Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package google-guest-agent for openSUSE:Factory checked in at 2026-07-23 23:16:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/google-guest-agent (Old) and /work/SRC/openSUSE:Factory/.google-guest-agent.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "google-guest-agent" Thu Jul 23 23:16:08 2026 rev:66 rq:1367486 version:20260529.00 Changes: -------- --- /work/SRC/openSUSE:Factory/google-guest-agent/google-guest-agent.changes 2026-07-21 23:01:30.431998804 +0200 +++ /work/SRC/openSUSE:Factory/.google-guest-agent.new.2004/google-guest-agent.changes 2026-07-23 23:18:58.606516308 +0200 @@ -1,0 +2,7 @@ +Thu Jul 23 14:55:42 UTC 2026 - Markéta Machová <[email protected]> + +- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on + truncated/invalid UTF-8 input (bsc#1272118) + * CVE-2026-56852.patch + +------------------------------------------------------------------- New: ---- CVE-2026-56852.patch ----------(New B)---------- New: truncated/invalid UTF-8 input (bsc#1272118) * CVE-2026-56852.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ google-guest-agent.spec ++++++ --- /var/tmp/diff_new_pack.AvXx9G/_old 2026-07-23 23:18:59.318541251 +0200 +++ /var/tmp/diff_new_pack.AvXx9G/_new 2026-07-23 23:18:59.322541392 +0200 @@ -31,6 +31,8 @@ Patch0: disable_google_dhclient_script.patch # PATCH-FIX-UPSTREAM - golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation Patch1: CVE-2026-39821.patch +# PATCH-FIX-UPSTREAM - golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input +Patch2: CVE-2026-56852.patch BuildRequires: golang(API) = 1.26 Requires: google-guest-configs Requires: google-guest-oslogin >= 20231003 @@ -47,6 +49,9 @@ pushd vendor/golang.org/x/net %patch -P 1 -p1 popd +pushd vendor/golang.org/x/text +%patch -P 2 -p1 +popd %build %ifnarch ppc64 ++++++ CVE-2026-56852.patch ++++++ >From 5ae8e578e495731553eddba11b2d0e86c91a00ce Mon Sep 17 00:00:00 2001 From: Damien Neil <[email protected]> Date: Tue, 14 Apr 2026 21:46:24 -0400 Subject: [PATCH] unicode/norm: avoid infinite loop on invalid input Invalid characters are given a Properties with a size of 0. The nextComposed function can enter an infinite loop when encountering an invalid character, since it advances its input by the (possibly 0) character size. Rather than finding every place which might assume characters have a non-zero size, change compInfo to return a size-1 Properties for invalid characters and use the property flags to record validity. Fixes golang/go#80142 Change-Id: Ie0791faefeddc1e8f671b0ed73f29e906a6a6964 Reviewed-on: https://go-review.googlesource.com/c/text/+/794100 LUCI-TryBot-Result: [email protected] <[email protected]> Auto-Submit: Damien Neil <[email protected]> Reviewed-by: Neal Patel <[email protected]> Reviewed-by: Neal Patel <[email protected]> --- unicode/norm/forminfo.go | 9 ++++++++- unicode/norm/iter.go | 8 ++------ unicode/norm/normalize.go | 20 ++++++++++---------- unicode/norm/normalize_test.go | 5 +++++ 4 files changed, 25 insertions(+), 17 deletions(-) diff --git a/unicode/norm/forminfo.go b/unicode/norm/forminfo.go index f3a234e5f..b3cf5d9bd 100644 --- a/unicode/norm/forminfo.go +++ b/unicode/norm/forminfo.go @@ -121,8 +121,12 @@ func (p Properties) BoundaryAfter() bool { // // When all 6 bits are zero, the character is inert, meaning it is never // influenced by normalization. +// +// We set flags to 0x80 (high bit 7 unused in quick check data) to indicate an invalid rune. type qcInfo uint8 +func (p Properties) isInvalid() bool { return p.flags == 0x80 } + func (p Properties) isYesC() bool { return p.flags&0x10 == 0 } func (p Properties) isYesD() bool { return p.flags&0x4 == 0 } @@ -247,6 +251,9 @@ func (f Form) PropertiesString(s string) Properties { // to a Properties. See the comment at the top of the file // for more information on the format. func compInfo(v uint16, sz int) Properties { + if sz == 0 { + return Properties{flags: 0x80, size: 1} + } if v == 0 { return Properties{size: uint8(sz)} } else if v >= 0x8000 { @@ -254,7 +261,7 @@ func compInfo(v uint16, sz int) Properties { size: uint8(sz), ccc: uint8(v), tccc: uint8(v), - flags: qcInfo(v >> 8), + flags: qcInfo(v>>8) & 0x3f, } if p.ccc > 0 || p.combinesBackward() { p.nLead = uint8(p.flags & 0x3) diff --git a/unicode/norm/iter.go b/unicode/norm/iter.go index 417c6b268..3cc059224 100644 --- a/unicode/norm/iter.go +++ b/unicode/norm/iter.go @@ -376,16 +376,12 @@ func nextComposed(i *Iter) []byte { goto doNorm } prevCC = i.info.tccc - sz := int(i.info.size) - if sz == 0 { - sz = 1 // illegal rune: copy byte-by-byte - } - p := outp + sz + p := outp + int(i.info.size) if p > len(i.buf) { break } outp = p - i.p += sz + i.p += int(i.info.size) if i.p >= i.rb.nsrc { i.setDone() break diff --git a/unicode/norm/normalize.go b/unicode/norm/normalize.go index 4747ad07a..60b1511ca 100644 --- a/unicode/norm/normalize.go +++ b/unicode/norm/normalize.go @@ -148,7 +148,7 @@ func (f Form) IsNormalString(s string) bool { // patched buffer and whether the decomposition is still in progress. func patchTail(rb *reorderBuffer) bool { info, p := lastRuneStart(&rb.f, rb.out) - if p == -1 || info.size == 0 { + if p == -1 || info.isInvalid() { return true } end := p + int(info.size) @@ -225,7 +225,7 @@ func doAppend(rb *reorderBuffer, out []byte, p int) []byte { } fd := &rb.f if doMerge { - var info Properties + info := Properties{flags: 0x80, size: 1} // invalid rune if p < n { info = fd.info(src, p) if !info.BoundaryBefore() || info.nLeadingNonStarters() > 0 { @@ -235,7 +235,7 @@ func doAppend(rb *reorderBuffer, out []byte, p int) []byte { p = decomposeSegment(rb, p, true) } } - if info.size == 0 { + if info.isInvalid() { rb.doFlush() // Append incomplete UTF-8 encoding. return src.appendSlice(rb.out, p, n) @@ -314,7 +314,7 @@ func (f *formInfo) quickSpan(src input, i, end int, atEOF bool) (n int, ok bool) continue } info := f.info(src, i) - if info.size == 0 { + if info.isInvalid() { if atEOF { // include incomplete runes return n, true @@ -379,7 +379,7 @@ func (f Form) firstBoundary(src input, nsrc int) int { // CGJ insertion points correctly. Luckily it doesn't have to. for { info := fd.info(src, i) - if info.size == 0 { + if info.isInvalid() { return -1 } if s := ss.next(info); s != ssSuccess { @@ -424,7 +424,7 @@ func (f Form) nextBoundary(src input, nsrc int, atEOF bool) int { } fd := formTable[f] info := fd.info(src, 0) - if info.size == 0 { + if info.isInvalid() { if atEOF { return 1 } @@ -435,7 +435,7 @@ func (f Form) nextBoundary(src input, nsrc int, atEOF bool) int { for i := int(info.size); i < nsrc; i += int(info.size) { info = fd.info(src, i) - if info.size == 0 { + if info.isInvalid() { if atEOF { return i } @@ -465,7 +465,7 @@ func lastBoundary(fd *formInfo, b []byte) int { if p == -1 { return -1 } - if info.size == 0 { // ends with incomplete rune + if info.isInvalid() { // ends with incomplete rune if p == 0 { // starts with incomplete rune return -1 } @@ -504,7 +504,7 @@ func lastBoundary(fd *formInfo, b []byte) int { func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int { // Force one character to be consumed. info := rb.f.info(rb.src, sp) - if info.size == 0 { + if info.isInvalid() { return 0 } if s := rb.ss.next(info); s == ssStarter { @@ -528,7 +528,7 @@ func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int { break } info = rb.f.info(rb.src, sp) - if info.size == 0 { + if info.isInvalid() { if !atEOF { return int(iShortSrc) }
