Control: tags 1146714 + patch Dear maintainer,
I've prepared an NMU for libre (versioned as 2.0.1-3.1) and uploaded it to DELAYED/2. Please feel free to tell me if I should cancel it. cu Adrian
diffstat for libre-2.0.1 libre-2.0.1 changelog | 8 ++ patches/0001-websock-Fix-integer-overflow-in-websock_decode-maske.patch | 36 ++++++++++ patches/series | 1 3 files changed, 45 insertions(+) diff -Nru libre-2.0.1/debian/changelog libre-2.0.1/debian/changelog --- libre-2.0.1/debian/changelog 2024-11-07 22:06:08.000000000 +0200 +++ libre-2.0.1/debian/changelog 2026-10-18 19:55:04.000000000 +0300 @@ -1,3 +1,11 @@ +libre (2.0.1-3.1) unstable; urgency=medium + + * Non-maintainer upload. + * CVE-2026-50161: Integer overflow in websock_decode() + (Closes: #1146714) + + -- Adrian Bunk <[email protected]> Sun, 18 Oct 2026 19:55:04 +0300 + libre (2.0.1-3) unstable; urgency=medium * Team upload diff -Nru libre-2.0.1/debian/patches/0001-websock-Fix-integer-overflow-in-websock_decode-maske.patch libre-2.0.1/debian/patches/0001-websock-Fix-integer-overflow-in-websock_decode-maske.patch --- libre-2.0.1/debian/patches/0001-websock-Fix-integer-overflow-in-websock_decode-maske.patch 1970-01-01 02:00:00.000000000 +0200 +++ libre-2.0.1/debian/patches/0001-websock-Fix-integer-overflow-in-websock_decode-maske.patch 2026-10-18 19:55:04.000000000 +0300 @@ -0,0 +1,36 @@ +From d381f643d2b2229cbe5d4bcf455dbbe87f20e539 Mon Sep 17 00:00:00 2001 +From: Tristan <[email protected]> +Date: Thu, 28 May 2026 16:32:12 +0200 +Subject: websock: Fix integer overflow in websock_decode() masked frame length + check (#1584) + +When a masked WebSocket frame uses the 64-bit extended length encoding +with a value close to UINT64_MAX, the bounds check expression +(4 + hdr->len) wraps to a small value due to unsigned overflow. This +causes the check to pass, and the subsequent XOR unmasking loop writes +past the end of the buffer. + +Add an explicit overflow guard before the addition. If hdr->len exceeds +SIZE_MAX - 4, the frame is rejected as too large before the overflowing +addition can occur. +--- + src/websock/websock.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/websock/websock.c b/src/websock/websock.c +index a9ee2bd4..0c57a109 100644 +--- a/src/websock/websock.c ++++ b/src/websock/websock.c +@@ -204,7 +204,8 @@ static int websock_decode(struct websock_hdr *hdr, struct mbuf *mb) + + if (hdr->mask) { + +- if (mbuf_get_left(mb) < (4 + hdr->len)) ++ if (hdr->len > SIZE_MAX - 4 || ++ mbuf_get_left(mb) < (4 + hdr->len)) + return ENODATA; + + hdr->mkey[0] = mbuf_read_u8(mb); +-- +2.47.3 + diff -Nru libre-2.0.1/debian/patches/series libre-2.0.1/debian/patches/series --- libre-2.0.1/debian/patches/series 2024-11-07 22:02:16.000000000 +0200 +++ libre-2.0.1/debian/patches/series 2026-10-18 19:55:04.000000000 +0300 @@ -1,3 +1,4 @@ 1001_system_header_locations.patch 1002_remove_SYSROOT.patch 1003_remove_MACHINE.patch +0001-websock-Fix-integer-overflow-in-websock_decode-maske.patch
