mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

patch: Fix CVE-2026-56288

Browse Source 
This patch applies the upstream fix referenced by NVD in [2], using
the commit shown in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56288

(From OE-Core rev: 1b1e13055b4eed838e1411d91dea46de08e1d72f)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a30cd69993f9f48d5cf55e57181e49171f0a1b7a)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hetvi Thakar
2026-07-27 06:03:18 -07:00
committed by Richard Purdie
parent f03efa1107
commit 00e6a3df8c
2 changed files with 76 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
meta/recipes-devtools/patch/patch/CVE-2026-56288.patch Normal file
View File

@@ -0,0 +1,75 @@
From f98fd4b5f696d1fcc9d86f81555370cf4b21150f Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 21 Apr 2026 10:05:02 -0700
Subject: [PATCH] Avoid null pointer derefence with bad hunks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Problem reported by Michał Majchrowicz.
* src/pch.c (another_hunk): Keep chars_read positive
even with malformed hunks.
CVE: CVE-2026-56288
Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313]
(cherry picked from commit e6d6a4e021660679d7fc9150f981d4920f722313)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
src/pch.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/src/pch.c b/src/pch.c
index 6f9f36f..0a31f72 100644
--- a/src/pch.c
+++ b/src/pch.c
@@ -1728,7 +1728,8 @@ another_hunk (enum diff difftype, bool rev)
p_end = filldst-1;
malformed ();
}
- chars_read -= fillsrc == p_ptrn_lines && incomplete_line ();
+ chars_read -= (1 < chars_read && fillsrc == p_ptrn_lines
+ && incomplete_line ());
p_Char[fillsrc] = ch;
p_line[fillsrc] = s;
p_len[fillsrc++] = chars_read;
@@ -1745,7 +1746,8 @@ another_hunk (enum diff difftype, bool rev)
malformed ();
}
context++;
- chars_read -= fillsrc == p_ptrn_lines && incomplete_line ();
+ chars_read -= (1 < chars_read && fillsrc == p_ptrn_lines
+ && incomplete_line ());
p_Char[fillsrc] = ch;
p_line[fillsrc] = s;
p_len[fillsrc++] = chars_read;
@@ -1765,7 +1767,8 @@ another_hunk (enum diff difftype, bool rev)
p_end = fillsrc-1;
malformed ();
}
- chars_read -= filldst == p_end && incomplete_line ();
+ chars_read -= (1 < chars_read && filldst == p_end
+ && incomplete_line ());
p_Char[filldst] = ch;
p_line[filldst] = s;
p_len[filldst++] = chars_read;
@@ -1852,7 +1855,8 @@ another_hunk (enum diff difftype, bool rev)
if (buf[0] != '<' || (buf[1] != ' ' && buf[1] != '\t'))
fatal ("'<' followed by space or tab expected at line %s of patch",
format_linenum (numbuf0, p_input_line));
- chars_read -= 2 + (i == p_ptrn_lines && incomplete_line ());
+ chars_read -= 2 + (3 < chars_read && i == p_ptrn_lines
+ && incomplete_line ());
p_len[i] = chars_read;
p_line[i] = savebuf (buf + 2, chars_read);
if (chars_read && ! p_line[i]) {
@@ -1897,7 +1901,8 @@ another_hunk (enum diff difftype, bool rev)
if (buf[0] != '>' || (buf[1] != ' ' && buf[1] != '\t'))
fatal ("'>' followed by space or tab expected at line %s of patch",
format_linenum (numbuf0, p_input_line));
- chars_read -= 2 + (i == p_end && incomplete_line ());
+ chars_read -= 2 + (3 < chars_read && i == p_end
+ && incomplete_line ());
p_len[i] = chars_read;
p_line[i] = savebuf (buf + 2, chars_read);
if (chars_read && ! p_line[i]) {

1
meta/recipes-devtools/patch/patch_2.7.6.bb
View File

@@ -12,6 +12,7 @@ SRC_URI += "file://0001-Unset-need_charset_alias-when-building-for-musl.patch \
file://0001-Don-t-leak-temporary-file-on-failed-multi-file-ed.patch \
file://CVE-2019-20633.patch \
file://CVE-2026-56289.patch \
file://CVE-2026-56288.patch \
"
SRC_URI[md5sum] = "4c68cee989d83c87b00a3860bcd05600"