mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
abef4d0701
This patch applies the complete upstream fix chain for CVE-2026-45409. Commit [1] introduces early domain-length rejection required by [2]. Commit [2] is the v3.14 fix identified by [5], and commit [3] extends the protection to per-label conversions and codec support to complete the v3.15 fix described in [4]. [1] https://github.com/kjd/idna/commit/c0dda4501df5 [2] https://github.com/kjd/idna/commit/628fef84d3ed [3] https://github.com/kjd/idna/commit/e1cb465b6376 [4] https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx [5] https://security-tracker.debian.org/tracker/CVE-2026-45409 (From OE-Core rev: 09773d9d1b44dfe868913b6bb142a728529f62cb) Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
49 lines
2.1 KiB
Diff
49 lines
2.1 KiB
Diff
From fabb538f1885a135e48a60de2e3c656d965e861d Mon Sep 17 00:00:00 2001
|
|
From: Kim Davies <kim@cynosure.com.au>
|
|
Date: Sun, 10 May 2026 12:44:47 -0700
|
|
Subject: [PATCH 2/3] Use valid_string_length() for early oversized-input check
|
|
|
|
CVE: CVE-2026-45409
|
|
Upstream-Status: Backport [https://github.com/kjd/idna/commit/628fef84d3eda59321c21127e73dcd873db23ead]
|
|
|
|
(cherry picked from commit 628fef84d3eda59321c21127e73dcd873db23ead)
|
|
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
|
|
---
|
|
idna/core.py | 16 ++++++----------
|
|
1 file changed, 6 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/idna/core.py b/idna/core.py
|
|
index a549326..4a9fc75 100644
|
|
--- a/idna/core.py
|
|
+++ b/idna/core.py
|
|
@@ -341,12 +341,9 @@ def encode(s: Union[str, bytes, bytearray], strict: bool = False, uts46: bool =
|
|
if uts46:
|
|
s = uts46_remap(s, std3_rules, transitional)
|
|
|
|
- # Reject inputs that exceed the maximum DNS domain length up-front.
|
|
- # Each codepoint in a U-label contributes at least one octet to its
|
|
- # A-label form, so any input longer than the domain limit cannot
|
|
- # produce a valid A-domain. Short-circuiting here prevents per-label
|
|
- # validation from being driven into quadratic time
|
|
- if len(s) > 254:
|
|
+ # Reject inputs that exceed the maximum DNS domain length up-front
|
|
+ # to avoid expensive computation on long inputs.
|
|
+ if not valid_string_length(s, trailing_dot=True):
|
|
raise IDNAError("Domain too long")
|
|
|
|
trailing_dot = False
|
|
@@ -382,10 +379,9 @@ def decode(s: Union[str, bytes, bytearray], strict: bool = False, uts46: bool =
|
|
raise IDNAError('Invalid ASCII in A-label')
|
|
if uts46:
|
|
s = uts46_remap(s, std3_rules, False)
|
|
- # See encode() for rationale; the same bound applies because every
|
|
- # legal A-domain is at most 254 octets and every codepoint of a
|
|
- # legal U-domain contributes at least one octet to its A-form.
|
|
- if len(s) > 254:
|
|
+ # Reject inputs that exceed the maximum DNS domain length up-front
|
|
+ # to avoid expensive computation on long inputs.
|
|
+ if not valid_string_length(s, trailing_dot=True):
|
|
raise IDNAError("Domain too long")
|
|
trailing_dot = False
|
|
result = []
|