Backport patch to fix CVE-2026-58471. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58471
Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee Signed-off-by: Ghanshyam Banait <[email protected]> --- .../wget/wget/CVE-2026-58471.patch | 74 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 75 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58471.patch diff --git a/meta/recipes-extended/wget/wget/CVE-2026-58471.patch b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch new file mode 100644 index 0000000000..2477505ff3 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2026-58471.patch @@ -0,0 +1,74 @@ +From c2640fe5171c59f87c58dc9fcb195b2d18b010ee Mon Sep 17 00:00:00 2001 +From: Arkadi Vainbrand <[email protected]> +Date: Tue, 13 Jan 2026 12:22:04 +0200 +Subject: [PATCH] Fix buffer size handling in filename conversion + +* src/url.c (convert_fname): Fix buffer overflow. + +Copyright-paperwork-exempt: Yes + +CVE: CVE-2026-58471 + +Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee] + +Signed-off-by: Arkadi Vainbrand <[email protected]> +Signed-off-by: Ghanshyam Banait <[email protected]> +--- + src/url.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/src/url.c b/src/url.c +index 7540e90f..f334456c 100644 +--- a/src/url.c ++++ b/src/url.c +@@ -1614,7 +1614,7 @@ convert_fname (char *fname) + const char *from_encoding = opt.encoding_remote; + const char *to_encoding = opt.locale; + iconv_t cd; +- size_t len, done, inlen, outlen; ++ size_t len, inlen, outlen; + char *s; + const char *orig_fname; + +@@ -1636,7 +1636,6 @@ convert_fname (char *fname) + inlen = strlen (fname); + len = outlen = inlen * 2; + converted_fname = s = xmalloc (outlen + 1); +- done = 0; + + for (;;) + { +@@ -1644,7 +1643,7 @@ convert_fname (char *fname) + if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0 + && iconv (cd, NULL, NULL, &s, &outlen) == 0) + { +- *(converted_fname + len - outlen - done) = '\0'; ++ *s = '\0'; + iconv_close (cd); + DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n", + orig_fname, from_encoding, converted_fname, to_encoding)); +@@ -1667,10 +1666,17 @@ convert_fname (char *fname) + } + else if (errno == E2BIG) /* Output buffer full */ + { +- done = len; +- len = outlen = done + inlen * 2; +- converted_fname = xrealloc (converted_fname, outlen + 1); +- s = converted_fname + done; ++ size_t used = s - converted_fname; ++ size_t newlen = used + inlen * 2 + 1; ++ ++ /* Ensure we actually grow the buffer */ ++ if (newlen <= len) ++ newlen = len * 2; ++ ++ converted_fname = xrealloc (converted_fname, newlen + 1); ++ len = newlen; ++ s = converted_fname + used; ++ outlen = len - used; + } + else /* Weird, we got an unspecified error */ + { +-- +GitLab + diff --git a/meta/recipes-extended/wget/wget_1.25.0.bb b/meta/recipes-extended/wget/wget_1.25.0.bb index d1dd6a1598..00667a1e24 100644 --- a/meta/recipes-extended/wget/wget_1.25.0.bb +++ b/meta/recipes-extended/wget/wget_1.25.0.bb @@ -20,6 +20,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \ file://CVE-2026-58469-regression_p2.patch \ file://CVE-2026-58472.patch \ file://CVE-2026-58472-regression.patch \ + file://CVE-2026-58471.patch \ " SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784" -- 2.40.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243932): https://lists.openembedded.org/g/openembedded-core/message/243932 Mute This Topic: https://lists.openembedded.org/mt/120857714/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
