[packages/diffutils] Rel 2; fixes CVE-2026-53910

[arekm]

commit 2715f55825185a9f796141a7469fcc498b1b1af9
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Mon Aug 31 15:46:02 2026 +0200

    Rel 2; fixes CVE-2026-53910

 diffutils-CVE-2026-53910.patch | 36 ++++++++++++++++++++++++++++++++++++
 diffutils.spec                 |  4 +++-
 2 files changed, 39 insertions(+), 1 deletion(-)
---
diff --git a/diffutils.spec b/diffutils.spec
index 1feb39c..0a912c9 100644
--- a/diffutils.spec
+++ b/diffutils.spec
@@ -5,7 +5,7 @@ Summary(pl.UTF-8):	Narzędzia diff GNU
 Summary(tr.UTF-8):	GNU dosya karşılaştırma araçları
 Name:		diffutils
 Version:	3.12
-Release:	1
+Release:	2
 License:	GPL v3+
 Group:		Applications/Text
 Source0:	https://ftp.gnu.org/gnu/diffutils/%{name}-%{version}.tar.xz
@@ -13,6 +13,7 @@ Source0:	https://ftp.gnu.org/gnu/diffutils/%{name}-%{version}.tar.xz
 Source1:	http://www.mif.pg.gda.pl/homepages/ankry/man-PLD/%{name}-non-english-man-pages.tar.bz2
 # Source1-md5:	34a7ab56f975ff7e439ea13923ec8ae4
 Patch0:		%{name}-info.patch
+Patch1:		%{name}-CVE-2026-53910.patch
 URL:		http://www.gnu.org/software/diffutils/
 BuildRequires:	autoconf >= 2.64
 BuildRequires:	automake >= 1:1.11
@@ -61,6 +62,7 @@ plików.
 %prep
 %setup -q
 %patch -P0 -p1
+%patch -P1 -p1
 
 %build
 %{__aclocal} -I m4
diff --git a/diffutils-CVE-2026-53910.patch b/diffutils-CVE-2026-53910.patch
new file mode 100644
index 0000000..3c30d4d
--- /dev/null
+++ b/diffutils-CVE-2026-53910.patch
@@ -0,0 +1,36 @@
+From GNU diffutils upstream, backported to 3.12.
+
+diff3: check for integer overflows when reading line numbers from diff
+
+Multiple signed integer overflows in readnum() let crafted diff output
+produce corrupted line numbers, which are then used for memory allocation
+and loop bounds, giving heap-based out-of-bounds writes.
+
+CVE-2026-53910. Reported by Michal Majchrowicz.
+
+Squashed from two upstream commits, NEWS/THANKS hunks dropped:
+https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
+https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815
+
+--- diffutils-3.12/src/diff3.c
++++ diffutils-3.12/src/diff3.c
+@@ -1020,11 +1020,18 @@
+ 
+   do
+     {
+-      num = c - '0' + num * 10;
++      if (ckd_mul (&num, num, 10) || ckd_add (&num, num, c - '0'))
++        return nullptr;
+       c = *++s;
+     }
+   while (c_isdigit (c));
+ 
++  /* Simplify overflow checking later, so that we can always add a
++     line number and a line count, or subtract two line numbers and
++     add 1 to the result, without worrying about overflow.  */
++  if (LIN_MAX / 2 < num)
++    return nullptr;
++
+   *pnum = num;
+   return s;
+ }
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/diffutils.git/commitdiff/2715f55825185a9f796141a7469fcc498b1b1af9