[AutoPR- Security] Patch rsync for CVE-2026-18743 [LOW]

SPECS/rsync/CVE-2026-18743.patch

@@ -0,0 +1,51 @@
+From 5886aff37d06258a4e1e13d6d16f456c65923fee Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Mon, 7 Sep 2026 15:49:07 +0000
+Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in
+ poptConfigFileToString()
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/rpm-software-management/popt/pull/137.patch
+---
+ popt/poptparse.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/popt/poptparse.c b/popt/poptparse.c
+index 5afc6c5..6cb5b56 100644
+--- a/popt/poptparse.c
++++ b/popt/poptparse.c
+@@ -139,7 +139,6 @@
+     char * p;
+     char * q;
+     char * x;
+-    size_t t;
+     size_t argvlen = 0;
+     size_t maxlinelen = sizeof(line);
+     size_t linelen;
+@@ -186,9 +185,9 @@
+ 	if (*q == '\0') {
+ 	    /* single command line option (ie, no name=val, just name) */
+ 	    q[-1] = '\0';		/* kill off newline from fgets() call */
+-	    argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1);
++	    argvlen += ((size_t)(q - p)) + (sizeof(" --")-1);
+ 	    if (argvlen >= maxargvlen) {
+-		maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2;
++		maxargvlen = argvlen * 2;
+ 		argstr_tmp = realloc(argstr, maxargvlen);
+ 		if (argstr_tmp == NULL) {
+ 		    free(argstr);
+@@ -218,10 +217,9 @@
+ 	    *x = '\0';	/* null out last char if space (including fgets() NL) */
+
+ 	/* rest of line accept */
+-	t = (size_t)(x - p);
+-	argvlen += t + (sizeof("' --='")-1);
++	argvlen += ((size_t)(x - p) + sizeof("' --='")-1);
+ 	if (argvlen >= maxargvlen) {
+-	    maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2;
++	    maxargvlen = argvlen * 2;
+ 	    argstr_tmp = realloc(argstr, maxargvlen);
+ 	    if (argstr_tmp == NULL) {
+ 		free(argstr);
+-- 
+2.45.4

SPECS/rsync/rsync.spec

@@ -1,13 +1,14 @@
 Summary:        Fast incremental file transfer.
 Name:           rsync
 Version:        3.5.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        GPLv3+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 Group:          Appication/Internet
 URL:            https://rsync.samba.org/
 Source0:        https://download.samba.org/pub/rsync/src/%{name}-%{version}.tar.gz
+Patch0:         CVE-2026-18743.patch
 BuildRequires:  lz4-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  zlib-devel
@@ -18,7 +19,7 @@ Requires:       zlib
 Rsync is a fast and extraordinarily versatile file copying tool. It can copy locally, to/from another host over any remote shell, or to/from a remote rsync daemon. It offers a large number of options that control every aspect of its behavior and permit very flexible specification of the set of files to be copied. It is famous for its delta-transfer algorithm, which reduces the amount of data sent over the network by sending only the differences between the source files and the existing files in the destination. Rsync is widely used for backups and mirroring and as an improved copy command for everyday use.
 
 %prep
-%autosetup
+%autosetup -p1
 
 %build
 %configure --with-included-zlib=no --disable-xxhash
@@ -60,6 +61,9 @@ EOF
 %{_sysconfdir}/rsyncd.conf
 
 %changelog
+* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.5.0-2
+- Patch for CVE-2026-18743
+
 * Fri Aug 14 2026 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 3.5.0-1
 - Auto-upgrade to 3.5.0 - for CVE-2026-70458, CVE-2026-53789, CVE-2026-70461, CVE-2026-53800, CVE-2026-53803, CVE-2026-53795, CVE-2026-70454, CVE-2026-53797, CVE-2026-53791, CVE-2026-53792, CVE-2026-53801, CVE-2026-70464, CVE-2026-70452, CVE-2026-53793, CVE-2026-70463, CVE-2026-53798, CVE-2026-70455, CVE-2026-53802, CVE-2026-53785, CVE-2026-53796, CVE-2026-53788, CVE-2026-53786, CVE-2026-53783, CVE-2026-70460, CVE-2026-70459, CVE-2026-53790, CVE-2026-53794, CVE-2026-70462, CVE-2026-70456, CVE-2026-70457, CVE-2026-53799, CVE-2026-53784, CVE-2026-70453, CVE-2026-18839, CVE-2026-18739, CVE-2026-41035