Version in base suite: 0.15-2

Base version: json-c_0.15-2
Target version: json-c_0.15-2+deb11u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/j/json-c/json-c_0.15-2.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/j/json-c/json-c_0.15-2+deb11u1.dsc

 changelog                         |    6 ++++++
 patches/0005-CVE-2021-32292.patch |   24 ++++++++++++++++++++++++
 patches/series                    |    1 +
 3 files changed, 31 insertions(+)

diff -Nru json-c-0.15/debian/changelog json-c-0.15/debian/changelog
--- json-c-0.15/debian/changelog	2021-02-03 12:28:20.000000000 +0000
+++ json-c-0.15/debian/changelog	2023-08-28 22:02:56.000000000 +0000
@@ -1,3 +1,9 @@
+json-c (0.15-2+deb11u1) bullseye-security; urgency=medium
+
+  * CVE-2021-32292
+
+ -- Moritz Mühlenhoff <jmm@debian.org>  Tue, 29 Aug 2023 00:02:56 +0200
+
 json-c (0.15-2) unstable; urgency=low
 
   [Debian Janitor]
diff -Nru json-c-0.15/debian/patches/0005-CVE-2021-32292.patch json-c-0.15/debian/patches/0005-CVE-2021-32292.patch
--- json-c-0.15/debian/patches/0005-CVE-2021-32292.patch	1970-01-01 00:00:00.000000000 +0000
+++ json-c-0.15/debian/patches/0005-CVE-2021-32292.patch	2023-08-28 22:02:56.000000000 +0000
@@ -0,0 +1,24 @@
+From 4e9e44e5258dee7654f74948b0dd5da39c28beec Mon Sep 17 00:00:00 2001
+From: Marc <34656315+MarcT512@users.noreply.github.com>
+Date: Fri, 7 Aug 2020 10:49:45 +0100
+Subject: [PATCH] Fix read past end of buffer
+
+Resolves https://github.com/json-c/json-c/issues/654
+---
+ apps/json_parse.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/apps/json_parse.c b/apps/json_parse.c
+index bba4622183..72b31a860a 100644
+--- a/apps/json_parse.c
++++ b/apps/json_parse.c
+@@ -82,7 +82,8 @@ static int parseit(int fd, int (*callback)(struct json_object *))
+ 			int parse_end = json_tokener_get_parse_end(tok);
+ 			if (obj == NULL && jerr != json_tokener_continue)
+ 			{
+-				char *aterr = &buf[start_pos + parse_end];
++				char *aterr = (start_pos + parse_end < sizeof(buf)) ?
++					&buf[start_pos + parse_end] : "";
+ 				fflush(stdout);
+ 				int fail_offset = total_read - ret + start_pos + parse_end;
+ 				fprintf(stderr, "Failed at offset %d: %s %c\n", fail_offset,
diff -Nru json-c-0.15/debian/patches/series json-c-0.15/debian/patches/series
--- json-c-0.15/debian/patches/series	2021-02-03 12:28:20.000000000 +0000
+++ json-c-0.15/debian/patches/series	2023-08-28 22:02:56.000000000 +0000
@@ -3,3 +3,4 @@
 0001-CMakeLists-use-GNUInstallDirs.patch
 #608.patch
 0004-reproducible-build.patch
+0005-CVE-2021-32292.patch