[Buildroot] [PATCH] package/libconfuse: bump to version 3.4

[Michael Fischer]

The backported fix is dropped, as 3.4 ships it:

  0001-Fix-163-unterminated-username-used-with-getpwnam.patch
    -> upstream commit d73777c2c356, released in 3.4

With the patch gone, LIBCONFUSE_IGNORE_CVES is no longer needed either.

3.4 also fixes three robustness defects that carry no CVE:

  #180  isspace() argument fix, could crash the lexer
  #182  stack exhaustion from deeply nested sections
  #187  null dereference on an empty comment with CFGF_COMMENTS

Signed-off-by: Michael Fischer <mf at go-sys.de>
---
 ...rminated-username-used-with-getpwnam.patch | 43 -------------------
 package/libconfuse/libconfuse.hash            |  4 +-
 package/libconfuse/libconfuse.mk              |  5 +--
 3 files changed, 2 insertions(+), 50 deletions(-)
 delete mode 100644 package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch

diff --git a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
deleted file mode 100644
index 44e15468ac..0000000000
--- a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From d73777c2c3566fb2647727bb56d9a2295b81669b Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit at gmail.com>
-Date: Fri, 2 Sep 2022 16:12:46 +0200
-Subject: [PATCH] Fix #163: unterminated username used with getpwnam()
-
-Signed-off-by: Joachim Wiberg <troglobit at gmail.com>
-
-CVE: CVE-2022-40320
-Upstream: https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice at gmail.com>
----
- src/confuse.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/src/confuse.c b/src/confuse.c
-index 6d1fdbd..05566b5 100644
---- a/src/confuse.c
-+++ b/src/confuse.c
-@@ -1894,18 +1894,20 @@ DLLIMPORT char *cfg_tilde_expand(const char *filename)
- 			passwd = getpwuid(geteuid());
- 			file = filename + 1;
- 		} else {
--			/* ~user or ~user/path */
--			char *user;
-+			char *user; /* ~user or ~user/path */
-+			size_t len;
- 
- 			file = strchr(filename, '/');
- 			if (file == 0)
- 				file = filename + strlen(filename);
- 
--			user = malloc(file - filename);
-+			len = file - filename - 1;
-+			user = malloc(len + 1);
- 			if (!user)
- 				return NULL;
- 
--			strncpy(user, filename + 1, file - filename - 1);
-+			strncpy(user, &filename[1], len);
-+			user[len] = 0;
- 			passwd = getpwnam(user);
- 			free(user);
- 		}
diff --git a/package/libconfuse/libconfuse.hash b/package/libconfuse/libconfuse.hash
index bb968f7a52..19453828d8 100644
--- a/package/libconfuse/libconfuse.hash
+++ b/package/libconfuse/libconfuse.hash
@@ -1,5 +1,3 @@
-# From https://github.com/martinh/libconfuse/releases/download/v3.3/confuse-3.3.tar.xz.md5
-md5  a183cef2cecdd3783436ff8de500d274  confuse-3.3.tar.xz
 # Locally computed
-sha256  1dd50a0320e135a55025b23fcdbb3f0a81913b6d0b0a9df8cc2fdf3b3dc67010  confuse-3.3.tar.xz
+sha256  36bfa3928f9c323914c7c8317e8722cb22f41db69d7c9d4c24b4689fa955445d  confuse-3.4.tar.xz
 sha256  dc3ff4b62f851dd2e94a151061ffeb7d28ddfc880a442068dc5283dbaa927306  LICENSE
diff --git a/package/libconfuse/libconfuse.mk b/package/libconfuse/libconfuse.mk
index fff684a55b..ac3866f746 100644
--- a/package/libconfuse/libconfuse.mk
+++ b/package/libconfuse/libconfuse.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBCONFUSE_VERSION = 3.3
+LIBCONFUSE_VERSION = 3.4
 LIBCONFUSE_SOURCE = confuse-$(LIBCONFUSE_VERSION).tar.xz
 LIBCONFUSE_SITE = https://github.com/libconfuse/libconfuse/releases/download/v$(LIBCONFUSE_VERSION)
 LIBCONFUSE_INSTALL_STAGING = YES
@@ -14,8 +14,5 @@ LIBCONFUSE_LICENSE_FILES = LICENSE
 LIBCONFUSE_CPE_ID_VALID = YES
 LIBCONFUSE_DEPENDENCIES = $(TARGET_NLS_DEPENDENCIES)
 
-# 0001-Fix-163-unterminated-username-used-with-getpwnam.patch
-LIBCONFUSE_IGNORE_CVES += CVE-2022-40320
-
 $(eval $(autotools-package))
 $(eval $(host-autotools-package))
-- 
2.43.0