From: Peter Marko <[email protected]> Pick patch listed in NVD CVE report.
Signed-off-by: Peter Marko <[email protected]> --- .../alsa/alsa-lib/CVE-2026-56109.patch | 33 +++++++++++++++++++ .../alsa/alsa-lib_1.2.15.3.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-56109.patch diff --git a/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-56109.patch b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-56109.patch new file mode 100644 index 0000000000..c6ecc837f8 --- /dev/null +++ b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-56109.patch @@ -0,0 +1,33 @@ +From 536dd6f8affdf5197c12a63a71c92a70b2833cc0 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela <[email protected]> +Date: Mon, 8 Jun 2026 14:33:19 +0200 +Subject: [PATCH] conf: add missing return value check in parse_def() + +A malformed configuration may cause SIGSEGV. + +Link: https://lore.kernel.org/alsa-devel/cagt8pqbu0p2vob+qhxwgcnjrkhacbhayhuubplbn-yj_siv...@mail.gmail.com/ +Reported-by: Luigino Camastra <[email protected]> +Signed-off-by: Jaroslav Kysela <[email protected]> + +CVE: CVE-2026-56109 +Upstream-Status: Backport [https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0] +Signed-off-by: Peter Marko <[email protected]> +--- + src/conf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/conf.c b/src/conf.c +index b0dd6298..e1dba23d 100644 +--- a/src/conf.c ++++ b/src/conf.c +@@ -1485,6 +1485,10 @@ static int parse_def(snd_config_t *parent, input_t *input, int skip, int overrid + endchr = ']'; + } + c = get_nonwhite(input); ++ if (c < 0) { ++ err = c; ++ goto __end; ++ } + if (c != endchr) { + if (n) + snd_config_delete(n); diff --git a/meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb b/meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb index 1ebb356925..04976f3bf7 100644 --- a/meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb +++ b/meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a916467b91076e631dd8edb7424769c7 \ SRC_URI = "https://www.alsa-project.org/files/pub/lib/${BP}.tar.bz2"; SRC_URI += "file://CVE-2026-25068.patch" +SRC_URI += "file://CVE-2026-56109.patch" SRC_URI[sha256sum] = "7b079d614d582cade7ab8db2364e65271d0877a37df8757ac4ac0c8970be861e" inherit autotools pkgconfig
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244002): https://lists.openembedded.org/g/openembedded-core/message/244002 Mute This Topic: https://lists.openembedded.org/mt/120880609/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
