From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Tom spot Callaway To: git-commits@fedoraproject.org Subject: [rpms/nanosvg] rawhide: fix CVE-2026-88367 Date: Fri, 25 Sep 2026 19:27:30 GMT Message-ID: <179036445059.1.14073746127728635206.rpms-nanosvg-3428777f67f6@fedoraproject.org> List-ID: X-Git-Repo: rpms/nanosvg X-Git-Branch: rawhide X-Git-Rev: 3428777f67f6cde3d0bf7c3aaa53497342a9c783 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbmFub3N2ZwpCcmFu Y2ggOiByYXdoaWRlCkNvbW1pdCA6IDM0Mjg3NzdmNjdmNmNkZTNkMGJmN2MzYWFhNTM0OTczNDJh OWM3ODMKQXV0aG9yIDogVG9tIHNwb3QgQ2FsbGF3YXkgPHNwb3Rhd3NAYW1hem9uLmNvbT4KRGF0 ZSAgIDogMjAyNi0wOS0yNVQxNToyNzoyNS0wNDowMApTdGF0cyAgOiArMTI1Ly0xIGluIDIgZmls ZShzKQpVUkwgICAgOiBodHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL25hbm9zdmcv Yy8zNDI4Nzc3ZjY3ZjZjZGUzZDBiZjdjM2FhYTUzNDk3MzQyYTljNzgzP2JyYW5jaD1yYXdoaWRl CgpMb2c6CmZpeCBDVkUtMjAyNi04ODM2NwoKLS0tCmRpZmYgLS1naXQgYS9uYW5vc3ZnLUNWRS0y MDI2LTg4MzY3LnBhdGNoIGIvbmFub3N2Zy1DVkUtMjAyNi04ODM2Ny5wYXRjaApuZXcgZmlsZSBt b2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi4wNjc2MTRjCi0tLSAvZGV2L251bGwKKysrIGIvbmFu b3N2Zy1DVkUtMjAyNi04ODM2Ny5wYXRjaApAQCAtMCwwICsxLDExNyBAQAorZGlmZiAtdXAgbmFu b3N2Zy1hYmNkMjc3ZWE0NWU5MDk4YmVkNzUyY2Y5YzY4NzViNTMzYzA4OTJmL3NyYy9uYW5vc3Zn LmguZml4IG5hbm9zdmctYWJjZDI3N2VhNDVlOTA5OGJlZDc1MmNmOWM2ODc1YjUzM2MwODkyZi9z cmMvbmFub3N2Zy5oCistLS0gbmFub3N2Zy1hYmNkMjc3ZWE0NWU5MDk4YmVkNzUyY2Y5YzY4NzVi NTMzYzA4OTJmL3NyYy9uYW5vc3ZnLmguZml4CTIwMjYtMDktMjUgMTQ6NTQ6MDcuMjUzMTEyNDU3 IC0wNDAwCisrKysgbmFub3N2Zy1hYmNkMjc3ZWE0NWU5MDk4YmVkNzUyY2Y5YzY4NzViNTMzYzA4 OTJmL3NyYy9uYW5vc3ZnLmgJMjAyNi0wOS0yNSAxNDo1NTo0MS4xMTc4MDk2OTcgLTA0MDAKK0BA IC0yMTY2LDExICsyMTY2LDEzIEBAIHN0YXRpYyB2b2lkIG5zdmdfX3BhdGhBcmNUbyhOU1ZHcGFy c2VyKgorIAkJeDIgPSBhcmdzWzVdOworIAkJeTIgPSBhcmdzWzZdOworIAl9CisrCWlmICghaXNm aW5pdGUoeDIpIHx8ICFpc2Zpbml0ZSh5MikpIHJldHVybjsKKyAKKyAJZHggPSB4MSAtIHgyOwor IAlkeSA9IHkxIC0geTI7CisgCWQgPSBzcXJ0ZihkeCpkeCArIGR5KmR5KTsKKy0JaWYgKGQgPCAx ZS02ZiB8fCByeCA8IDFlLTZmIHx8IHJ5IDwgMWUtNmYpIHsKKysJaWYgKGQgPCAxZS02ZiB8fCBy eCA8IDFlLTZmIHx8IHJ5IDwgMWUtNmYgfHwKKysJCSFpc2Zpbml0ZShkKSB8fCAhaXNmaW5pdGUo cngpIHx8ICFpc2Zpbml0ZShyeSkgfHwgIWlzZmluaXRlKHJvdHgpKSB7CisgCQkvLyBUaGUgYXJj IGRlZ2VuZXJhdGVzIHRvIGEgbGluZQorIAkJbnN2Z19fbGluZVRvKHAsIHgyLCB5Mik7CisgCQkq Y3B4ID0geDI7CitAQCAtMjIyNCw2ICsyMjI2LDE0IEBAIHN0YXRpYyB2b2lkIG5zdmdfX3BhdGhB cmNUbyhOU1ZHcGFyc2VyKgorIAllbHNlIGlmIChmcyA9PSAxICYmIGRhIDwgMCkKKyAJCWRhICs9 IDIgKiBOU1ZHX1BJOworIAorKwkvLyBJbnZhbGlkIGludGVybWVkaWF0ZSBnZW9tZXRyeSBtdXN0 IG5vdCByZWFjaCB0aGUgc3ViZGl2aXNpb24gY2FzdC4KKysJaWYgKCFpc2Zpbml0ZShkYSkgfHwg IWlzZmluaXRlKGExKSB8fCAhaXNmaW5pdGUoY3gpIHx8ICFpc2Zpbml0ZShjeSkpIHsKKysJCW5z dmdfX2xpbmVUbyhwLCB4MiwgeTIpOworKwkJKmNweCA9IHgyOworKwkJKmNweSA9IHkyOworKwkJ cmV0dXJuOworKwl9CisrCisgCS8vIEFwcHJveGltYXRlIHRoZSBhcmMgdXNpbmcgY3ViaWMgc3Bs aW5lIHNlZ21lbnRzLgorIAl0WzBdID0gY29zcng7IHRbMV0gPSBzaW5yeDsKKyAJdFsyXSA9IC1z aW5yeDsgdFszXSA9IGNvc3J4OworZGlmZiAtdXAgbmFub3N2Zy1hYmNkMjc3ZWE0NWU5MDk4YmVk NzUyY2Y5YzY4NzViNTMzYzA4OTJmL3NyYy9uYW5vc3ZncmFzdC5oLmZpeCBuYW5vc3ZnLWFiY2Qy NzdlYTQ1ZTkwOThiZWQ3NTJjZjljNjg3NWI1MzNjMDg5MmYvc3JjL25hbm9zdmdyYXN0LmgKKy0t LSBuYW5vc3ZnLWFiY2QyNzdlYTQ1ZTkwOThiZWQ3NTJjZjljNjg3NWI1MzNjMDg5MmYvc3JjL25h bm9zdmdyYXN0LmguZml4CTIwMjYtMDktMjUgMTQ6NTU6NDkuNDM1OTY5ODUxIC0wNDAwCisrKysg bmFub3N2Zy1hYmNkMjc3ZWE0NWU5MDk4YmVkNzUyY2Y5YzY4NzViNTMzYzA4OTJmL3NyYy9uYW5v c3ZncmFzdC5oCTIwMjYtMDktMjUgMTU6MDA6MzYuNDAwODAyNzg1IC0wNDAwCitAQCAtOTQsNiAr OTQsNyBAQCB2b2lkIG5zdmdEZWxldGVSYXN0ZXJpemVyKE5TVkdyYXN0ZXJpemVyCisgI2luY2x1 ZGUgPG1hdGguaD4KKyAjaW5jbHVkZSA8c3RkbGliLmg+CisgI2luY2x1ZGUgPHN0cmluZy5oPgor KyNpbmNsdWRlIDxsaW1pdHMuaD4KKyAKKyAjZGVmaW5lIE5TVkdfX1NVQlNBTVBMRVMJNQorICNk ZWZpbmUgTlNWR19fRklYU0hJRlQJCTEwCitAQCAtMzQ2LDYgKzM0NywyNCBAQCBzdGF0aWMgZmxv YXQgbnN2Z19fbm9ybWFsaXplKGZsb2F0ICp4LCBmCisgfQorIAorIHN0YXRpYyBmbG9hdCBuc3Zn X19hYnNmKGZsb2F0IHgpIHsgcmV0dXJuIHggPCAwID8gLXggOiB4OyB9Cisrc3RhdGljIGZsb2F0 IG5zdmdfX3JvdW5kZihmbG9hdCB4KSB7IHJldHVybiAoeCA+PSAwKSA/IGZsb29yZih4ICsgMC41 KSA6IGNlaWxmKHggLSAwLjUpOyB9CisrCisrc3RhdGljIGludCBuc3ZnX19yb3VuZGZfY2xhbXAo ZmxvYXQgeCkKKyt7CisrCWZsb2F0IHJvdW5kZWQ7CisrCWlmICghaXNmaW5pdGUoeCkpIHJldHVy biB4ID4gMCA/IElOVF9NQVggOiAoeCA8IDAgPyBJTlRfTUlOIDogMCk7CisrCXJvdW5kZWQgPSBu c3ZnX19yb3VuZGYoeCk7CisrCWlmICgoZG91YmxlKXJvdW5kZWQgPj0gKGRvdWJsZSlJTlRfTUFY KSByZXR1cm4gSU5UX01BWDsKKysJaWYgKChkb3VibGUpcm91bmRlZCA8PSAoZG91YmxlKUlOVF9N SU4pIHJldHVybiBJTlRfTUlOOworKwlyZXR1cm4gKGludClyb3VuZGVkOworK30KKysKKytzdGF0 aWMgaW50IG5zdmdfX2lhZGRfc2F0KGludCBhLCBpbnQgYikKKyt7CisrCWlmIChiID4gMCAmJiBh ID4gSU5UX01BWCAtIGIpIHJldHVybiBJTlRfTUFYOworKwlpZiAoYiA8IDAgJiYgYSA8IElOVF9N SU4gLSBiKSByZXR1cm4gSU5UX01JTjsKKysJcmV0dXJuIGEgKyBiOworK30KKyAKKyBzdGF0aWMg dm9pZCBuc3ZnX19mbGF0dGVuQ3ViaWNCZXooTlNWR3Jhc3Rlcml6ZXIqIHIsCisgCQkJCQkJCQkg IGZsb2F0IHgxLCBmbG9hdCB5MSwgZmxvYXQgeDIsIGZsb2F0IHkyLAorQEAgLTU3Myw3ICs1OTIs NyBAQCBzdGF0aWMgdm9pZCBuc3ZnX19yb3VuZEpvaW4oTlNWR3Jhc3Rlcml6CisgCWlmIChkYSA8 IE5TVkdfUEkpIGRhICs9IE5TVkdfUEkqMjsKKyAJaWYgKGRhID4gTlNWR19QSSkgZGEgLT0gTlNW R19QSSoyOworIAorLQluID0gKGludCljZWlsZigobnN2Z19fYWJzZihkYSkgLyBOU1ZHX1BJKSAq IChmbG9hdCluY2FwKTsKKysJbiA9IG5zdmdfX3JvdW5kZl9jbGFtcChjZWlsZigobnN2Z19fYWJz ZihkYSkgLyBOU1ZHX1BJKSAqIChmbG9hdCluY2FwKSk7CisgCWlmIChuIDwgMikgbiA9IDI7Cisg CWlmIChuID4gbmNhcCkgbiA9IG5jYXA7CisgCitAQCAtNjE2LDkgKzYzNSwxMiBAQCBzdGF0aWMg dm9pZCBuc3ZnX19zdHJhaWdodEpvaW4oTlNWR3Jhc3RlCisgc3RhdGljIGludCBuc3ZnX19jdXJ2 ZURpdnMoZmxvYXQgciwgZmxvYXQgYXJjLCBmbG9hdCB0b2wpCisgeworIAlmbG9hdCBkYSA9IGFj b3NmKHIgLyAociArIHRvbCkpICogMi4wZjsKKy0JaW50IGRpdnMgPSAoaW50KWNlaWxmKGFyYyAv IGRhKTsKKy0JaWYgKGRpdnMgPCAyKSBkaXZzID0gMjsKKy0JcmV0dXJuIGRpdnM7CisrCWZsb2F0 IGRpdnM7CisrCS8vIEh1Z2UgcmFkaWkgY2FuIHJvdW5kIHRoZSByYXRpbyB0byBvbmU7IHVzZSB0 aGUgbWluaW11bSBzdWJkaXZpc2lvbi4KKysJaWYgKCEoZGEgPiAwLjBmKSkgcmV0dXJuIDI7Cisr CWRpdnMgPSBjZWlsZihhcmMgLyBkYSk7CisrCWlmICghaXNmaW5pdGUoZGl2cykgfHwgKGRvdWJs ZSlkaXZzID49IChkb3VibGUpSU5UX01BWCkgcmV0dXJuIDI7CisrCXJldHVybiBkaXZzIDwgMiA/ IDIgOiAoaW50KWRpdnM7CisgfQorIAorIHN0YXRpYyB2b2lkIG5zdmdfX2V4cGFuZFN0cm9rZShO U1ZHcmFzdGVyaXplciogciwgTlNWR3BvaW50KiBwb2ludHMsIGludCBucG9pbnRzLCBpbnQgY2xv c2VkLCBpbnQgbGluZUpvaW4sIGludCBsaW5lQ2FwLCBmbG9hdCBsaW5lV2lkdGgpCitAQCAtODg3 LDExICs5MDksOCBAQCBzdGF0aWMgTlNWR2FjdGl2ZUVkZ2UqIG5zdmdfX2FkZEFjdGl2ZShOCisg CWZsb2F0IGR4ZHkgPSAoZS0+eDEgLSBlLT54MCkgLyAoZS0+eTEgLSBlLT55MCk7CisgLy8JU1RC VFRfYXNzZXJ0KGUtPnkwIDw9IHN0YXJ0X3BvaW50KTsKKyAJLy8gcm91bmQgZHggZG93biB0byBh dm9pZCBnb2luZyB0b28gZmFyCistCWlmIChkeGR5IDwgMCkKKy0JCXotPmR4ID0gKGludCkoLWZs b29yZihOU1ZHX19GSVggKiAtZHhkeSkpOworLQllbHNlCistCQl6LT5keCA9IChpbnQpZmxvb3Jm KE5TVkdfX0ZJWCAqIGR4ZHkpOworLQl6LT54ID0gKGludClmbG9vcmYoTlNWR19fRklYICogKGUt PngwICsgZHhkeSAqIChzdGFydFBvaW50IC0gZS0+eTApKSk7CisrCXotPmR4ID0gbnN2Z19fcm91 bmRmX2NsYW1wKE5TVkdfX0ZJWCAqIGR4ZHkpOworKwl6LT54ID0gbnN2Z19fcm91bmRmX2NsYW1w KE5TVkdfX0ZJWCAqIChlLT54MCArIGR4ZHkgKiAoc3RhcnRQb2ludCAtIGUtPnkwKSkpOworIC8v CXotPnggLT0gb2ZmX3ggKiBGSVg7CisgCXotPmV5ID0gZS0+eTE7CisgCXotPm5leHQgPSAwOwor QEAgLTExNTYsNyArMTE3NSw3IEBAIHN0YXRpYyB2b2lkIG5zdmdfX3Jhc3Rlcml6ZVNvcnRlZEVk Z2VzKE4KKyAvLwkJCQkJTlNWR19fYXNzZXJ0KHotPnZhbGlkKTsKKyAJCQkJCW5zdmdfX2ZyZWVB Y3RpdmUociwgeik7CisgCQkJCX0gZWxzZSB7CistCQkJCQl6LT54ICs9IHotPmR4OyAvLyBhZHZh bmNlIHRvIHBvc2l0aW9uIGZvciBjdXJyZW50IHNjYW5saW5lCisrCQkJCQl6LT54ID0gbnN2Z19f aWFkZF9zYXQoei0+eCwgei0+ZHgpOyAvLyBhZHZhbmNlIHRvIHBvc2l0aW9uIGZvciBjdXJyZW50 IHNjYW5saW5lCisgCQkJCQlzdGVwID0gJigoKnN0ZXApLT5uZXh0KTsgLy8gYWR2YW5jZSB0aHJv dWdoIGxpc3QKKyAJCQkJfQorIAkJCX0KCmRpZmYgLS1naXQgYS9uYW5vc3ZnLnNwZWMgYi9uYW5v c3ZnLnNwZWMKaW5kZXggZDdhMzYyYy4uZjFiNzMxNSAxMDA2NDQKLS0tIGEvbmFub3N2Zy5zcGVj CisrKyBiL25hbm9zdmcuc3BlYwpAQCAtMyw3ICszLDcgQEAKIE5hbWU6CQluYW5vc3ZnCiAjIFRo aXMgdGhpbmcgaGFzIG5vIHZlcnNpb24gc28gd2UnbGwgdXNlIHRoZSBsYXN0IGNvbW1pdCBkYXRl CiBWZXJzaW9uOgkyMDIyMTIyMQotUmVsZWFzZToJMTAlez9kaXN0fQorUmVsZWFzZToJMTElez9k aXN0fQogTGljZW5zZToJWmxpYgogIyBUZWNobmljYWxseSwgdGhpcyBpcyBhIGZvcmssIGJ1dCB0 aGUgdXBzdHJlYW0gaXMgdW5tYWludGFpbmVkIGFuZCB0aGlzIG9uZSBoYXMgc29tZSBmaXhlcwog VVJMOgkJaHR0cHM6Ly9naXRodWIuY29tL2ZsdGsvbmFub3N2ZwpAQCAtMTgsNiArMTgsOSBAQCBQ YXRjaDE6CQluYW5vc3ZnLWxpYjY0LnBhdGNoCiAjIGh0dHBzOi8vZ2l0aHViLmNvbS9tZW1vbm9u ZW4vbmFub3N2Zy9wdWxsLzIxNgogIyBNb2RpZmllZCBzbGlnaHRseSB0byB3b3JrIHdpdGhvdXQg YW4gaW5zdGFsbGVkIG5hbm9zdmcgaW5zdGFuY2UKIFBhdGNoMjoJCW5hbm9zdmctYnVpbGQtZXhh bXBsZXMucGF0Y2gKKyMgaHR0cHM6Ly9naXRodWIuY29tL2phbnR6ZW5vL25hbm9zdmdfc2xvcC9j b21taXQvYTM5YWZiNDdmZjcyZjRhMTBmMGRmOWJhMzRmNDUwOGNjZjU1MWY3MworIyBGaXhlcyBD VkUtMjAyNi04ODM2NworUGF0Y2gzOgkJbmFub3N2Zy1DVkUtMjAyNi04ODM2Ny5wYXRjaAogU3Vt bWFyeToJU2ltcGxlIHN0dXBpZCBTVkcgcGFyc2VyCiBCdWlsZFJlcXVpcmVzOgljbWFrZSwgZ2Nj CiAjIE5lZWRlZCBmb3IgZXhhbXBsZTEKQEAgLTQxLDYgKzQ0LDcgQEAgRGV2ZWxvcG1lbnQgZmls ZXMgZm9yIG5hbm9zdmcuCiAlcGF0Y2ggLVAwIC1wMSAtYiAuc292ZXIKICVwYXRjaCAtUDEgLXAx IC1iIC5saWI2NAogJXBhdGNoIC1QMiAtcDEgLWIgLmJ1aWxkLWV4YW1wbGVzCislcGF0Y2ggLVAz IC1wMSAtYiAuQ1ZFLTIwMjYtODgzNjcKIAogJWJ1aWxkCiAlY21ha2UKQEAgLTY5LDYgKzczLDkg QEAgcG9wZAogJXtfbGliZGlyfS9saWJuYW5vc3ZncmFzdC5zbwogCiAlY2hhbmdlbG9nCisqIEZy aSBTZXAgMjUgMjAyNiBUb20gQ2FsbGF3YXkgPHNwb3RAZmVkb3JhcHJvamVjdC5vcmc+IC0gMjAy MjEyMjEtMTEKKy0gYXBwbHkgZml4IGZvciBDVkUtMjAyNi04ODM2NyAodGhhbmtzIHRvIEBqYW50 emVubyBhbmQgQDE4MjA4OTMxMzUtcGl4ZWwgb24gR2l0SHViKQorCiAqIFRodSBKdWwgMTYgMjAy NiBGZWRvcmEgUmVsZWFzZSBFbmdpbmVlcmluZyA8cmVsZW5nQGZlZG9yYXByb2plY3Qub3JnPiAt IDIwMjIxMjIxLTEwCiAtIFJlYnVpbHQgZm9yIGh0dHBzOi8vZmVkb3JhcHJvamVjdC5vcmcvd2lr aS9GZWRvcmFfNDVfTWFzc19SZWJ1aWxkCiAK