From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Milan Crha To: git-commits@fedoraproject.org Subject: [rpms/libical] f43: Resolves: #2540947 (CVE-2026-88383: Denial of Service via crafted iCalendar property parsing) Date: Fri, 25 Sep 2026 06:49:05 GMT Message-ID: <179031894538.1.15040832720529656528.rpms-libical-c4f6aaaa04ce@fedoraproject.org> List-ID: X-Git-Repo: rpms/libical X-Git-Branch: f43 X-Git-Rev: c4f6aaaa04ce695090092cf02bd2e9b3ff9885cc QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbGliaWNhbApCcmFu Y2ggOiBmNDMKQ29tbWl0IDogYzRmNmFhYWEwNGNlNjk1MDkwMDkyY2YwMmJkMmU5YjNmZjk4ODVj YwpBdXRob3IgOiBNaWxhbiBDcmhhIDxtY3JoYUByZWRoYXQuY29tPgpEYXRlICAgOiAyMDI2LTA5 LTI1VDA4OjQ4OjEwKzAyOjAwClN0YXRzICA6ICs0MC8tNyBpbiAyIGZpbGUocykKVVJMICAgIDog aHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9saWJpY2FsL2MvYzRmNmFhYWEwNGNl Njk1MDkwMDkyY2YwMmJkMmU5YjNmZjk4ODVjYz9icmFuY2g9ZjQzCgpMb2c6ClJlc29sdmVzOiAj MjU0MDk0NyAoQ1ZFLTIwMjYtODgzODM6IERlbmlhbCBvZiBTZXJ2aWNlIHZpYSBjcmFmdGVkIGlD YWxlbmRhciBwcm9wZXJ0eSBwYXJzaW5nKQoKLS0tCmRpZmYgLS1naXQgYS8wMDAxLUNWRS0yMDI2 LTg4MzgzLWJzZWFyY2gtaW5jb21wYXRpYmxlLWNhbGxiYWNrLXBvaW50ZXIucGF0Y2ggYi8wMDAx LUNWRS0yMDI2LTg4MzgzLWJzZWFyY2gtaW5jb21wYXRpYmxlLWNhbGxiYWNrLXBvaW50ZXIucGF0 Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uZjA3OWEyMwotLS0gL2Rldi9u dWxsCisrKyBiLzAwMDEtQ1ZFLTIwMjYtODgzODMtYnNlYXJjaC1pbmNvbXBhdGlibGUtY2FsbGJh Y2stcG9pbnRlci5wYXRjaApAQCAtMCwwICsxLDM2IEBACitkaWZmIC11cCBsaWJpY2FsLTMuMC4y MC9zcmMvbGliaWNhbC9pY2FsZGVyaXZlZHBhcmFtZXRlci5jLmluLjEgbGliaWNhbC0zLjAuMjAv c3JjL2xpYmljYWwvaWNhbGRlcml2ZWRwYXJhbWV0ZXIuYy5pbgorLS0tIGxpYmljYWwtMy4wLjIw L3NyYy9saWJpY2FsL2ljYWxkZXJpdmVkcGFyYW1ldGVyLmMuaW4uMQkyMDI1LTAzLTEwIDE3OjA4 OjI3LjAwMDAwMDAwMCArMDEwMAorKysrIGxpYmljYWwtMy4wLjIwL3NyYy9saWJpY2FsL2ljYWxk ZXJpdmVkcGFyYW1ldGVyLmMuaW4JMjAyNi0wOS0yNSAwODoyNzo1Ni4zMTI3NDg0MDAgKzAyMDAK K0BAIC05NywxMiArOTcsMjAgQEAgY29uc3QgY2hhciAqaWNhbHBhcmFtZXRlcl9raW5kX3RvX3N0 cmluZworICAgICByZXR1cm4gMDsKKyB9CisgCisrLyoqIERPIE5PVCBVU0UuIFJFVEFJTkVEIEZP UiBCQy4gKi8KKyBpbnQgaWNhbHBhcmFtZXRlcl9jb21wYXJlX2tpbmRfbWFwKGNvbnN0IHN0cnVj dCBpY2FscGFyYW1ldGVyX2tpbmRfbWFwICphLAorICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgY29uc3Qgc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXAgKmIpCisgeworICAg ICByZXR1cm4gc3RyY2FzZWNtcChhLT5uYW1lLCBiLT5uYW1lKTsKKyB9CisgCisrc3RhdGljIGlu dCBzX2ljYWxwYXJhbWV0ZXJfY29tcGFyZV9raW5kX21hcChjb25zdCB2b2lkICphLCBjb25zdCB2 b2lkICpiKQorK3sKKysgICAgY29uc3Qgc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXAgKmFt YXAgPSAoc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXAgKilhOworKyAgICBjb25zdCBzdHJ1 Y3QgaWNhbHBhcmFtZXRlcl9raW5kX21hcCAqYm1hcCA9IChzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9r aW5kX21hcCAqKWI7CisrICAgIHJldHVybiBzdHJjYXNlY21wKGFtYXAtPm5hbWUsIGJtYXAtPm5h bWUpOworK30KKysKKyBpY2FscGFyYW1ldGVyX2tpbmQgaWNhbHBhcmFtZXRlcl9zdHJpbmdfdG9f a2luZChjb25zdCBjaGFyICpzdHJpbmcpCisgeworICAgICBzdHJ1Y3QgaWNhbHBhcmFtZXRlcl9r aW5kX21hcCBrZXk7CitAQCAtMTE1LDkgKzEyMyw5IEBAIGljYWxwYXJhbWV0ZXJfa2luZCBpY2Fs cGFyYW1ldGVyX3N0cmluZ18KKyAgICAga2V5LmtpbmQgPSBJQ0FMX0FOWV9QQVJBTUVURVI7Cisg ICAgIGtleS5uYW1lID0gc3RyaW5nOworICAgICByZXN1bHQgPQorLSAgICAgICAgYnNlYXJjaCgm a2V5LCBwYXJhbWV0ZXJfbWFwLCBzaXplb2YocGFyYW1ldGVyX21hcCkgLyBzaXplb2Yoc3RydWN0 IGljYWxwYXJhbWV0ZXJfa2luZF9tYXApLAorKyAgICAgICAgKHN0cnVjdCBpY2FscGFyYW1ldGVy X2tpbmRfbWFwICopYnNlYXJjaCgma2V5LCBwYXJhbWV0ZXJfbWFwLCBzaXplb2YocGFyYW1ldGVy X21hcCkgLyBzaXplb2Yoc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXApLAorICAgICAgICAg ICAgICAgICBzaXplb2Yoc3RydWN0IGljYWxwYXJhbWV0ZXJfa2luZF9tYXApLAorLSAgICAgICAg ICAgICAgICAoaW50ICgqKShjb25zdCB2b2lkICosIGNvbnN0IHZvaWQgKikpaWNhbHBhcmFtZXRl cl9jb21wYXJlX2tpbmRfbWFwKTsKKysgICAgICAgICAgICAgICAgc19pY2FscGFyYW1ldGVyX2Nv bXBhcmVfa2luZF9tYXApOworIAorICAgICBpZiAocmVzdWx0KSB7CisgICAgICAgICByZXR1cm4g cmVzdWx0LT5raW5kOwoKZGlmZiAtLWdpdCBhL2xpYmljYWwuc3BlYyBiL2xpYmljYWwuc3BlYwpp bmRleCAxN2U4ODYwLi5iYTQ4OTYxIDEwMDY0NAotLS0gYS9saWJpY2FsLnNwZWMKKysrIGIvbGli aWNhbC5zcGVjCkBAIC0zLDExICszLDE0IEBACiBTdW1tYXJ5OglSZWZlcmVuY2UgaW1wbGVtZW50 YXRpb24gb2YgdGhlIGlDYWxlbmRhciBkYXRhIHR5cGUgYW5kIHNlcmlhbGl6YXRpb24gZm9ybWF0 CiBOYW1lOgkJbGliaWNhbAogVmVyc2lvbjoJMy4wLjIwCi1SZWxlYXNlOgk0JXs/ZGlzdH0KK1Jl bGVhc2U6CTUlez9kaXN0fQogTGljZW5zZToJTEdQTC0yLjEtb25seSBPUiBNUEwtMi4wCiBVUkw6 CQlodHRwczovL2xpYmljYWwuZ2l0aHViLmlvL2xpYmljYWwvCiBTb3VyY2U6CQlodHRwczovL2dp dGh1Yi5jb20vJXtuYW1lfS8le25hbWV9L2FyY2hpdmUvdiV7dmVyc2lvbn0vJXtuYW1lfS0le3Zl cnNpb259LnRhci5negogCisjIGh0dHBzOi8vZ2l0aHViLmNvbS9saWJpY2FsL2xpYmljYWwvaXNz dWVzLzEzNjEKK1BhdGNoOiAgICAgICAgICAwMDAxLUNWRS0yMDI2LTg4MzgzLWJzZWFyY2gtaW5j b21wYXRpYmxlLWNhbGxiYWNrLXBvaW50ZXIucGF0Y2gKKwogQnVpbGRSZXF1aXJlczoJZ2NjCiBC dWlsZFJlcXVpcmVzOglnY2MtYysrCiBCdWlsZFJlcXVpcmVzOgljbWFrZQpAQCAtMTMzLDEwICsx MzYsNCBAQCBybSAle2J1aWxkcm9vdH0vJXtfbGliZXhlY2Rpcn0vbGliaWNhbC9pY2FsLWdsaWIt c3JjLWdlbmVyYXRvcgogJXtfZGF0YWRpcn0vZ3RrLWRvYy9odG1sLyV7bmFtZX0tZ2xpYgogCiAl Y2hhbmdlbG9nCi0qIFdlZCBBdWcgMDYgMjAyNSBGcmFudGnFoWVrIFphdGxvdWthbCA8ZnphdGxv dWtAcmVkaGF0LmNvbT4gLSAzLjAuMjAtNAotLSBSZWJ1aWx0IGZvciBpY3UgNzcuMQotCi0qIFRo dSBKdWwgMjQgMjAyNSBGZWRvcmEgUmVsZWFzZSBFbmdpbmVlcmluZyA8cmVsZW5nQGZlZG9yYXBy b2plY3Qub3JnPiAtIDMuMC4yMC0zCi0tIFJlYnVpbHQgZm9yIGh0dHBzOi8vZmVkb3JhcHJvamVj dC5vcmcvd2lraS9GZWRvcmFfNDNfTWFzc19SZWJ1aWxkCi0KICVhdXRvY2hhbmdlbG9nCg==