mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

wget: Fix CVE-2026-58471

Browse Source 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] c2640fe517
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58471

(From OE-Core rev: e8a20e6c7f6b2fc06b1ef0fabf63ed5fc349f1ac)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hetvi Thakar
2026-07-22 03:12:29 -07:00
committed by Richard Purdie
parent a3df9d6274
commit 23aff30de0
2 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
meta/recipes-extended/wget/wget/CVE-2026-58471.patch Normal file
View File

@@ -0,0 +1,71 @@
From f419222cc7e02dea2da104b4fb5a997019bab9a9 Mon Sep 17 00:00:00 2001
From: Arkadi Vainbrand <arkadva8@gmail.com>
Date: Tue, 13 Jan 2026 12:22:04 +0200
Subject: [PATCH] Fix buffer size handling in filename conversion
* src/url.c (convert_fname): Fix buffer overflow.
Copyright-paperwork-exempt: Yes
CVE: CVE-2026-58471
Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee]
Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
(cherry picked from commit c2640fe5171c59f87c58dc9fcb195b2d18b010ee)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
src/url.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/src/url.c b/src/url.c
index 68688256..6a9efe88 100644
--- a/src/url.c
+++ b/src/url.c
@@ -1603,7 +1603,7 @@ convert_fname (char *fname)
const char *from_encoding = opt.encoding_remote;
const char *to_encoding = opt.locale;
iconv_t cd;
- size_t len, done, inlen, outlen;
+ size_t len, inlen, outlen;
char *s;
const char *orig_fname;
@@ -1625,7 +1625,6 @@ convert_fname (char *fname)
inlen = strlen (fname);
len = outlen = inlen * 2;
converted_fname = s = xmalloc (outlen + 1);
- done = 0;
for (;;)
{
@@ -1633,7 +1632,7 @@ convert_fname (char *fname)
if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
&& iconv (cd, NULL, NULL, &s, &outlen) == 0)
{
- *(converted_fname + len - outlen - done) = '\0';
+ *s = '\0';
iconv_close (cd);
DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
orig_fname, from_encoding, converted_fname, to_encoding));
@@ -1656,10 +1655,17 @@ convert_fname (char *fname)
}
else if (errno == E2BIG) /* Output buffer full */
{
- done = len;
- len = outlen = done + inlen * 2;
- converted_fname = xrealloc (converted_fname, outlen + 1);
- s = converted_fname + done;
+ size_t used = s - converted_fname;
+ size_t newlen = used + inlen * 2 + 1;
+
+ /* Ensure we actually grow the buffer */
+ if (newlen <= len)
+ newlen = len * 2;
+
+ converted_fname = xrealloc (converted_fname, newlen + 1);
+ len = newlen;
+ s = converted_fname + used;
+ outlen = len - used;
}
else /* Weird, we got an unspecified error */
{

1
meta/recipes-extended/wget/wget_1.21.4.bb
View File

@@ -5,6 +5,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
file://CVE-2026-58469.patch \
file://CVE-2026-58469-regression_p1.patch \
file://CVE-2026-58469-regression_p2.patch \
file://CVE-2026-58471.patch \
"
SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c"