From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Tom spot Callaway To: git-commits@fedoraproject.org Subject: [rpms/nanosvg] f43: fix CVE-2026-88367 Date: Fri, 25 Sep 2026 20:25:45 GMT Message-ID: <179036794589.1.72866670475865445.rpms-nanosvg-3428777f67f6@fedoraproject.org> List-ID: X-Git-Repo: rpms/nanosvg X-Git-Branch: f43 X-Git-Rev: 3428777f67f6cde3d0bf7c3aaa53497342a9c783 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbmFub3N2ZwpCcmFu Y2ggOiBmNDMKQ29tbWl0IDogMzQyODc3N2Y2N2Y2Y2RlM2QwYmY3YzNhYWE1MzQ5NzM0MmE5Yzc4 MwpBdXRob3IgOiBUb20gc3BvdCBDYWxsYXdheSA8c3BvdGF3c0BhbWF6b24uY29tPgpEYXRlICAg OiAyMDI2LTA5LTI1VDE1OjI3OjI1LTA0OjAwClN0YXRzICA6ICsxMjUvLTEgaW4gMiBmaWxlKHMp ClVSTCAgICA6IGh0dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvbmFub3N2Zy9jLzM0 Mjg3NzdmNjdmNmNkZTNkMGJmN2MzYWFhNTM0OTczNDJhOWM3ODM/YnJhbmNoPWY0MwoKTG9nOgpm aXggQ1ZFLTIwMjYtODgzNjcKCi0tLQpkaWZmIC0tZ2l0IGEvbmFub3N2Zy1DVkUtMjAyNi04ODM2 Ny5wYXRjaCBiL25hbm9zdmctQ1ZFLTIwMjYtODgzNjcucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2 NDQKaW5kZXggMDAwMDAwMC4uMDY3NjE0YwotLS0gL2Rldi9udWxsCisrKyBiL25hbm9zdmctQ1ZF LTIwMjYtODgzNjcucGF0Y2gKQEAgLTAsMCArMSwxMTcgQEAKK2RpZmYgLXVwIG5hbm9zdmctYWJj ZDI3N2VhNDVlOTA5OGJlZDc1MmNmOWM2ODc1YjUzM2MwODkyZi9zcmMvbmFub3N2Zy5oLmZpeCBu YW5vc3ZnLWFiY2QyNzdlYTQ1ZTkwOThiZWQ3NTJjZjljNjg3NWI1MzNjMDg5MmYvc3JjL25hbm9z dmcuaAorLS0tIG5hbm9zdmctYWJjZDI3N2VhNDVlOTA5OGJlZDc1MmNmOWM2ODc1YjUzM2MwODky Zi9zcmMvbmFub3N2Zy5oLmZpeAkyMDI2LTA5LTI1IDE0OjU0OjA3LjI1MzExMjQ1NyAtMDQwMAor KysrIG5hbm9zdmctYWJjZDI3N2VhNDVlOTA5OGJlZDc1MmNmOWM2ODc1YjUzM2MwODkyZi9zcmMv bmFub3N2Zy5oCTIwMjYtMDktMjUgMTQ6NTU6NDEuMTE3ODA5Njk3IC0wNDAwCitAQCAtMjE2Niwx MSArMjE2NiwxMyBAQCBzdGF0aWMgdm9pZCBuc3ZnX19wYXRoQXJjVG8oTlNWR3BhcnNlcioKKyAJ CXgyID0gYXJnc1s1XTsKKyAJCXkyID0gYXJnc1s2XTsKKyAJfQorKwlpZiAoIWlzZmluaXRlKHgy KSB8fCAhaXNmaW5pdGUoeTIpKSByZXR1cm47CisgCisgCWR4ID0geDEgLSB4MjsKKyAJZHkgPSB5 MSAtIHkyOworIAlkID0gc3FydGYoZHgqZHggKyBkeSpkeSk7CistCWlmIChkIDwgMWUtNmYgfHwg cnggPCAxZS02ZiB8fCByeSA8IDFlLTZmKSB7CisrCWlmIChkIDwgMWUtNmYgfHwgcnggPCAxZS02 ZiB8fCByeSA8IDFlLTZmIHx8CisrCQkhaXNmaW5pdGUoZCkgfHwgIWlzZmluaXRlKHJ4KSB8fCAh aXNmaW5pdGUocnkpIHx8ICFpc2Zpbml0ZShyb3R4KSkgeworIAkJLy8gVGhlIGFyYyBkZWdlbmVy YXRlcyB0byBhIGxpbmUKKyAJCW5zdmdfX2xpbmVUbyhwLCB4MiwgeTIpOworIAkJKmNweCA9IHgy OworQEAgLTIyMjQsNiArMjIyNiwxNCBAQCBzdGF0aWMgdm9pZCBuc3ZnX19wYXRoQXJjVG8oTlNW R3BhcnNlcioKKyAJZWxzZSBpZiAoZnMgPT0gMSAmJiBkYSA8IDApCisgCQlkYSArPSAyICogTlNW R19QSTsKKyAKKysJLy8gSW52YWxpZCBpbnRlcm1lZGlhdGUgZ2VvbWV0cnkgbXVzdCBub3QgcmVh Y2ggdGhlIHN1YmRpdmlzaW9uIGNhc3QuCisrCWlmICghaXNmaW5pdGUoZGEpIHx8ICFpc2Zpbml0 ZShhMSkgfHwgIWlzZmluaXRlKGN4KSB8fCAhaXNmaW5pdGUoY3kpKSB7CisrCQluc3ZnX19saW5l VG8ocCwgeDIsIHkyKTsKKysJCSpjcHggPSB4MjsKKysJCSpjcHkgPSB5MjsKKysJCXJldHVybjsK KysJfQorKworIAkvLyBBcHByb3hpbWF0ZSB0aGUgYXJjIHVzaW5nIGN1YmljIHNwbGluZSBzZWdt ZW50cy4KKyAJdFswXSA9IGNvc3J4OyB0WzFdID0gc2lucng7CisgCXRbMl0gPSAtc2lucng7IHRb M10gPSBjb3NyeDsKK2RpZmYgLXVwIG5hbm9zdmctYWJjZDI3N2VhNDVlOTA5OGJlZDc1MmNmOWM2 ODc1YjUzM2MwODkyZi9zcmMvbmFub3N2Z3Jhc3QuaC5maXggbmFub3N2Zy1hYmNkMjc3ZWE0NWU5 MDk4YmVkNzUyY2Y5YzY4NzViNTMzYzA4OTJmL3NyYy9uYW5vc3ZncmFzdC5oCistLS0gbmFub3N2 Zy1hYmNkMjc3ZWE0NWU5MDk4YmVkNzUyY2Y5YzY4NzViNTMzYzA4OTJmL3NyYy9uYW5vc3ZncmFz dC5oLmZpeAkyMDI2LTA5LTI1IDE0OjU1OjQ5LjQzNTk2OTg1MSAtMDQwMAorKysrIG5hbm9zdmct YWJjZDI3N2VhNDVlOTA5OGJlZDc1MmNmOWM2ODc1YjUzM2MwODkyZi9zcmMvbmFub3N2Z3Jhc3Qu aAkyMDI2LTA5LTI1IDE1OjAwOjM2LjQwMDgwMjc4NSAtMDQwMAorQEAgLTk0LDYgKzk0LDcgQEAg dm9pZCBuc3ZnRGVsZXRlUmFzdGVyaXplcihOU1ZHcmFzdGVyaXplcgorICNpbmNsdWRlIDxtYXRo Lmg+CisgI2luY2x1ZGUgPHN0ZGxpYi5oPgorICNpbmNsdWRlIDxzdHJpbmcuaD4KKysjaW5jbHVk ZSA8bGltaXRzLmg+CisgCisgI2RlZmluZSBOU1ZHX19TVUJTQU1QTEVTCTUKKyAjZGVmaW5lIE5T VkdfX0ZJWFNISUZUCQkxMAorQEAgLTM0Niw2ICszNDcsMjQgQEAgc3RhdGljIGZsb2F0IG5zdmdf X25vcm1hbGl6ZShmbG9hdCAqeCwgZgorIH0KKyAKKyBzdGF0aWMgZmxvYXQgbnN2Z19fYWJzZihm bG9hdCB4KSB7IHJldHVybiB4IDwgMCA/IC14IDogeDsgfQorK3N0YXRpYyBmbG9hdCBuc3ZnX19y b3VuZGYoZmxvYXQgeCkgeyByZXR1cm4gKHggPj0gMCkgPyBmbG9vcmYoeCArIDAuNSkgOiBjZWls Zih4IC0gMC41KTsgfQorKworK3N0YXRpYyBpbnQgbnN2Z19fcm91bmRmX2NsYW1wKGZsb2F0IHgp CisreworKwlmbG9hdCByb3VuZGVkOworKwlpZiAoIWlzZmluaXRlKHgpKSByZXR1cm4geCA+IDAg PyBJTlRfTUFYIDogKHggPCAwID8gSU5UX01JTiA6IDApOworKwlyb3VuZGVkID0gbnN2Z19fcm91 bmRmKHgpOworKwlpZiAoKGRvdWJsZSlyb3VuZGVkID49IChkb3VibGUpSU5UX01BWCkgcmV0dXJu IElOVF9NQVg7CisrCWlmICgoZG91YmxlKXJvdW5kZWQgPD0gKGRvdWJsZSlJTlRfTUlOKSByZXR1 cm4gSU5UX01JTjsKKysJcmV0dXJuIChpbnQpcm91bmRlZDsKKyt9CisrCisrc3RhdGljIGludCBu c3ZnX19pYWRkX3NhdChpbnQgYSwgaW50IGIpCisreworKwlpZiAoYiA+IDAgJiYgYSA+IElOVF9N QVggLSBiKSByZXR1cm4gSU5UX01BWDsKKysJaWYgKGIgPCAwICYmIGEgPCBJTlRfTUlOIC0gYikg cmV0dXJuIElOVF9NSU47CisrCXJldHVybiBhICsgYjsKKyt9CisgCisgc3RhdGljIHZvaWQgbnN2 Z19fZmxhdHRlbkN1YmljQmV6KE5TVkdyYXN0ZXJpemVyKiByLAorIAkJCQkJCQkJICBmbG9hdCB4 MSwgZmxvYXQgeTEsIGZsb2F0IHgyLCBmbG9hdCB5MiwKK0BAIC01NzMsNyArNTkyLDcgQEAgc3Rh dGljIHZvaWQgbnN2Z19fcm91bmRKb2luKE5TVkdyYXN0ZXJpegorIAlpZiAoZGEgPCBOU1ZHX1BJ KSBkYSArPSBOU1ZHX1BJKjI7CisgCWlmIChkYSA+IE5TVkdfUEkpIGRhIC09IE5TVkdfUEkqMjsK KyAKKy0JbiA9IChpbnQpY2VpbGYoKG5zdmdfX2Fic2YoZGEpIC8gTlNWR19QSSkgKiAoZmxvYXQp bmNhcCk7CisrCW4gPSBuc3ZnX19yb3VuZGZfY2xhbXAoY2VpbGYoKG5zdmdfX2Fic2YoZGEpIC8g TlNWR19QSSkgKiAoZmxvYXQpbmNhcCkpOworIAlpZiAobiA8IDIpIG4gPSAyOworIAlpZiAobiA+ IG5jYXApIG4gPSBuY2FwOworIAorQEAgLTYxNiw5ICs2MzUsMTIgQEAgc3RhdGljIHZvaWQgbnN2 Z19fc3RyYWlnaHRKb2luKE5TVkdyYXN0ZQorIHN0YXRpYyBpbnQgbnN2Z19fY3VydmVEaXZzKGZs b2F0IHIsIGZsb2F0IGFyYywgZmxvYXQgdG9sKQorIHsKKyAJZmxvYXQgZGEgPSBhY29zZihyIC8g KHIgKyB0b2wpKSAqIDIuMGY7CistCWludCBkaXZzID0gKGludCljZWlsZihhcmMgLyBkYSk7Cist CWlmIChkaXZzIDwgMikgZGl2cyA9IDI7CistCXJldHVybiBkaXZzOworKwlmbG9hdCBkaXZzOwor KwkvLyBIdWdlIHJhZGlpIGNhbiByb3VuZCB0aGUgcmF0aW8gdG8gb25lOyB1c2UgdGhlIG1pbmlt dW0gc3ViZGl2aXNpb24uCisrCWlmICghKGRhID4gMC4wZikpIHJldHVybiAyOworKwlkaXZzID0g Y2VpbGYoYXJjIC8gZGEpOworKwlpZiAoIWlzZmluaXRlKGRpdnMpIHx8IChkb3VibGUpZGl2cyA+ PSAoZG91YmxlKUlOVF9NQVgpIHJldHVybiAyOworKwlyZXR1cm4gZGl2cyA8IDIgPyAyIDogKGlu dClkaXZzOworIH0KKyAKKyBzdGF0aWMgdm9pZCBuc3ZnX19leHBhbmRTdHJva2UoTlNWR3Jhc3Rl cml6ZXIqIHIsIE5TVkdwb2ludCogcG9pbnRzLCBpbnQgbnBvaW50cywgaW50IGNsb3NlZCwgaW50 IGxpbmVKb2luLCBpbnQgbGluZUNhcCwgZmxvYXQgbGluZVdpZHRoKQorQEAgLTg4NywxMSArOTA5 LDggQEAgc3RhdGljIE5TVkdhY3RpdmVFZGdlKiBuc3ZnX19hZGRBY3RpdmUoTgorIAlmbG9hdCBk eGR5ID0gKGUtPngxIC0gZS0+eDApIC8gKGUtPnkxIC0gZS0+eTApOworIC8vCVNUQlRUX2Fzc2Vy dChlLT55MCA8PSBzdGFydF9wb2ludCk7CisgCS8vIHJvdW5kIGR4IGRvd24gdG8gYXZvaWQgZ29p bmcgdG9vIGZhcgorLQlpZiAoZHhkeSA8IDApCistCQl6LT5keCA9IChpbnQpKC1mbG9vcmYoTlNW R19fRklYICogLWR4ZHkpKTsKKy0JZWxzZQorLQkJei0+ZHggPSAoaW50KWZsb29yZihOU1ZHX19G SVggKiBkeGR5KTsKKy0Jei0+eCA9IChpbnQpZmxvb3JmKE5TVkdfX0ZJWCAqIChlLT54MCArIGR4 ZHkgKiAoc3RhcnRQb2ludCAtIGUtPnkwKSkpOworKwl6LT5keCA9IG5zdmdfX3JvdW5kZl9jbGFt cChOU1ZHX19GSVggKiBkeGR5KTsKKysJei0+eCA9IG5zdmdfX3JvdW5kZl9jbGFtcChOU1ZHX19G SVggKiAoZS0+eDAgKyBkeGR5ICogKHN0YXJ0UG9pbnQgLSBlLT55MCkpKTsKKyAvLwl6LT54IC09 IG9mZl94ICogRklYOworIAl6LT5leSA9IGUtPnkxOworIAl6LT5uZXh0ID0gMDsKK0BAIC0xMTU2 LDcgKzExNzUsNyBAQCBzdGF0aWMgdm9pZCBuc3ZnX19yYXN0ZXJpemVTb3J0ZWRFZGdlcyhOCisg Ly8JCQkJCU5TVkdfX2Fzc2VydCh6LT52YWxpZCk7CisgCQkJCQluc3ZnX19mcmVlQWN0aXZlKHIs IHopOworIAkJCQl9IGVsc2UgeworLQkJCQkJei0+eCArPSB6LT5keDsgLy8gYWR2YW5jZSB0byBw b3NpdGlvbiBmb3IgY3VycmVudCBzY2FubGluZQorKwkJCQkJei0+eCA9IG5zdmdfX2lhZGRfc2F0 KHotPngsIHotPmR4KTsgLy8gYWR2YW5jZSB0byBwb3NpdGlvbiBmb3IgY3VycmVudCBzY2FubGlu ZQorIAkJCQkJc3RlcCA9ICYoKCpzdGVwKS0+bmV4dCk7IC8vIGFkdmFuY2UgdGhyb3VnaCBsaXN0 CisgCQkJCX0KKyAJCQl9CgpkaWZmIC0tZ2l0IGEvbmFub3N2Zy5zcGVjIGIvbmFub3N2Zy5zcGVj CmluZGV4IGQ3YTM2MmMuLmYxYjczMTUgMTAwNjQ0Ci0tLSBhL25hbm9zdmcuc3BlYworKysgYi9u YW5vc3ZnLnNwZWMKQEAgLTMsNyArMyw3IEBACiBOYW1lOgkJbmFub3N2ZwogIyBUaGlzIHRoaW5n IGhhcyBubyB2ZXJzaW9uIHNvIHdlJ2xsIHVzZSB0aGUgbGFzdCBjb21taXQgZGF0ZQogVmVyc2lv bjoJMjAyMjEyMjEKLVJlbGVhc2U6CTEwJXs/ZGlzdH0KK1JlbGVhc2U6CTExJXs/ZGlzdH0KIExp Y2Vuc2U6CVpsaWIKICMgVGVjaG5pY2FsbHksIHRoaXMgaXMgYSBmb3JrLCBidXQgdGhlIHVwc3Ry ZWFtIGlzIHVubWFpbnRhaW5lZCBhbmQgdGhpcyBvbmUgaGFzIHNvbWUgZml4ZXMKIFVSTDoJCWh0 dHBzOi8vZ2l0aHViLmNvbS9mbHRrL25hbm9zdmcKQEAgLTE4LDYgKzE4LDkgQEAgUGF0Y2gxOgkJ bmFub3N2Zy1saWI2NC5wYXRjaAogIyBodHRwczovL2dpdGh1Yi5jb20vbWVtb25vbmVuL25hbm9z dmcvcHVsbC8yMTYKICMgTW9kaWZpZWQgc2xpZ2h0bHkgdG8gd29yayB3aXRob3V0IGFuIGluc3Rh bGxlZCBuYW5vc3ZnIGluc3RhbmNlCiBQYXRjaDI6CQluYW5vc3ZnLWJ1aWxkLWV4YW1wbGVzLnBh dGNoCisjIGh0dHBzOi8vZ2l0aHViLmNvbS9qYW50emVuby9uYW5vc3ZnX3Nsb3AvY29tbWl0L2Ez OWFmYjQ3ZmY3MmY0YTEwZjBkZjliYTM0ZjQ1MDhjY2Y1NTFmNzMKKyMgRml4ZXMgQ1ZFLTIwMjYt ODgzNjcKK1BhdGNoMzoJCW5hbm9zdmctQ1ZFLTIwMjYtODgzNjcucGF0Y2gKIFN1bW1hcnk6CVNp bXBsZSBzdHVwaWQgU1ZHIHBhcnNlcgogQnVpbGRSZXF1aXJlczoJY21ha2UsIGdjYwogIyBOZWVk ZWQgZm9yIGV4YW1wbGUxCkBAIC00MSw2ICs0NCw3IEBAIERldmVsb3BtZW50IGZpbGVzIGZvciBu YW5vc3ZnLgogJXBhdGNoIC1QMCAtcDEgLWIgLnNvdmVyCiAlcGF0Y2ggLVAxIC1wMSAtYiAubGli NjQKICVwYXRjaCAtUDIgLXAxIC1iIC5idWlsZC1leGFtcGxlcworJXBhdGNoIC1QMyAtcDEgLWIg LkNWRS0yMDI2LTg4MzY3CiAKICVidWlsZAogJWNtYWtlCkBAIC02OSw2ICs3Myw5IEBAIHBvcGQK ICV7X2xpYmRpcn0vbGlibmFub3N2Z3Jhc3Quc28KIAogJWNoYW5nZWxvZworKiBGcmkgU2VwIDI1 IDIwMjYgVG9tIENhbGxhd2F5IDxzcG90QGZlZG9yYXByb2plY3Qub3JnPiAtIDIwMjIxMjIxLTEx CistIGFwcGx5IGZpeCBmb3IgQ1ZFLTIwMjYtODgzNjcgKHRoYW5rcyB0byBAamFudHplbm8gYW5k IEAxODIwODkzMTM1LXBpeGVsIG9uIEdpdEh1YikKKwogKiBUaHUgSnVsIDE2IDIwMjYgRmVkb3Jh IFJlbGVhc2UgRW5naW5lZXJpbmcgPHJlbGVuZ0BmZWRvcmFwcm9qZWN0Lm9yZz4gLSAyMDIyMTIy MS0xMAogLSBSZWJ1aWx0IGZvciBodHRwczovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvRmVkb3Jh XzQ1X01hc3NfUmVidWlsZAogCg==