[MIR] libcue

this looks ok, still pending:

 - bug subscriber
 - tracker-miners MIR

[Expired for libcue (Ubuntu) because there has been no activity for 60 days.]

I'll reset this back to New, because I would like to upload Nautilus depending on tracker soon. This is something we should do towards the start of a cycle.

If the previous MIR can be used to promote this to main again, please just let us know.

this looks ok from the packaging side.
It's a little bit odd that the package is orphaned in Debian, and now pulled into main.

assigning to the security team for a review (parsing external data)

I reviewed libcue (2.2.1-2) from disco. This is not a full security audit but
rather a quick gauge of maintainability.

libcue is a library to parse CUE sheets / files (metadata which describes how
tracks of a CD or DVD are layed out). Stored as plain text and commonly have
the .cue extension. Parsed via flex / bison.

- Build dependencies:
  - bison, cmake, debhelper-compat, flex

- No CVE history

- no pre or postinst scripts
- no systemd unit files
- no system dbus services
- no setuid files
- no binaries in PATH
- no sudo fragments
- no udev rules
- tests run during the build, seems reasonably extensive
- no cron jobs
- clean build log other than warning regarding possible buffer overflow in
  time_frame_to_mmssff() - see below

- doesn't spawn other processes
- memory management looked careful
- file IO - reads from FILE* via flex, doesn't directly open files
- minimal logging, looked fine
- no environment variables used
- no ioctl() or other privileged syscalls
- Does not use cryptography
- Does not use DBus
- Does not use webkit
- Does not use temporary files
- Does not use javascript
- No cppcheck errors
- Does not use polkit

- Potential for signed integer overflow in time_msf_to_frame() if time is negative
- Potential for buffer overflow in time_frame_to_mmssff() if time is negative
  - Both would be fixed if time was treated everywhere as an unsigned quantity
    rather than signed integral types (int/long)

- ACK from security team to promote to main.

libcue 2.2.1-2 in disco: universe/libs -> main