[packages/bzip2] Rel 3; fix CVE-2026-42250

[arekm]

commit 4d5504c85e32de889615c9257c6b968832c94b68
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Mon Aug 31 15:27:44 2026 +0200

    Rel 3; fix CVE-2026-42250

 bzip2-CVE-2026-42250.patch | 32 ++++++++++++++++++++++++++++++++
 bzip2.spec                 |  4 +++-
 2 files changed, 35 insertions(+), 1 deletion(-)
---
diff --git a/bzip2.spec b/bzip2.spec
index 3e50958..9cc4a01 100644
--- a/bzip2.spec
+++ b/bzip2.spec
@@ -12,7 +12,7 @@ Summary(uk.UTF-8):	Компресор файлів на базі алгорит
 Summary(ru.UTF-8):	Компрессор файлов на основе алгоритма блочной сортировки
 Name:		bzip2
 Version:	1.0.8
-Release:	2
+Release:	3
 License:	BSD-like
 Group:		Applications/Archiving
 Source0:	https://sourceware.org/pub/bzip2/%{name}-%{version}.tar.gz
@@ -21,6 +21,7 @@ Source1:	http://qboosh.pl/man/%{name}-man-pages.tar.bz2
 # Source1-md5:	14a68bf85666428000aad7cb0785a6e5
 Source2:	%{name}.pc
 Patch0:		%{name}-libtoolizeautoconf.patch
+Patch1:		%{name}-CVE-2026-42250.patch
 
 # Modified from http://www.vanheusden.com/Linux/bzip2-1.0.2.diff.gz
 Patch2:		%{name}-progress-counter-1.0.2.patch
@@ -167,6 +168,7 @@ Bibliotecas estáticas para desenvolvimento com a bzip2.
 %prep
 %setup -q
 %patch -P0 -p1
+%patch -P1 -p1
 
 %{?with_progress:%patch -P2 -p1}
 
diff --git a/bzip2-CVE-2026-42250.patch b/bzip2-CVE-2026-42250.patch
new file mode 100644
index 0000000..077cc7c
--- /dev/null
+++ b/bzip2-CVE-2026-42250.patch
@@ -0,0 +1,32 @@
+From 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 Mon Sep 17 00:00:00 2001
+From: Mark Wielaard <mark at klomp.org>
+Date: Thu, 28 May 2026 16:15:45 +0200
+Subject: bzip2recover: Make sure to not process more than
+ BZ_MAX_HANDLED_BLOCKS
+
+There is an off-by-one in the check before calling tooManyBlocks. This
+causes the scanning loop to run one more time and cause a possible
+read or write one past the global bStart, bEnd, rbStart and rbEnd
+buffers. There are no known exploits of this issue and you will need
+to compile with something like gcc -fsanitize=address (ASAN
+AddressSanitizer) to observe the faulty read/write.
+
+This has been assigned CVE-2026-42250.
+https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
+---
+ bzip2recover.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bzip2recover.c b/bzip2recover.c
+index a8131e0..4b1c219 100644
+--- a/bzip2recover.c
++++ b/bzip2recover.c
+@@ -402,7 +402,7 @@ Int32 main ( Int32 argc, Char** argv )
+             rbEnd[rbCtr] = bEnd[currBlock];
+             rbCtr++;
+          }
+-         if (currBlock >= BZ_MAX_HANDLED_BLOCKS)
++         if (currBlock >= BZ_MAX_HANDLED_BLOCKS - 1)
+             tooManyBlocks(BZ_MAX_HANDLED_BLOCKS);
+          currBlock++;
+ 
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/bzip2.git/commitdiff/4d5504c85e32de889615c9257c6b968832c94b68