mirror of
https://git.yoctoproject.org/poky
synced 2026-07-30 16:17:49 +02:00
865d0fd2d6
Backport upstream fix for a global buffer overflow in the LZH decompression logic (unlzh.c). The left[] and right[] global arrays shared across LZW and LZH decompression routines are not reinitialized between files processed in the same invocation, allowing an out-of-bounds read in the LZH decoder. Adapted for gzip 1.13: - Refreshed NEWS and THANKS hunks to match 1.13 release context. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41992 (From OE-Core rev: db470c65798b4a90a5c1c333d61f3a531cca75cc) Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit deaaaacabbf8d21fb9271e3f6f83055893510cff) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>