Backport upstream patch for Magick::Draw memleak (CVE-2023-5349)

rmagick-pr1406-draw-memleak-CVE-2023-5349.patch

@@ -0,0 +1,23 @@
+From da823515a13130010f74678dc48f8b08a70cbd14 Mon Sep 17 00:00:00 2001
+From: Watson <watson1978@gmail.com>
+Date: Sun, 16 Jul 2023 17:59:52 +0900
+Subject: [PATCH] Fix memory leak in `Magick::Draw` for recentry ImageMagick 6
+ by removing unnecessary `GetDrawInfo()` calling
+
+---
+ ext/RMagick/rmdraw.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/ext/RMagick/rmdraw.c b/ext/RMagick/rmdraw.c
+index b71a3958d..c523a6238 100644
+--- a/ext/RMagick/rmdraw.c
++++ b/ext/RMagick/rmdraw.c
+@@ -1420,8 +1420,6 @@ DrawOptions_initialize(VALUE self)
+         rb_raise(rb_eNoMemError, "not enough memory to continue");
+     }
+ 
+-    GetDrawInfo(NULL, draw_options->info);
+-
+     if (rb_block_given_p())
+     {
+         rb_yield(self);

rubygem-rmagick.spec

@@ -9,7 +9,7 @@ Requires:		(ImageMagick%{?_isa} >= %2 with ImageMagick%{?_isa} < %3)\
 
 Name:		rubygem-%{gem_name}
 Version:	5.2.0
-Release:	1%{?dist}
+Release:	2%{?dist}
 
 Summary:	Ruby binding to ImageMagick
 # SPDX confirmed
@@ -19,6 +19,9 @@ Source0:	https://rubygems.org/gems/%{gem_name}-%{version}.gem
 # %%{SOURCE2} %%{version}
 Source1:	rubygem-%{gem_name}-%{version}-full.tar.gz
 Source2:	rmagick-create-full-tarball.sh
+# https://github.com/rmagick/rmagick/pull/1406
+# Fix Magick::Draw memleak, CVE-2023-5349
+Patch0:	rmagick-pr1406-draw-memleak-CVE-2023-5349.patch
 
 BuildRequires:	gcc
 BuildRequires:	rubygems-devel 
@@ -58,6 +61,7 @@ Documentation for %{name}.
 
 %prep
 %setup -q -T -n %{gem_name}-%{version} -b 1
+%patch -P0 -p1
 gem spec %{SOURCE0} -l --ruby > %{gem_name}.gemspec
 
 # permission
@@ -148,6 +152,9 @@ done
 %doc	%{gem_instdir}/examples/
 
 %changelog
+* Tue Oct 31 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 5.2.0-2
+- Backport upstream patch for Magick::Draw memleak (CVE-2023-5349)
+
 * Mon Mar 13 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 5.2.0-1
 - 5.2.0