mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-11 21:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

expat: fix CVE-2026-56411

Browse Source 
This patch applies the upstream fix shown in [1] as referenced by [2].

[1] 528a4e5017
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56411

(From OE-Core rev: 61f895ea50fc7d6e3c1f3bac9e77f3a7ac96de6a)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Deepak Rathore
2026-07-31 11:26:23 +05:30
committed by Paul Barker
parent 12aa2868f6
commit 2c527003ab
2 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
meta/recipes-core/expat/expat/CVE-2026-56411.patch Normal file
View File

@@ -0,0 +1,50 @@
From 5e696e78f8c4a709c4f774973b142e57090c4364 Mon Sep 17 00:00:00 2001
From: netliomax25-code <netliomax25@gmail.com>
Date: Tue, 2 Jun 2026 13:13:34 +0530
Subject: [PATCH 11/17] xmlwf: protect notation list allocation from integer
overflow
CVE: CVE-2026-56411
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5]
Backport Changes:
- Use Scarthgap 2.6.4 freeNotations cleanup and return directly
because the newer shared cleanUp label is absent.
(cherry picked from commit 528a4e5017e1bd3b48b689fd0c131df940ae3ea5)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
expat/xmlwf/xmlwf.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
index bd5f68a4..6a3d31b7 100644
--- a/expat/xmlwf/xmlwf.c
+++ b/expat/xmlwf/xmlwf.c
@@ -387,9 +387,9 @@ static void XMLCALL
endDoctypeDecl(void *userData) {
XmlwfUserData *data = (XmlwfUserData *)userData;
NotationList **notations;
- int notationCount = 0;
+ size_t notationCount = 0;
NotationList *p;
- int i;
+ size_t i;
/* How many notations do we have? */
for (p = data->notationListHead; p != NULL; p = p->next)
@@ -401,6 +401,14 @@ endDoctypeDecl(void *userData) {
return;
}
+ /* Detect and prevent integer overflow in the multiplication, mirroring
+ the guards in xcsdup() and resolveSystemId() */
+ if (notationCount > SIZE_MAX / sizeof(NotationList *)) {
+ fprintf(stderr, "Unable to sort notations");
+ freeNotations(data);
+ return;
+ }
+
notations = malloc(notationCount * sizeof(NotationList *));
if (notations == NULL) {
fprintf(stderr, "Unable to sort notations");

1
meta/recipes-core/expat/expat_2.6.4.bb
View File

@@ -71,6 +71,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56406-dependent.patch;striplevel=2 \
file://CVE-2026-56406.patch;striplevel=2 \
file://CVE-2026-56409.patch;striplevel=2 \
file://CVE-2026-56411.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"