From: Vijay Anusuri <[email protected]> Pick patch according to [2]
[1] https://nvd.nist.gov/vuln/detail/cve-2026-57433 [2] https://security-tracker.debian.org/tracker/CVE-2026-57433 Signed-off-by: Vijay Anusuri <[email protected]> Signed-off-by: Yoann Congal <[email protected]> --- .../perl/files/CVE-2026-57433.patch | 32 +++++++++++++++++++ meta/recipes-devtools/perl/perl_5.42.0.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57433.patch diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57433.patch b/meta/recipes-devtools/perl/files/CVE-2026-57433.patch new file mode 100644 index 00000000000..f0ea08b1fe0 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-57433.patch @@ -0,0 +1,32 @@ +From e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7 Mon Sep 17 00:00:00 2001 +From: "Paul \"LeoNerd\" Evans" <[email protected]> +Date: Sat, 9 May 2026 16:47:14 +0100 +Subject: [PATCH] Storable.xs: Avoid signed int overflow when unpacking a list + of hook data items + +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7] +CVE: CVE-2026-57433 +Signed-off-by: Vijay Anusuri <[email protected]> +--- + dist/Storable/Storable.xs | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs +index 3930db6..62a1a6d 100644 +--- a/dist/Storable/Storable.xs ++++ b/dist/Storable/Storable.xs +@@ -5035,7 +5035,10 @@ static SV *retrieve_hook_common(pTHX_ stcxt_t *cxt, const char *cname, int large + } + else + GETMARK(len3); +- if (len3) { ++ if (len3 == I32_MAX) ++ /* If len3 is exactly I32_MAX it will upset av_extend below */ ++ CROAK(("Invalid count of hook data items")); ++ else if (len3) { + av = newAV(); + av_extend(av, len3 + 1); /* Leave room for [0] */ + AvFILLp(av) = len3; /* About to be filled anyway */ +-- +2.43.0 + diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb b/meta/recipes-devtools/perl/perl_5.42.0.bb index 3469258f727..6f0092c1cc7 100644 --- a/meta/recipes-devtools/perl/perl_5.42.0.bb +++ b/meta/recipes-devtools/perl/perl_5.42.0.bb @@ -22,6 +22,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://CVE-2026-57432-01.patch \ file://CVE-2026-57432-02.patch \ file://CVE-2026-42496.patch \ + file://CVE-2026-57433.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245444): https://lists.openembedded.org/g/openembedded-core/message/245444 Mute This Topic: https://lists.openembedded.org/mt/121158873/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
