[rpms/libical] f43: Resolves: #2540947 (CVE-2026-88383: Denial of Service via crafted iCalendar property parsing)

[Milan Crha <mcrha@redhat.com>]

A new commit has been pushed.

Repo   : rpms/libical
Branch : f43
Commit : c4f6aaaa04ce695090092cf02bd2e9b3ff9885cc
Author : Milan Crha <mcrha@redhat.com>
Date   : 2026-09-25T08:48:10+02:00
Stats  : +40/-7 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/libical/c/c4f6aaaa04ce695090092cf02bd2e9b3ff9885cc?branch=f43

Log:
Resolves: #2540947 (CVE-2026-88383: Denial of Service via crafted iCalendar property parsing)

---
diff --git a/0001-CVE-2026-88383-bsearch-incompatible-callback-pointer.patch b/0001-CVE-2026-88383-bsearch-incompatible-callback-pointer.patch
new file mode 100644
index 0000000..f079a23
--- /dev/null
+++ b/0001-CVE-2026-88383-bsearch-incompatible-callback-pointer.patch
@@ -0,0 +1,36 @@
+diff -up libical-3.0.20/src/libical/icalderivedparameter.c.in.1 libical-3.0.20/src/libical/icalderivedparameter.c.in
+--- libical-3.0.20/src/libical/icalderivedparameter.c.in.1	2025-03-10 17:08:27.000000000 +0100
++++ libical-3.0.20/src/libical/icalderivedparameter.c.in	2026-09-25 08:27:56.312748400 +0200
+@@ -97,12 +97,20 @@ const char *icalparameter_kind_to_string
+     return 0;
+ }
+ 
++/** DO NOT USE. RETAINED FOR BC. */
+ int icalparameter_compare_kind_map(const struct icalparameter_kind_map *a,
+                                    const struct icalparameter_kind_map *b)
+ {
+     return strcasecmp(a->name, b->name);
+ }
+ 
++static int s_icalparameter_compare_kind_map(const void *a, const void *b)
++{
++    const struct icalparameter_kind_map *amap = (struct icalparameter_kind_map *)a;
++    const struct icalparameter_kind_map *bmap = (struct icalparameter_kind_map *)b;
++    return strcasecmp(amap->name, bmap->name);
++}
++
+ icalparameter_kind icalparameter_string_to_kind(const char *string)
+ {
+     struct icalparameter_kind_map key;
+@@ -115,9 +123,9 @@ icalparameter_kind icalparameter_string_
+     key.kind = ICAL_ANY_PARAMETER;
+     key.name = string;
+     result =
+-        bsearch(&key, parameter_map, sizeof(parameter_map) / sizeof(struct icalparameter_kind_map),
++        (struct icalparameter_kind_map *)bsearch(&key, parameter_map, sizeof(parameter_map) / sizeof(struct icalparameter_kind_map),
+                 sizeof(struct icalparameter_kind_map),
+-                (int (*)(const void *, const void *))icalparameter_compare_kind_map);
++                s_icalparameter_compare_kind_map);
+ 
+     if (result) {
+         return result->kind;

diff --git a/libical.spec b/libical.spec
index 17e8860..ba48961 100644
--- a/libical.spec
+++ b/libical.spec
@@ -3,11 +3,14 @@
 Summary:	Reference implementation of the iCalendar data type and serialization format
 Name:		libical
 Version:	3.0.20
-Release:	4%{?dist}
+Release:	5%{?dist}
 License:	LGPL-2.1-only OR MPL-2.0
 URL:		https://libical.github.io/libical/
 Source:		https://github.com/%{name}/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 
+# https://github.com/libical/libical/issues/1361
+Patch:          0001-CVE-2026-88383-bsearch-incompatible-callback-pointer.patch
+
 BuildRequires:	gcc
 BuildRequires:	gcc-c++
 BuildRequires:	cmake
@@ -133,10 +136,4 @@ rm %{buildroot}/%{_libexecdir}/libical/ical-glib-src-generator
 %{_datadir}/gtk-doc/html/%{name}-glib
 
 %changelog
-* Wed Aug 06 2025 František Zatloukal <fzatlouk@redhat.com> - 3.0.20-4
-- Rebuilt for icu 77.1
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.20-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
 %autochangelog