[packages/libcue] Rel 2; fix for CVE-2023-43641

[arekm]

commit 2f3918c4641ade9f50219c312d17e78f41c98425
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Tue Oct 10 16:10:28 2023 +0200

    Rel 2; fix for CVE-2023-43641

 CVE-2023-43641.patch | 24 ++++++++++++++++++++++++
 libcue.spec          |  4 +++-
 2 files changed, 27 insertions(+), 1 deletion(-)
---
diff --git a/libcue.spec b/libcue.spec
index c6d106d..3e3b758 100644
--- a/libcue.spec
+++ b/libcue.spec
@@ -2,12 +2,13 @@ Summary:	CUE Sheet Parser Library
 Summary(pl.UTF-8):	Biblioteka analizująca Cue Sheet
 Name:		libcue
 Version:	2.2.1
-Release:	1
+Release:	2
 License:	GPL v2, parts BSD-like
 Group:		Libraries
 #Source0Download: https://github.com/lipnitsk/libcue/releases
 Source0:	https://github.com/lipnitsk/libcue/archive/v%{version}/%{name}-%{version}.tar.gz
 # Source0-md5:	1dfe65751c3817c76a107bd5a0d924a3
+Patch0:         CVE-2023-43641.patch
 URL:		https://github.com/lipnitsk/libcue
 BuildRequires:	bison
 BuildRequires:	cmake >= 2.8
@@ -45,6 +46,7 @@ Pliki nagłówkowe biblioteki libcue.
 
 %prep
 %setup -q
+%patch0 -p1
 
 %build
 install -d build
diff --git a/CVE-2023-43641.patch b/CVE-2023-43641.patch
new file mode 100644
index 0000000..b38727f
--- /dev/null
+++ b/CVE-2023-43641.patch
@@ -0,0 +1,24 @@
+From fdf72c8bded8d24cfa0608b8e97f2eed210a920e Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse at github.com>
+Date: Wed, 27 Sep 2023 20:22:43 +0100
+Subject: [PATCH] Check that the array index isn't negative. This fixes
+ CVE-2023-43641.
+
+Signed-off-by: Kevin Backhouse <kevinbackhouse at github.com>
+---
+ cd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cd.c b/cd.c
+index cf77a18..4bbea19 100644
+--- a/cd.c
++++ b/cd.c
+@@ -339,7 +339,7 @@ track_get_rem(const Track* track)
+ 
+ void track_set_index(Track *track, int i, long ind)
+ {
+-	if (i > MAXINDEX) {
++	if (i < 0 || i > MAXINDEX) {
+ 		fprintf(stderr, "too many indexes\n");
+                 return;
+         }
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/libcue.git/commitdiff/2f3918c4641ade9f50219c312d17e78f41c98425