mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
f03efa1107
This patch applies the upstream fix referenced by NVD in [2], using the commit shown in [1]. [1] https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56289 (From OE-Core rev: b1540647185015c99fbf421d889547a6c10e7e29) Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 48c1aa91e829a87c398e8c012cde45cd8c1aab0a) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
37 lines
1.2 KiB
Diff
37 lines
1.2 KiB
Diff
From a40c835ab06314526d623e62ae27830d0ad88752 Mon Sep 17 00:00:00 2001
|
||
From: Paul Eggert <eggert@cs.ucla.edu>
|
||
Date: Tue, 21 Apr 2026 13:16:10 -0700
|
||
Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20infloop=20on=20null=20ranges?=
|
||
MIME-Version: 1.0
|
||
Content-Type: text/plain; charset=UTF-8
|
||
Content-Transfer-Encoding: 8bit
|
||
|
||
Problem reported by Michał Majchrowicz.
|
||
* src/patch.c (locate_hunk): Don’t attempt to optimize
|
||
matches of a null range. Instead, apply all the checks
|
||
we apply to non-null ranges.
|
||
|
||
CVE: CVE-2026-56289
|
||
Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9]
|
||
|
||
(cherry picked from commit faba04ef4f2b410257f76c1b9dc85e350929c4b9)
|
||
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
|
||
---
|
||
src/patch.c | 3 ---
|
||
1 file changed, 3 deletions(-)
|
||
|
||
diff --git a/src/patch.c b/src/patch.c
|
||
index b348b5c..0e8d5c9 100644
|
||
--- a/src/patch.c
|
||
+++ b/src/patch.c
|
||
@@ -1146,9 +1146,6 @@ locate_hunk (lin fuzz)
|
||
lin max_offset = MAX(max_pos_offset, max_neg_offset);
|
||
lin min_offset;
|
||
|
||
- if (!pat_lines) /* null range matches always */
|
||
- return first_guess;
|
||
-
|
||
/* Do not try lines <= 0. */
|
||
if (first_guess <= max_neg_offset)
|
||
max_neg_offset = first_guess - 1;
|