diff --git a/libs/confuse/Makefile b/libs/confuse/Makefile index ed6cb6b5e5..b521033c58 100644 --- a/libs/confuse/Makefile +++ b/libs/confuse/Makefile @@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk PKG_NAME:=confuse -PKG_VERSION:=3.3 -PKG_RELEASE:=2 +PKG_VERSION:=3.4 +PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=https://github.com/martinh/libconfuse/releases/download/v$(PKG_VERSION) -PKG_HASH:=1dd50a0320e135a55025b23fcdbb3f0a81913b6d0b0a9df8cc2fdf3b3dc67010 +PKG_HASH:=36bfa3928f9c323914c7c8317e8722cb22f41db69d7c9d4c24b4689fa955445d PKG_MAINTAINER:=Alexandru Ardelean PKG_LICENSE:=ISC diff --git a/libs/confuse/patches/010-CVE-2022-40320.patch b/libs/confuse/patches/010-CVE-2022-40320.patch deleted file mode 100644 index 2dafd2402f..0000000000 --- a/libs/confuse/patches/010-CVE-2022-40320.patch +++ /dev/null @@ -1,37 +0,0 @@ -From d73777c2c3566fb2647727bb56d9a2295b81669b Mon Sep 17 00:00:00 2001 -From: Joachim Wiberg -Date: Fri, 2 Sep 2022 16:12:46 +0200 -Subject: [PATCH] Fix #163: unterminated username used with getpwnam() - -Signed-off-by: Joachim Wiberg ---- - src/confuse.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - ---- a/src/confuse.c -+++ b/src/confuse.c -@@ -1863,18 +1863,20 @@ DLLIMPORT char *cfg_tilde_expand(const c - passwd = getpwuid(geteuid()); - file = filename + 1; - } else { -- /* ~user or ~user/path */ -- char *user; -+ char *user; /* ~user or ~user/path */ -+ size_t len; - - file = strchr(filename, '/'); - if (file == 0) - file = filename + strlen(filename); - -- user = malloc(file - filename); -+ len = file - filename - 1; -+ user = malloc(len + 1); - if (!user) - return NULL; - -- strncpy(user, filename + 1, file - filename - 1); -+ strncpy(user, &filename[1], len); -+ user[len] = 0; - passwd = getpwnam(user); - free(user); - }