diff -pruN 1.12.11+20110422.1+1e14eea~dfsg-4/debian/changelog 1.12.11+20110422.1+1e14eea~dfsg-5/debian/changelog --- 1.12.11+20110422.1+1e14eea~dfsg-4/debian/changelog 2023-02-08 08:46:57.000000000 +0000 +++ 1.12.11+20110422.1+1e14eea~dfsg-5/debian/changelog 2023-05-23 03:53:48.000000000 +0000 @@ -1,3 +1,13 @@ +sofia-sip (1.12.11+20110422.1+1e14eea~dfsg-5) unstable; urgency=medium + + * Add patch to fix reported CVE; add copyright of patch. + For further information see: + - CVE-2022-47516[0] + [0] https://security-tracker.debian.org/tracker/CVE-2022-47516 + https://www.cve.org/CVERecord?id=CVE-2022-47516 (closes: bug#1031792) + + -- Evangelos Ribeiro Tzaras Tue, 23 May 2023 05:53:48 +0200 + sofia-sip (1.12.11+20110422.1+1e14eea~dfsg-4) unstable; urgency=high (fixes a CVE) * Rename patches to indicate they have been picked from upstream diff -pruN 1.12.11+20110422.1+1e14eea~dfsg-4/debian/copyright 1.12.11+20110422.1+1e14eea~dfsg-5/debian/copyright --- 1.12.11+20110422.1+1e14eea~dfsg-4/debian/copyright 2023-02-08 08:46:57.000000000 +0000 +++ 1.12.11+20110422.1+1e14eea~dfsg-5/debian/copyright 2023-05-23 03:53:48.000000000 +0000 @@ -250,6 +250,7 @@ Files: Copyright: 2022 Andrey Volk 2022 Qiuhao Li + 2022 Dave Horton License-Grant: This library is free software; you can redistribute it and/or modify it diff -pruN 1.12.11+20110422.1+1e14eea~dfsg-4/debian/patches/0005-cve-dos-wrong-assert.patch 1.12.11+20110422.1+1e14eea~dfsg-5/debian/patches/0005-cve-dos-wrong-assert.patch --- 1.12.11+20110422.1+1e14eea~dfsg-4/debian/patches/0005-cve-dos-wrong-assert.patch 1970-01-01 00:00:00.000000000 +0000 +++ 1.12.11+20110422.1+1e14eea~dfsg-5/debian/patches/0005-cve-dos-wrong-assert.patch 2023-05-23 03:53:48.000000000 +0000 @@ -0,0 +1,22 @@ +From: Dave Horton +Date: Mon, 28 Nov 2022 14:44:30 -0500 +Subject: remove assert that can reasonably be expected to happen + +(cherry picked from commit cadf505d88e2971d24b6a4379ddbb1398d8ec443) +--- + libsofia-sip-ua/tport/tport.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/libsofia-sip-ua/tport/tport.c b/libsofia-sip-ua/tport/tport.c +index c3bc2b6..18dfd47 100644 +--- a/libsofia-sip-ua/tport/tport.c ++++ b/libsofia-sip-ua/tport/tport.c +@@ -3309,8 +3309,6 @@ tport_t *tport_tsend(tport_t *self, + tp_name_t tpn[1]; + struct sigcomp_compartment *cc; + +- assert(self); +- + if (!self || !msg || !_tpn) { + msg_set_errno(msg, EINVAL); + return NULL; diff -pruN 1.12.11+20110422.1+1e14eea~dfsg-4/debian/patches/series 1.12.11+20110422.1+1e14eea~dfsg-5/debian/patches/series --- 1.12.11+20110422.1+1e14eea~dfsg-4/debian/patches/series 2023-02-08 08:46:57.000000000 +0000 +++ 1.12.11+20110422.1+1e14eea~dfsg-5/debian/patches/series 2023-05-23 03:53:48.000000000 +0000 @@ -4,3 +4,4 @@ 0002-cve-fix-oob-read-url_canonize.patch 0003-cve-fix-heap-overflow-by-two.patch 0004-cve-check-stun-message-and-attr-len.patch +0005-cve-dos-wrong-assert.patch