On Wed, 2026-09-02 at 11:18 +0200, Yoann Congal wrote: > On Mon Aug 17, 2026 at 12:59 PM CEST, Daniel Turull via > lists.openembedded.org wrote: > > From: Daniel Turull <[email protected]> > > > > - The RAR5 double-free in init_unpack() is a regression introduced > > upstream by commit 620bdafa on 2026-05-16 and existed only > > on the git master branch until it was fixed by PR #3071 (commit > > 1c914cdf) on 2026-05-24. It was never part of an upstream release. > > - The upstream release tarballs (3.6.x/3.7.x/3.8.6) use the older > > init_unpack() with unchecked calloc and no early-return path, so the > > freed window_buf/filtered_buf pointers are never left dangling and the > > double-free cannot occur. > > > > References: > > > > > > Signed-off-by: Daniel Turull <[email protected]> > > --- > > meta/recipes-extended/libarchive/libarchive_3.8.7.bb | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb > > b/meta/recipes- > > extended/libarchive/libarchive_3.8.7.bb > > index e8c3a3bfe3..0926acd8f9 100644 > > --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb > > +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb > > @@ -92,3 +92,7 @@ RDEPENDS:${PN}-ptest += "bsdtar bsdcpio" > > CVE_STATUS[CVE-2026-4426] = "fixed-version: fixed since 3.8.7" > > CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7" > > CVE_STATUS[CVE-2026-5745] = "fixed-version: fixed since 3.8.6" > > +CVE_STATUS[CVE-2026-14164] = "not-applicable-platform: Double-free > > regression in the RAR5\ > > + reader's init_unpack() was introduced upstream by commit 620bdafa > > (2026-05-16) and existed\ > > + only on the git master branch until the fix in PR #3071 (commit 1c914cdf, > > 2026-05-24). It was\ > > + never part of an upstream release tarball." > > Hello, > > I don't think not-applicable-platform is the right flag for this > CVE_STATUS. See cve-check-map.conf[0]: > > [not-applicable-platform] use when vulnerability affects other platform > > (e.g. Windows or Debian) > > How about "fixed-version"?
Sure. I'll send a v2 with it. also for scarthgap Daniel
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244965): https://lists.openembedded.org/g/openembedded-core/message/244965 Mute This Topic: https://lists.openembedded.org/mt/120788176/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
