[Rpm-maint] [rpm-software-management/rpm] Fix CVE-2021-20248 (#1692)

[Demi Marie Obenour]

It is possible to cause undefined behavior (signed integer overflow)
using a malformed package that has einfo.offset set to INT32_MIN in the
trailer.
You can view, comment on, or merge this pull request online at:

  https://github.com/rpm-software-management/rpm/pull/1692

-- Commit Summary --

  * Fix CVE-2021-20248

-- File Changes --

    M lib/header.c (8)

-- Patch Links --

https://github.com/rpm-software-management/rpm/pull/1692.patch
https://github.com/rpm-software-management/rpm/pull/1692.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1692
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20210601/d8ff8819/attachment.html>