mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

libarchive: patch CVE-2026-5745

Browse Source 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-5745

(From OE-Core rev: f35b64a303e5c3641a76576e69fe921a4b6166f9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Peter Marko
2026-08-23 14:42:13 +02:00
committed by Richard Purdie
parent fd0ffc6666
commit bf5d6de552
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
meta/recipes-extended/libarchive/libarchive/CVE-2026-5745.patch Normal file
View File

@@ -0,0 +1,39 @@
From 5f7025543205106d64081cbafd8c345bf859b86f Mon Sep 17 00:00:00 2001
From: Tim Kientzle <kientzle@acm.org>
Date: Sat, 18 Apr 2026 21:04:59 -0700
Subject: [PATCH] Merge pull request #2905 from Patsakas/Patsakas-fix-acl-bug
Fix NULL pointer increment in archive_acl_from_text_nl
(Not a security issue, and arguably not really even a bug, but easy to fix regardless.)
(cherry picked from commit 0b0b888f86b46e3b279f5f7c6eef0479f35978ee)
CVE: CVE-2026-5745
Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/5f7025543205106d64081cbafd8c345bf859b86f]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
libarchive/archive_acl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libarchive/archive_acl.c b/libarchive/archive_acl.c
index ab601833..14a107a4 100644
--- a/libarchive/archive_acl.c
+++ b/libarchive/archive_acl.c
@@ -1718,7 +1718,6 @@ archive_acl_from_text_nl(struct archive_acl *acl, const char *text,
tag = 0;
s = field[n].start;
- st = field[n].start + 1;
len = field[n].end - field[n].start;
if (len == 0) {
@@ -1726,6 +1725,8 @@ archive_acl_from_text_nl(struct archive_acl *acl, const char *text,
continue;
}
+ st = s + 1;
+
switch (*s) {
case 'u':
if (len == 1 || (len == 4

1
meta/recipes-extended/libarchive/libarchive_3.7.9.bb
View File

@@ -50,6 +50,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \
file://CVE-2026-4424-1.patch \
file://CVE-2026-4424-2.patch \
file://CVE-2026-5121-02.patch \
file://CVE-2026-5745.patch \
"
UPSTREAM_CHECK_URI = "http://libarchive.org/"