mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-06-17 10:53:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

go: patch CVE-2026-42504

Browse Source 
Backport patch from [1]

[1] https://go.dev/cl/774481

(From OE-Core rev: 1556a34831b2d96c8a7862493494f3b9fa10d4a9)

Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Reviewed-by: Bruno Vernay <bruno.vernay@se.com>
Signed-off-by: Jeremy Rosen <jeremy.rosen@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Theo Gaige (Schneider Electric)
2026-05-21 12:09:46 +02:00
committed by Paul Barker
parent 33b725d19b
commit c0b84584be
2 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/go/go-1.22.12.inc
View File

@@ -53,6 +53,7 @@ SRC_URI += "\
file://CVE-2026-39826.patch \
file://CVE-2026-42499.patch \
file://CVE-2026-42501.patch \
file://CVE-2026-42504.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"

58
meta/recipes-devtools/go/go/CVE-2026-42504.patch Normal file
View File

@@ -0,0 +1,58 @@
From 41ca50d68cd74e0a68f3917cd902885c84fedbf7 Mon Sep 17 00:00:00 2001
From: Damien Neil <dneil@google.com>
Date: Tue, 5 May 2026 15:20:34 -0700
Subject: [PATCH] mime: avoid quadratic complexity in WordDecoder.DecodeHeader
When encountering an undecodable encoded-word,
skip over the entire word rather than just the initial "=?".
Fixes #79217
Fixes CVE-2026-42504
Change-Id: I28605faa235459d2ba71bd0f3ae3dce96a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/774481
Reviewed-by: Nicholas Husin <nsh@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Nicholas Husin <husin@google.com>
CVE: CVE-2026-42504
Upstream-Status: Backport [https://github.com/golang/go/commit/f230dd8a1d0a63d73e92685e378dcd725f7aac00]
Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
---
src/mime/encodedword.go | 4 ++--
src/mime/encodedword_test.go | 4 ++++
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/src/mime/encodedword.go b/src/mime/encodedword.go
index e6b470b1fb..a7059f3bc4 100644
--- a/src/mime/encodedword.go
+++ b/src/mime/encodedword.go
@@ -275,8 +275,8 @@ func (d *WordDecoder) DecodeHeader(header string) (string, error) {
content, err := decode(encoding, text)
if err != nil {
betweenWords = false
- buf.WriteString(header[:start+2])
- header = header[start+2:]
+ buf.WriteString(header[:end])
+ header = header[end:]
continue
}
diff --git a/src/mime/encodedword_test.go b/src/mime/encodedword_test.go
index 2a98794380..befc3cd996 100644
--- a/src/mime/encodedword_test.go
+++ b/src/mime/encodedword_test.go
@@ -140,6 +140,10 @@ func TestDecodeHeader(t *testing.T) {
{"=?ISO-8859-1?Q?a?= =?ISO-8859-1?Q?b?=", "ab"},
{"=?ISO-8859-1?Q?a?= \r\n\t =?ISO-8859-1?Q?b?=", "ab"},
{"=?ISO-8859-1?Q?a_b?=", "a b"},
+ // Undecodable words
+ {"=?UTF-8?b?garbage?= =?UTF-8?b?QW5kcsOp?= =?UTF-8?b?garbage?=", "=?UTF-8?b?garbage?= André =?UTF-8?b?garbage?="},
+ {"=?UTF-8?b?QW5kcsOp", "=?UTF-8?b?QW5kcsOp"},
+ {"=?UTF-8?x?y?=?UTF-8?x?y=?", "=?UTF-8?x?y?=?UTF-8?x?y=?"},
}
for _, test := range tests {
--
2.43.0