From: Amaury Couderc <[email protected]> Backport patch to fix CVE-2026-58472.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-58472 https://www.cve.org/CVERecord?id=CVE-2026-58472 https://security-tracker.debian.org/tracker/CVE-2026-58472 https://ubuntu.com/security/CVE-2026-58472 https://osv.dev/list?q=CVE-2026-58472 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812 [nvd] Signed-off-by: Amaury Couderc <[email protected]> --- .../wget/wget/CVE-2026-58472.patch | 73 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 74 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58472.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58472.patch b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch new file mode 100644 index 0000000000..3499f298a9 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58472.patch @@ -0,0 +1,73 @@ +From e4b70d86b2347f03bbe17ae258c68a77cdf6ee52 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= <[email protected]> +Date: Mon, 29 Jun 2026 19:13:15 +0200 +Subject: [PATCH] * src/convert.c (html_quote_string): Fix integer+buffer + overflow + +Reported-by: [email protected] + +CVE: CVE-2026-58472 +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812] + +Signed-off-by: Amaury Couderc <[email protected]> +--- + src/convert.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +diff --git a/src/convert.c b/src/convert.c +index 2e5bc22b..d1cbab88 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -36,6 +36,7 @@ as that of the covered work. */ + #include <unistd.h> + #include <errno.h> + #include <assert.h> ++#include <intprops.h> + #include "convert.h" + #include "url.h" + #include "recur.h" +@@ -1178,21 +1179,37 @@ html_quote_string (const char *s) + { + const char *b = s; + char *p, *res; +- int i; ++ size_t i; ++ int ok; + + /* Pass through the string, and count the new size. */ +- for (i = 0; *s; s++, i++) ++ for (i = 0; *s; s++) + { + if (*s == '&') +- i += 4; /* `amp;' */ ++ ok = INT_ADD_OK (i, 4, &i); /* `amp;' */ + else if (*s == '<' || *s == '>') +- i += 3; /* `lt;' and `gt;' */ ++ ok = INT_ADD_OK (i, 3, &i); /* `lt;' and `gt;' */ + else if (*s == '\"') +- i += 5; /* `quot;' */ ++ ok = INT_ADD_OK (i, 5, &i); /* `quot;' */ + else if (*s == ' ') +- i += 4; /* #32; */ ++ ok = INT_ADD_OK (i, 4, &i); /* #32; */ ++ else ++ ok = INT_ADD_OK (i, 1, &i); ++ ++ if (!ok) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } + } +- res = xmalloc (i + 1); ++ ++ if (!INT_ADD_OK (i, 1, &i)) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } ++ ++ res = xmalloc (i); + s = b; + for (p = res; *s; s++) + { diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index 8d9b983de5..b773081753 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -18,6 +18,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58469.patch \ file://CVE-2026-58470.patch \ file://CVE-2026-58471.patch \ + file://CVE-2026-58472.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241612): https://lists.openembedded.org/g/openembedded-core/message/241612 Mute This Topic: https://lists.openembedded.org/mt/120390812/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
