From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Milan Crha To: git-commits@fedoraproject.org Subject: [rpms/libical] f44: Resolves: #2540947 (CVE-2026-88383: Denial of Service via crafted iCalendar property parsing) Date: Fri, 25 Sep 2026 06:46:11 GMT Message-ID: <179031877107.1.17958549195651730967.rpms-libical-ba53b572605c@fedoraproject.org> List-ID: X-Git-Repo: rpms/libical X-Git-Branch: f44 X-Git-Rev: ba53b572605c0e9b82c0c7585f9d2caa36b372c4 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbGliaWNhbApCcmFu Y2ggOiBmNDQKQ29tbWl0IDogYmE1M2I1NzI2MDVjMGU5YjgyYzBjNzU4NWY5ZDJjYWEzNmIzNzJj NApBdXRob3IgOiBNaWxhbiBDcmhhIDxtY3JoYUByZWRoYXQuY29tPgpEYXRlICAgOiAyMDI2LTA5 LTI1VDA4OjQ1OjMxKzAyOjAwClN0YXRzICA6ICszOS8tMCBpbiAyIGZpbGUocykKVVJMICAgIDog aHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9saWJpY2FsL2MvYmE1M2I1NzI2MDVj MGU5YjgyYzBjNzU4NWY5ZDJjYWEzNmIzNzJjND9icmFuY2g9ZjQ0CgpMb2c6ClJlc29sdmVzOiAj MjU0MDk0NyAoQ1ZFLTIwMjYtODgzODM6IERlbmlhbCBvZiBTZXJ2aWNlIHZpYSBjcmFmdGVkIGlD YWxlbmRhciBwcm9wZXJ0eSBwYXJzaW5nKQoKLS0tCmRpZmYgLS1naXQgYS8wMDAxLUNWRS0yMDI2 LTg4MzgzLWJzZWFyY2gtaW5jb21wYXRpYmxlLWNhbGxiYWNrLXBvaW50ZXIucGF0Y2ggYi8wMDAx LUNWRS0yMDI2LTg4MzgzLWJzZWFyY2gtaW5jb21wYXRpYmxlLWNhbGxiYWNrLXBvaW50ZXIucGF0 Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uZjA3OWEyMwotLS0gL2Rldi9u dWxsCisrKyBiLzAwMDEtQ1ZFLTIwMjYtODgzODMtYnNlYXJjaC1pbmNvbXBhdGlibGUtY2FsbGJh Y2stcG9pbnRlci5wYXRjaApAQCAtMCwwICsxLDM2IEBACitkaWZmIC11cCBsaWJpY2FsLTMuMC4y MC9zcmMvbGliaWNhbC9pY2FsZGVyaXZlZHBhcmFtZXRlci5jLmluLjEgbGliaWNhbC0zLjAuMjAv c3JjL2xpYmljYWwvaWNhbGRlcml2ZWRwYXJhbWV0ZXIuYy5pbgorLS0tIGxpYmljYWwtMy4wLjIw L3NyYy9saWJpY2FsL2ljYWxkZXJpdmVkcGFyYW1ldGVyLmMuaW4uMQkyMDI1LTAzLTEwIDE3OjA4 OjI3LjAwMDAwMDAwMCArMDEwMAorKysrIGxpYmljYWwtMy4wLjIwL3NyYy9saWJpY2FsL2ljYWxk ZXJpdmVkcGFyYW1ldGVyLmMuaW4JMjAyNi0wOS0yNSAwODoyNzo1Ni4zMTI3NDg0MDAgKzAyMDAK K0BAIC05NywxMiArOTcsMjAgQEAgY29uc3QgY2hhciAqaWNhbHBhcmFtZXRlcl9raW5kX3RvX3N0 cmluZworICAgICByZXR1cm4gMDsKKyB9CisgCisrLyoqIERPIE5PVCBVU0UuIFJFVEFJTkVEIEZP UiBCQy4gKi8KKyBpbnQgaWNhbHBhcmFtZXRlcl9jb21wYXJlX2tpbmRfbWFwKGNvbnN0IHN0cnVj dCBpY2FscGFyYW1ldGVyX2tpbmRfbWFwICphLAorICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgY29uc3Qgc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXAgKmIpCisgeworICAg ICByZXR1cm4gc3RyY2FzZWNtcChhLT5uYW1lLCBiLT5uYW1lKTsKKyB9CisgCisrc3RhdGljIGlu dCBzX2ljYWxwYXJhbWV0ZXJfY29tcGFyZV9raW5kX21hcChjb25zdCB2b2lkICphLCBjb25zdCB2 b2lkICpiKQorK3sKKysgICAgY29uc3Qgc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXAgKmFt YXAgPSAoc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXAgKilhOworKyAgICBjb25zdCBzdHJ1 Y3QgaWNhbHBhcmFtZXRlcl9raW5kX21hcCAqYm1hcCA9IChzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9r aW5kX21hcCAqKWI7CisrICAgIHJldHVybiBzdHJjYXNlY21wKGFtYXAtPm5hbWUsIGJtYXAtPm5h bWUpOworK30KKysKKyBpY2FscGFyYW1ldGVyX2tpbmQgaWNhbHBhcmFtZXRlcl9zdHJpbmdfdG9f a2luZChjb25zdCBjaGFyICpzdHJpbmcpCisgeworICAgICBzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9r aW5kX21hcCBrZXk7CitAQCAtMTE1LDkgKzEyMyw5IEBAIGljYWxwYXJhbWV0ZXJfa2luZCBpY2Fs cGFyYW1ldGVyX3N0cmluZ18KKyAgICAga2V5LmtpbmQgPSBJQ0FMX0FOWV9QQVJBTUVURVI7Cisg ICAgIGtleS5uYW1lID0gc3RyaW5nOworICAgICByZXN1bHQgPQorLSAgICAgICAgYnNlYXJjaCgm a2V5LCBwYXJhbWV0ZXJfbWFwLCBzaXplb2YocGFyYW1ldGVyX21hcCkgLyBzaXplb2Yoc3RydWN0 IGljYWxwYXJhbWV0ZXJfa2luZF9tYXApLAorKyAgICAgICAgKHN0cnVjdCBpY2FscGFyYW1ldGVy X2tpbmRfbWFwICopYnNlYXJjaCgma2V5LCBwYXJhbWV0ZXJfbWFwLCBzaXplb2YocGFyYW1ldGVy X21hcCkgLyBzaXplb2Yoc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXApLAorICAgICAgICAg ICAgICAgICBzaXplb2Yoc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXApLAorLSAgICAgICAg ICAgICAgICAoaW50ICgqKShjb25zdCB2b2lkICosIGNvbnN0IHZvaWQgKikpaWNhbHBhcmFtZXRl cl9jb21wYXJlX2tpbmRfbWFwKTsKKysgICAgICAgICAgICAgICAgc19pY2FscGFyYW1ldGVyX2Nv bXBhcmVfa2luZF9tYXApOworIAorICAgICBpZiAocmVzdWx0KSB7CisgICAgICAgICByZXR1cm4g cmVzdWx0LT5raW5kOwoKZGlmZiAtLWdpdCBhL2xpYmljYWwuc3BlYyBiL2xpYmljYWwuc3BlYwpp bmRleCBlZTljYWNkLi42ZTVlNTcyIDEwMDY0NAotLS0gYS9saWJpY2FsLnNwZWMKKysrIGIvbGli aWNhbC5zcGVjCkBAIC04LDYgKzgsOSBAQCBMaWNlbnNlOglMR1BMLTIuMS1vbmx5IE9SIE1QTC0y LjAKIFVSTDoJCWh0dHBzOi8vbGliaWNhbC5naXRodWIuaW8vbGliaWNhbC8KIFNvdXJjZToJCWh0 dHBzOi8vZ2l0aHViLmNvbS8le25hbWV9LyV7bmFtZX0vYXJjaGl2ZS92JXt2ZXJzaW9ufS8le25h bWV9LSV7dmVyc2lvbn0udGFyLmd6CiAKKyMgaHR0cHM6Ly9naXRodWIuY29tL2xpYmljYWwvbGli aWNhbC9pc3N1ZXMvMTM2MQorUGF0Y2g6ICAgICAgICAgIDAwMDEtQ1ZFLTIwMjYtODgzODMtYnNl YXJjaC1pbmNvbXBhdGlibGUtY2FsbGJhY2stcG9pbnRlci5wYXRjaAorCiBCdWlsZFJlcXVpcmVz OglnY2MKIEJ1aWxkUmVxdWlyZXM6CWdjYy1jKysKIEJ1aWxkUmVxdWlyZXM6CWNtYWtlCg==