[rpms/libical] f45: Resolves: #2540947 (CVE-2026-88383: Denial of Service via crafted iCalendar property parsing)

[Milan Crha <mcrha@redhat.com>]

A new commit has been pushed.

Repo   : rpms/libical
Branch : f45
Commit : ab6b8c8e98ada9cc216a917a304257645fc89d71
Author : Milan Crha <mcrha@redhat.com>
Date   : 2026-09-25T08:44:24+02:00
Stats  : +39/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/libical/c/ab6b8c8e98ada9cc216a917a304257645fc89d71?branch=f45

Log:
Resolves: #2540947 (CVE-2026-88383: Denial of Service via crafted iCalendar property parsing)

---
diff --git a/0001-CVE-2026-88383-bsearch-incompatible-callback-pointer.patch b/0001-CVE-2026-88383-bsearch-incompatible-callback-pointer.patch
new file mode 100644
index 0000000..f079a23
--- /dev/null
+++ b/0001-CVE-2026-88383-bsearch-incompatible-callback-pointer.patch
@@ -0,0 +1,36 @@
+diff -up libical-3.0.20/src/libical/icalderivedparameter.c.in.1 libical-3.0.20/src/libical/icalderivedparameter.c.in
+--- libical-3.0.20/src/libical/icalderivedparameter.c.in.1	2025-03-10 17:08:27.000000000 +0100
++++ libical-3.0.20/src/libical/icalderivedparameter.c.in	2026-09-25 08:27:56.312748400 +0200
+@@ -97,12 +97,20 @@ const char *icalparameter_kind_to_string
+     return 0;
+ }
+ 
++/** DO NOT USE. RETAINED FOR BC. */
+ int icalparameter_compare_kind_map(const struct icalparameter_kind_map *a,
+                                    const struct icalparameter_kind_map *b)
+ {
+     return strcasecmp(a->name, b->name);
+ }
+ 
++static int s_icalparameter_compare_kind_map(const void *a, const void *b)
++{
++    const struct icalparameter_kind_map *amap = (struct icalparameter_kind_map *)a;
++    const struct icalparameter_kind_map *bmap = (struct icalparameter_kind_map *)b;
++    return strcasecmp(amap->name, bmap->name);
++}
++
+ icalparameter_kind icalparameter_string_to_kind(const char *string)
+ {
+     struct icalparameter_kind_map key;
+@@ -115,9 +123,9 @@ icalparameter_kind icalparameter_string_
+     key.kind = ICAL_ANY_PARAMETER;
+     key.name = string;
+     result =
+-        bsearch(&key, parameter_map, sizeof(parameter_map) / sizeof(struct icalparameter_kind_map),
++        (struct icalparameter_kind_map *)bsearch(&key, parameter_map, sizeof(parameter_map) / sizeof(struct icalparameter_kind_map),
+                 sizeof(struct icalparameter_kind_map),
+-                (int (*)(const void *, const void *))icalparameter_compare_kind_map);
++                s_icalparameter_compare_kind_map);
+ 
+     if (result) {
+         return result->kind;

diff --git a/libical.spec b/libical.spec
index ee9cacd..6e5e572 100644
--- a/libical.spec
+++ b/libical.spec
@@ -8,6 +8,9 @@ License:	LGPL-2.1-only OR MPL-2.0
 URL:		https://libical.github.io/libical/
 Source:		https://github.com/%{name}/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 
+# https://github.com/libical/libical/issues/1361
+Patch:          0001-CVE-2026-88383-bsearch-incompatible-callback-pointer.patch
+
 BuildRequires:	gcc
 BuildRequires:	gcc-c++
 BuildRequires:	cmake