CVE-2018-1000221

pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in
dequote() that can result in dequote() function returns 1-byte allocation
if initial length is 0, leading to buffer overflow. This attack appear to
be exploitable via specially crafted .pc file. This vulnerability appears
to have been fixed in 1.5.3.