From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Milan Crha To: git-commits@fedoraproject.org Subject: [rpms/libical] rawhide: Resolves: #2540947 (CVE-2026-88383: Denial of Service via crafted iCalendar property parsing) Date: Fri, 25 Sep 2026 06:43:54 GMT Message-ID: <179031863473.1.14714809417664197179.rpms-libical-d3983e28fe2c@fedoraproject.org> List-ID: X-Git-Repo: rpms/libical X-Git-Branch: rawhide X-Git-Rev: d3983e28fe2c2c9fec7dd7f15becf283dab03893 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbGliaWNhbApCcmFu Y2ggOiByYXdoaWRlCkNvbW1pdCA6IGQzOTgzZTI4ZmUyYzJjOWZlYzdkZDdmMTViZWNmMjgzZGFi MDM4OTMKQXV0aG9yIDogTWlsYW4gQ3JoYSA8bWNyaGFAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAy Ni0wOS0yNVQwODo0MTo0MCswMjowMApTdGF0cyAgOiArMzkvLTAgaW4gMiBmaWxlKHMpClVSTCAg ICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvbGliaWNhbC9jL2QzOTgzZTI4 ZmUyYzJjOWZlYzdkZDdmMTViZWNmMjgzZGFiMDM4OTM/YnJhbmNoPXJhd2hpZGUKCkxvZzoKUmVz b2x2ZXM6ICMyNTQwOTQ3IChDVkUtMjAyNi04ODM4MzogRGVuaWFsIG9mIFNlcnZpY2UgdmlhIGNy YWZ0ZWQgaUNhbGVuZGFyIHByb3BlcnR5IHBhcnNpbmcpCgotLS0KZGlmZiAtLWdpdCBhLzAwMDEt Q1ZFLTIwMjYtODgzODMtYnNlYXJjaC1pbmNvbXBhdGlibGUtY2FsbGJhY2stcG9pbnRlci5wYXRj aCBiLzAwMDEtQ1ZFLTIwMjYtODgzODMtYnNlYXJjaC1pbmNvbXBhdGlibGUtY2FsbGJhY2stcG9p bnRlci5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5mMDc5YTIzCi0t LSAvZGV2L251bGwKKysrIGIvMDAwMS1DVkUtMjAyNi04ODM4My1ic2VhcmNoLWluY29tcGF0aWJs ZS1jYWxsYmFjay1wb2ludGVyLnBhdGNoCkBAIC0wLDAgKzEsMzYgQEAKK2RpZmYgLXVwIGxpYmlj YWwtMy4wLjIwL3NyYy9saWJpY2FsL2ljYWxkZXJpdmVkcGFyYW1ldGVyLmMuaW4uMSBsaWJpY2Fs LTMuMC4yMC9zcmMvbGliaWNhbC9pY2FsZGVyaXZlZHBhcmFtZXRlci5jLmluCistLS0gbGliaWNh bC0zLjAuMjAvc3JjL2xpYmljYWwvaWNhbGRlcml2ZWRwYXJhbWV0ZXIuYy5pbi4xCTIwMjUtMDMt MTAgMTc6MDg6MjcuMDAwMDAwMDAwICswMTAwCisrKysgbGliaWNhbC0zLjAuMjAvc3JjL2xpYmlj YWwvaWNhbGRlcml2ZWRwYXJhbWV0ZXIuYy5pbgkyMDI2LTA5LTI1IDA4OjI3OjU2LjMxMjc0ODQw MCArMDIwMAorQEAgLTk3LDEyICs5NywyMCBAQCBjb25zdCBjaGFyICppY2FscGFyYW1ldGVyX2tp bmRfdG9fc3RyaW5nCisgICAgIHJldHVybiAwOworIH0KKyAKKysvKiogRE8gTk9UIFVTRS4gUkVU QUlORUQgRk9SIEJDLiAqLworIGludCBpY2FscGFyYW1ldGVyX2NvbXBhcmVfa2luZF9tYXAoY29u c3Qgc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXAgKmEsCisgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBjb25zdCBzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9raW5kX21hcCAqYikK KyB7CisgICAgIHJldHVybiBzdHJjYXNlY21wKGEtPm5hbWUsIGItPm5hbWUpOworIH0KKyAKKytz dGF0aWMgaW50IHNfaWNhbHBhcmFtZXRlcl9jb21wYXJlX2tpbmRfbWFwKGNvbnN0IHZvaWQgKmEs IGNvbnN0IHZvaWQgKmIpCisreworKyAgICBjb25zdCBzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9raW5k X21hcCAqYW1hcCA9IChzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9raW5kX21hcCAqKWE7CisrICAgIGNv bnN0IHN0cnVjdCBpY2FscGFyYW1ldGVyX2tpbmRfbWFwICpibWFwID0gKHN0cnVjdCBpY2FscGFy YW1ldGVyX2tpbmRfbWFwICopYjsKKysgICAgcmV0dXJuIHN0cmNhc2VjbXAoYW1hcC0+bmFtZSwg Ym1hcC0+bmFtZSk7CisrfQorKworIGljYWxwYXJhbWV0ZXJfa2luZCBpY2FscGFyYW1ldGVyX3N0 cmluZ190b19raW5kKGNvbnN0IGNoYXIgKnN0cmluZykKKyB7CisgICAgIHN0cnVjdCBpY2FscGFy YW1ldGVyX2tpbmRfbWFwIGtleTsKK0BAIC0xMTUsOSArMTIzLDkgQEAgaWNhbHBhcmFtZXRlcl9r aW5kIGljYWxwYXJhbWV0ZXJfc3RyaW5nXworICAgICBrZXkua2luZCA9IElDQUxfQU5ZX1BBUkFN RVRFUjsKKyAgICAga2V5Lm5hbWUgPSBzdHJpbmc7CisgICAgIHJlc3VsdCA9CistICAgICAgICBi c2VhcmNoKCZrZXksIHBhcmFtZXRlcl9tYXAsIHNpemVvZihwYXJhbWV0ZXJfbWFwKSAvIHNpemVv ZihzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9raW5kX21hcCksCisrICAgICAgICAoc3RydWN0IGljYWxw YXJhbWV0ZXJfa2luZF9tYXAgKilic2VhcmNoKCZrZXksIHBhcmFtZXRlcl9tYXAsIHNpemVvZihw YXJhbWV0ZXJfbWFwKSAvIHNpemVvZihzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9raW5kX21hcCksCisg ICAgICAgICAgICAgICAgIHNpemVvZihzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9raW5kX21hcCksCist ICAgICAgICAgICAgICAgIChpbnQgKCopKGNvbnN0IHZvaWQgKiwgY29uc3Qgdm9pZCAqKSlpY2Fs cGFyYW1ldGVyX2NvbXBhcmVfa2luZF9tYXApOworKyAgICAgICAgICAgICAgICBzX2ljYWxwYXJh bWV0ZXJfY29tcGFyZV9raW5kX21hcCk7CisgCisgICAgIGlmIChyZXN1bHQpIHsKKyAgICAgICAg IHJldHVybiByZXN1bHQtPmtpbmQ7CgpkaWZmIC0tZ2l0IGEvbGliaWNhbC5zcGVjIGIvbGliaWNh bC5zcGVjCmluZGV4IGVlOWNhY2QuLjZlNWU1NzIgMTAwNjQ0Ci0tLSBhL2xpYmljYWwuc3BlYwor KysgYi9saWJpY2FsLnNwZWMKQEAgLTgsNiArOCw5IEBAIExpY2Vuc2U6CUxHUEwtMi4xLW9ubHkg T1IgTVBMLTIuMAogVVJMOgkJaHR0cHM6Ly9saWJpY2FsLmdpdGh1Yi5pby9saWJpY2FsLwogU291 cmNlOgkJaHR0cHM6Ly9naXRodWIuY29tLyV7bmFtZX0vJXtuYW1lfS9hcmNoaXZlL3Yle3ZlcnNp b259LyV7bmFtZX0tJXt2ZXJzaW9ufS50YXIuZ3oKIAorIyBodHRwczovL2dpdGh1Yi5jb20vbGli aWNhbC9saWJpY2FsL2lzc3Vlcy8xMzYxCitQYXRjaDogICAgICAgICAgMDAwMS1DVkUtMjAyNi04 ODM4My1ic2VhcmNoLWluY29tcGF0aWJsZS1jYWxsYmFjay1wb2ludGVyLnBhdGNoCisKIEJ1aWxk UmVxdWlyZXM6CWdjYwogQnVpbGRSZXF1aXJlczoJZ2NjLWMrKwogQnVpbGRSZXF1aXJlczoJY21h a2UK