucHJpbnRmKSBvbmx5IGVudGVyZWQgdGhlIGNvdW50LW9ubHkgcGF0aCB3 aGVuIGJvdGggY291bnQgPT0gMCBBTkQgYnVmIHdhcyBOVUxMLiBBIGNhbGxlciBwYXNzaW5nIGEg dmFsaWQgYnVmZmVyIHdpdGggY291bnQgPT0gMCAodGhlIHNoYXBlIGNhbGxlcnMgdXNlIHRvIGFz ayAnaG93IGJpZyB3b3VsZCB0aGlzIGJlPycpIGZlbGwgdGhyb3VnaCB0byB0aGUgZWxzZSBicmFu Y2gsIGNvbXB1dGVkIGwgPSAoaW50KShjLmJ1ZiAtIGJ1ZikgPSAwLCBoaXQgdGhlIGwgPj0gY291 bnQgY2xhbXAsIGRyb3BwZWQgdG8gbCA9IGNvdW50IC0gMSA9IC0xLCBhbmQgZXhlY3V0ZWQgYnVm Wy0xXSA9IDAgLS0gb25lIGJ5dGUgb3V0LW9mLWJvdW5kcyBiZWZvcmUgdGhlIGNhbGxlcidzIGJ1 ZmZlci4KKworVGhlIEMgc3RhbmRhcmQgaXMgZXhwbGljaXQgdGhhdCBzbnByaW50ZihidWYsIDAs IC4uLikgbXVzdCBub3Qgd3JpdGUuIGdsaWJjLCBtdXNsIGFuZCB0aGUgQlNEIHNucHJpbnRmIGFs bCBza2lwIHRoZSBudWxsIHRlcm1pbmF0b3Igd2hlbiBjb3VudCA9PSAwLgorCitFeHRlbmQgdGhl IGdhdGUgdG8gY291bnQgPD0gMCBzbyB0aGUgY291bnQtb25seSBwYXRoIGhhbmRsZXMgYm90aCB0 aGUgbnVsbC1idWYgYW5kIHRoZSBub24tbnVsbC1idWYgY2FzZXMgdGhlIHNhbWUgd2F5LiBUaGUg Y291bnQtb25seSBwYXRoIHVzZXMgc3Ric3BfX2NvdW50X2NsYW1wX2NhbGxiYWNrIHdoaWNoIG9u bHkgYWNjdW11bGF0ZXMgbGVuZ3RoIGFuZCBuZXZlciBkZXJlZmVyZW5jZXMgYnVmLCBzbyBpdCdz IHNhZmUgd2l0aCBidWYgPT0gTlVMTC4gQmVoYXZpb3IgZm9yIGNvdW50ID4gMCBpcyB1bmNoYW5n ZWQuCisKK1ZlcmlmaWVkIHVuZGVyIEFTYW4vVUJTYW4gb24gbWFzdGVyIDJjOTgwYmI1OiBzdGFj ayBsYXlvdXQgcHV0cyBwYWRfYWZ0ZXIgaW1tZWRpYXRlbHkgYmVmb3JlIGJ1ZjsgYmVmb3JlIHRo ZSBmaXgsIHNucHJpbnRmKGJ1ZiwgMCwgLi4uKSBzZXRzIHBhZF9hZnRlclsxNV0gdG8gMHgwMDsg YWZ0ZXIgdGhlIGZpeCBpdCBzdGF5cyBhcyAnQicuIFBvc2l0aXZlIGNvbnRyb2xzIChub3JtYWwg c25wcmludGYsIHRydW5jYXRpb24sIGNvdW50PTEsIGNvdW50PTAtd2l0aC1udWxsLWJ1ZikgYWxs IHN0aWxsIHBhc3MuCisKK0ZpeGVzOiAjMTk2MworUmVwb3J0ZWQtYnk6IEplcnJ5R1cgKGdpdGh1 Yi5jb20vSmVycnlHVykKK1NpZ25lZC1vZmYtYnk6IEJyYW5kb24gQmFycmFudGUgPGFldGhlcmFp QGFldGhlcnN5c3RlbXMubmV0PgorLS0tCisgc3RiX3NwcmludGYuaCB8IDYgKysrKystCisgMSBm aWxlIGNoYW5nZWQsIDUgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQorCitkaWZmIC0tZ2l0 IGEvc3RiX3NwcmludGYuaCBiL3N0Yl9zcHJpbnRmLmgKK2luZGV4IGNhNDMyYTZiY2EuLjY2MjVk NmVlZDAgMTAwNjQ0CistLS0gYS9zdGJfc3ByaW50Zi5oCisrKysgYi9zdGJfc3ByaW50Zi5oCitA QCAtMTQzMSw4ICsxNDMxLDEyIEBAIFNUQlNQX19QVUJMSUNERUYgaW50IFNUQl9TUFJJTlRGX0RF Q09SQVRFKCB2c25wcmludGYgKSggY2hhciAqIGJ1ZiwgaW50IGNvdW50LCBjCisgeworICAgIHN0 YnNwX19jb250ZXh0IGM7CisgCistICAgaWYgKCAoY291bnQgPT0gMCkgJiYgIWJ1ZiApCisrICAg aWYgKCBjb3VudCA8PSAwICkKKyAgICB7CisrICAgICAgLy8gQyBzdGFuZGFyZDogc25wcmludGYo YnVmLCAwLCAuLi4pIHdyaXRlcyBub3RoaW5nLCByZXR1cm5zIHRoZSBjb3VudAorKyAgICAgIC8v IHRoZSBmdWxsIG91dHB1dCB3b3VsZCBoYXZlIHRha2VuLiBIYW5kbGUgdGhpcyB3aGV0aGVyIG9y IG5vdCB0aGUKKysgICAgICAvLyBjYWxsZXIgcGFzc2VkIGEgdmFsaWQgYnVmZmVyIC0tIHdyaXRp bmcgYnVmW2NvdW50IC0gMV0gd2l0aCBjb3VudCA9PSAwCisrICAgICAgLy8gaXMgYW4gb3V0LW9m LWJvdW5kcyB3cml0ZSBiZWZvcmUgdGhlIGNhbGxlcidzIGJ1ZmZlci4KKyAgICAgICBjLmxlbmd0 aCA9IDA7CisgCisgICAgICAgU1RCX1NQUklOVEZfREVDT1JBVEUoIHZzcHJpbnRmY2IgKSggc3Ri c3BfX2NvdW50X2NsYW1wX2NhbGxiYWNrLCAmYywgYy50bXAsIGZtdCwgdmEgKTsKCmRpZmYgLS1n aXQgYS9zdGIuc3BlYyBiL3N0Yi5zcGVjCmluZGV4IDZiMzhmNGMuLjI2OWU3NDcgMTAwNjQ0Ci0t LSBhL3N0Yi5zcGVjCisrKyBiL3N0Yi5zcGVjCkBAIC0yMjYsNiArMjI2LDE4IEBAIFBhdGNoOiAg ICAgICAgICAle3VybH0vcHVsbC8xODYzLnBhdGNoCiAjIGh0dHBzOi8vZ2l0aHViLmNvbS9ub3Ro aW5ncy9zdGIvaXNzdWVzLzE5MjkKIFBhdGNoOiAgICAgICAgICBpc3N1ZS0xOTI5LnBhdGNoCiAK KyMgc3RiX3NwcmludGY6IGRvbid0IHdyaXRlIGJ1ZlstMV0gb24gc25wcmludGYoYnVmLCAwLCAu Li4pIChmaXhlcyAjMTk2MykKKyMgaHR0cHM6Ly9naXRodWIuY29tL25vdGhpbmdzL3N0Yi9wdWxs LzE5OTUKKyMKKyMgRml4ZXMgQ1ZFLTIwMjYtNzk1MTY6CisjCisjIFtTRUNVUklUWV0gc3Ric3Bf c25wcmludGYgd2l0aCBjb3VudD0wIHdyaXRlcyBudWxsIHRlcm1pbmF0b3IgYmVmb3JlIGJ1ZmZl cgorIyBodHRwczovL2dpdGh1Yi5jb20vbm90aGluZ3Mvc3RiL2lzc3Vlcy8xOTYzCisjCisjIFBh dGNoIHJlamVjdGVkIHVwc3RyZWFtIHdpdGhvdXQgY29tbWVudCwgcHJlc3VtYWJseSBiZWNhdXNl IHRoZSBQUiB3YXMKKyMgZHJhZnRlZCB3aXRoIEFJL0xMTSBhc3Npc3RhbmNlLgorUGF0Y2g6ICAg ICAgICAgICV7dXJsfS9wdWxsLzE5OTUucGF0Y2gKKwogJWdsb2JhbCBzdGJfY19sZXhlcl92ZXJz aW9uIDAuMTIKICVnbG9iYWwgc3RiX2Nvbm5lY3RlZF9jb21wb25lbnRzX3ZlcnNpb24gMC45Ngog JWdsb2JhbCBzdGJfZGl2aWRlX3ZlcnNpb24gMC45NAo=