Pick patch according to [2] [1] https://nvd.nist.gov/vuln/detail/cve-2026-57433 [2] https://security-tracker.debian.org/tracker/CVE-2026-57433
Signed-off-by: Vijay Anusuri <[email protected]> --- .../perl/files/CVE-2026-57433.patch | 32 +++++++++++++++++++ meta/recipes-devtools/perl/perl_5.42.0.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57433.patch diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57433.patch b/meta/recipes-devtools/perl/files/CVE-2026-57433.patch new file mode 100644 index 0000000000..f0ea08b1fe --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-57433.patch @@ -0,0 +1,32 @@ +From e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7 Mon Sep 17 00:00:00 2001 +From: "Paul \"LeoNerd\" Evans" <[email protected]> +Date: Sat, 9 May 2026 16:47:14 +0100 +Subject: [PATCH] Storable.xs: Avoid signed int overflow when unpacking a list + of hook data items + +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7] +CVE: CVE-2026-57433 +Signed-off-by: Vijay Anusuri <[email protected]> +--- + dist/Storable/Storable.xs | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs +index 3930db6..62a1a6d 100644 +--- a/dist/Storable/Storable.xs ++++ b/dist/Storable/Storable.xs +@@ -5035,7 +5035,10 @@ static SV *retrieve_hook_common(pTHX_ stcxt_t *cxt, const char *cname, int large + } + else + GETMARK(len3); +- if (len3) { ++ if (len3 == I32_MAX) ++ /* If len3 is exactly I32_MAX it will upset av_extend below */ ++ CROAK(("Invalid count of hook data items")); ++ else if (len3) { + av = newAV(); + av_extend(av, len3 + 1); /* Leave room for [0] */ + AvFILLp(av) = len3; /* About to be filled anyway */ +-- +2.43.0 + diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb b/meta/recipes-devtools/perl/perl_5.42.0.bb index 73230ab175..180c3d1f64 100644 --- a/meta/recipes-devtools/perl/perl_5.42.0.bb +++ b/meta/recipes-devtools/perl/perl_5.42.0.bb @@ -21,6 +21,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://CVE-2026-13221.patch \ file://CVE-2026-57432-1.patch \ file://CVE-2026-57432-2.patch \ + file://CVE-2026-57433.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \ -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244467): https://lists.openembedded.org/g/openembedded-core/message/244467 Mute This Topic: https://lists.openembedded.org/mt/120953097/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
