From: Daniel Turull <[email protected]> Backport patch to fix CVE-2026-14164.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-14164 Upstream fix: https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8 Tested with ptest: Before: PASSED: 5, FAILED: 0, SKIPPED: 0 After: PASSED: 5, FAILED: 0, SKIPPED: 0 Signed-off-by: Daniel Turull <[email protected]> Signed-off-by: Fabien Thomas <[email protected]> --- .../libarchive/CVE-2026-14164.patch | 53 +++++++++++++++++++ .../libarchive/libarchive_3.8.7.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch new file mode 100644 index 0000000000..b734fc448f --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-14164.patch @@ -0,0 +1,53 @@ +From edbac77e8e544286fe7581bc398781c949ee5a22 Mon Sep 17 00:00:00 2001 +From: "Dustin L. Howett" <[email protected]> +Date: Sun, 24 May 2026 12:43:00 -0500 +Subject: [PATCH] Merge pull request #3071 from stoeckmann/rar5_doublefree + +rar5: Avoid dangling pointers in init_unpack +(cherry picked from commit 42453cf16255800726b4efedab25138639ceef20) + +Conflicts Resolved: + +libarchive/archive_read_support_format_rar5.c (1 conflict): +- The stable branch's init_unpack() already unconditionally NULLs + rar->cstate.window_buf and rar->cstate.filtered_buf right after free() + (the core CVE fix), but still retained the redundant else-branch that + re-NULLed them when window_size <= 0. Removed that dead else-branch to + match the upstream fix, and omitted upstream's added + `if(...== NULL) return ARCHIVE_FATAL;` calloc failure checks, since + init_unpack() is void-returning in this stable version and predates + that hardening. + +Assisted-by: kiro:claude-sonnet-5 + +Changes from upstream commit f774f03b40cb: + - libarchive/archive_read_support_format_rar5.c: adapted from upstream + +CVE: CVE-2026-14164 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/f774f03b40cb109348e5c6d52b59c864e3cfa8e8] + +Signed-off-by: Daniel Turull <[email protected]> +--- + libarchive/archive_read_support_format_rar5.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/libarchive/archive_read_support_format_rar5.c b/libarchive/archive_read_support_format_rar5.c +index 63dd97b3..271aa0cb 100644 +--- a/libarchive/archive_read_support_format_rar5.c ++++ b/libarchive/archive_read_support_format_rar5.c +@@ -2568,12 +2568,12 @@ static void init_unpack(struct rar5* rar) { + free(rar->cstate.window_buf); + free(rar->cstate.filtered_buf); + ++ rar->cstate.window_buf = NULL; ++ rar->cstate.filtered_buf = NULL; ++ + if(rar->cstate.window_size > 0) { + rar->cstate.window_buf = calloc(1, rar->cstate.window_size); + rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size); +- } else { +- rar->cstate.window_buf = NULL; +- rar->cstate.filtered_buf = NULL; + } + + clear_data_ready_stack(rar); diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb index e8c3a3bfe3..ecb13a6772 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb @@ -31,6 +31,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv" SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://run-ptest \ + file://CVE-2026-14164.patch \ " UPSTREAM_CHECK_URI = "https://www.libarchive.org/";
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243360): https://lists.openembedded.org/g/openembedded-core/message/243360 Mute This Topic: https://lists.openembedded.org/mt/120735225/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
