2 files changed, 101 insertions, 0 deletions
diff --git a/dev-libs/confuse/confuse-3.3-r2.ebuild b/dev-libs/confuse/confuse-3.3-r2.ebuild
new file mode 100644
index 000000000000..57c0210569c8
--- /dev/null
+++ b/dev-libs/confuse/confuse-3.3-r2.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit multilib-minimal flag-o-matic
+
+DESCRIPTION="a configuration file parser library"
+HOMEPAGE="https://github.com/martinh/libconfuse"
+SRC_URI="https://github.com/martinh/libconfuse/releases/download/v${PV}/${P}.tar.xz"
+
+LICENSE="ISC"
+SLOT="0/2.1.0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x86-solaris"
+
+IUSE="nls static-libs"
+
+BDEPEND="
+	sys-devel/flex
+	sys-devel/libtool
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )
+"
+RDEPEND="
+	nls? ( virtual/libintl[${MULTILIB_USEDEP}] )
+"
+
+PATCHES=(
+	# Upstream commit to fix CVE-2022-40320:
+	# https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
+	"${FILESDIR}"/confuse-3.3-fix-CVE-2022-40320.patch
+)
+
+DOCS=( AUTHORS )
+
+src_prepare() {
+	default
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# https://github.com/libconfuse/libconfuse/pull/167
+	append-lfs-flags
+
+	# examples are normally compiled but not installed. They
+	# fail during a mingw crosscompile.
+	local ECONF_SOURCE=${BUILD_DIR}
+	econf \
+		--enable-shared \
+		--disable-examples \
+		$(use_enable nls) \
+		$(use_enable static-libs static)
+}
+
+multilib_src_install_all() {
+	doman doc/man/man3/*.3
+	dodoc -r doc/html
+
+	docinto examples
+	dodoc examples/*.{c,conf}
+
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/dev-libs/confuse/files/confuse-3.3-fix-CVE-2022-40320.patch b/dev-libs/confuse/files/confuse-3.3-fix-CVE-2022-40320.patch
new file mode 100644
index 000000000000..478c8556fe59
--- /dev/null
+++ b/dev-libs/confuse/files/confuse-3.3-fix-CVE-2022-40320.patch
@@ -0,0 +1,39 @@
+https://bugs.gentoo.org/901089
+https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
+
+(Rebased by Vaibhav Rustagi <vaibhavrustagi@google.com>)
+
+From d73777c2c3566fb2647727bb56d9a2295b81669b Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Fri, 2 Sep 2022 16:12:46 +0200
+Subject: [PATCH] Fix #163: unterminated username used with getpwnam()
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+--- a/src/confuse.c
++++ b/src/confuse.c
+@@ -1863,18 +1863,20 @@ DLLIMPORT char *cfg_tilde_expand(const char *filename)
+ 			passwd = getpwuid(geteuid());
+ 			file = filename + 1;
+ 		} else {
+-			/* ~user or ~user/path */
+-			char *user;
++			char *user; /* ~user or ~user/path */
++			size_t len;
+ 
+ 			file = strchr(filename, '/');
+ 			if (file == 0)
+ 				file = filename + strlen(filename);
+ 
+-			user = malloc(file - filename);
++			len = file - filename - 1;
++			user = malloc(len + 1);
+ 			if (!user)
+ 				return NULL;
+ 
+-			strncpy(user, filename + 1, file - filename - 1);
++			strncpy(user, &filename[1], len);
++			user[len] = 0;
+ 			passwd = getpwnam(user);
+ 			free(user);
+ 		}
+