NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31912
Upstream-commit: 
https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9
Signed-off-by: Jaipaul Cheernam <[email protected]>
---
 .../libpcap/libpcap/02-CVE-2026-31912.patch   | 520 ++++++++++++++++++
 .../libpcap/libpcap_1.10.4.bb                 |   1 +
 2 files changed, 521 insertions(+)
 create mode 100644 
meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch

diff --git a/meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch 
b/meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch
new file mode 100644
index 0000000000..1173a4f9d7
--- /dev/null
+++ b/meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch
@@ -0,0 +1,520 @@
+From d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9 Mon Sep 17 00:00:00 2001
+From: Denis Ovsienko <[email protected]>
+Date: Thu, 30 Jul 2026 13:33:55 +0100
+Subject: [PATCH] CVE-2026-31912: Mind the program bounds in 
pcap_offline_filter().
+
+The current revision of pcapint_filter_with_aux_data() does not know the
+number of instructions in the filter program, it assumes the program
+counter always remains within the bounds of the provided filter program
+and always reaches a return instruction.  This holds for programs that
+have been generated or validated by libpcap.
+
+However, this does not necessarily hold for programs that come from an
+external source via pcap_offline_filter() or [deprecated] bpf_filter()
+and have not been explicitly validated.  If the interpreter executes
+such a program and advances the program counter beyond the last
+instruction, it will be interpreting memory space after the filter
+program as BPF instructions, which in the current implementation will
+eventually cause either abort() (another commit addresses that) or
+SIGSEGV.
+
+To fix the latter problem, in pcapint_filter_with_aux_data() add a
+parameter for the number of instructions in the program and reject the
+packet as soon as (or just before) the program counter goes out of
+bounds.  Update all incoming code paths to specify the length; also in
+pcap_offline_filter(3PCAP) make it clear the function now requires the
+'bf_len' member to be set correctly and uses it.
+
+(backported from commit d1209988c74dd9330659898d3b676ee6bbe1c551)
+
+(cherry picked from commit d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9)
+
+Upstream-Status: Backport 
[https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9]
+CVE: CVE-2026-31912
+Signed-off-by: Jaipaul Cheernam <[email protected]>
+---
+diff --git a/bpf_filter.c b/bpf_filter.c
+index fa82d1d0..dec336ea 100644
+--- a/bpf_filter.c
++++ b/bpf_filter.c
+@@ -72,6 +72,24 @@ enum {
+         BPF_S_ANC_VLAN_TAG_PRESENT,
+ };
+ 
++/*
++ * Kernel BPF implementations tend to define BPF_MAXINSNS to 512 or 4096, the
++ * userland interpreter in libpcap is meant to support much longer filter
++ * programs.  In the latter case it is important that BPF_MAXINSNS does not
++ * interfere with the safety checks in the validator and the interpreter:
++ *   (BPF_MAXINSNS + UINT8_MAX) * sizeof(struct bpf_insn) < UINT32_MAX
++ * It makes the most sense to be able to interpret as many instructions as
++ * pcap_compile() can produce, without optimization, for a valid filter
++ * expression before it consumes as much memory as the current definitions of
++ * NCHUNKS and CHUNKSIZE() allow.  For some expressions this can be almost
++ * 1.53 million instructions on a 64-bit machine and twice as many on a 32-bit
++ * machine.
++ */
++#ifdef BPF_MAXINSNS
++#undef BPF_MAXINSNS
++#endif
++#define BPF_MAXINSNS 3060000U
++
+ /*
+  * Execute the filter program starting at pc on the packet p
+  * wirelen is the length of the original packet
+@@ -86,12 +104,14 @@ enum {
+  */
+ #if defined(SKF_AD_VLAN_TAG_PRESENT)
+ u_int
+-pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_char *p,
+-    u_int wirelen, u_int buflen, const struct pcap_bpf_aux_data *aux_data)
++pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen,
++    const u_char *p, const u_int wirelen, const u_int buflen,
++    const struct pcap_bpf_aux_data *aux_data)
+ #else
+ u_int
+-pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_char *p,
+-    u_int wirelen, u_int buflen, const struct pcap_bpf_aux_data *aux_data _U_)
++pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen,
++    const u_char *p, const u_int wirelen, const u_int buflen,
++    const struct pcap_bpf_aux_data *aux_data _U_)
+ #endif
+ {
+       register uint32_t A, X;
+@@ -101,13 +121,36 @@ pcap_filter_with_aux_data(const struct bpf_insn *pc, 
const u_char *p,
+       if (pc == 0)
+               /*
+                * No filter means accept all.
++               * In this case the value of 'proglen' is irrelevant.
+                */
+               return (u_int)-1;
++      if (proglen < 1 || proglen > BPF_MAXINSNS)
++              return 0;
++
++      /*
++       * Require the current instruction pointer not to overflow for both the
++       * filter program (where the pointer will be dereferenced) and an
++       * immediately following margin (where it will be not).  So long as the
++       * margin is large enough to represent the destination of any single
++       * conditional [forward] jump from within the filter program, a single
++       * guard prevents all filter program over-read attempts that result
++       * from the program running out of instructions before a BPF_RET or a
++       * conditional jump directing the interpreter beyond the program end.
++       * Unconditional jumps mean a larger problem space, which the BPF_JA
++       * case below addresses separately.
++       */
++      const struct bpf_insn *pcend = pc + proglen;
++      if (pcend + UINT8_MAX < pc)
++              return 0;
++
+       A = 0;
+       X = 0;
++      const struct bpf_insn *pc0 = pc;
+       --pc;
+       for (;;) {
+               ++pc;
++              if (pc >= pcend)
++                      return 0;
+               switch (pc->code) {
+ 
+               default:
+@@ -243,6 +286,40 @@ DIAG_ON_DEFAULT_ONLY_SWITCH
+                       continue;
+ 
+               case BPF_JMP|BPF_JA:
++                      /*
++                       * The pointer (pc) decrements and increments in units
++                       * of sizeof(struct bpf_insn) == 8 bytes.  The number
++                       * of units is in the [INT32_MIN, INT32_MAX] interval,
++                       * hence the result can point before the beginning or
++                       * beyond the end of the filter program and can under-
++                       * or overflow; also on 32-bit architectures it can
++                       * under- or overflow more than once and can test
++                       * negative for underflow, overflow and out-of-range
++                       * conditions after under- or overflowing at least
++                       * once.
++                       *
++                       * However, it has been verified above that the program
++                       * length is sufficiently small and the pointer does
++                       * not wrap within the bounds of the filter program, so
++                       * there is a one-to-one correspondence between BPF
++                       * program counter values [0, proglen) and all valid
++                       * values of the pointer.  In other words, after this
++                       * unconditional jump the pointer arithmetic result
++                       * will be valid iff BPF program counter value will be
++                       * valid.  For the latter problem the solution is
++                       * almost the same as in the validator.
++                       *
++                       * The main difference is that here the current value
++                       * of BPF program counter is not a 32-bit unsigned
++                       * variable, but a ptrdiff_t expression, which is
++                       * 64-bit signed on 64-bit architectures and 32-bit
++                       * signed on 32-bit architectures.  However, the cast
++                       * to 32-bit unsigned is safe in both cases because:
++                       * pc0 <= pc < pc0 + proglen, therefore:
++                       * 0 <= pc - pc0 < proglen <= BPF_MAXINSNS < INT32_MAX
++                       */
++                      if ((bpf_u_int32)(pc - pc0) + 1 + pc->k >= proglen)
++                              return 0;
+                       /*
+                        * XXX - we currently implement "ip6 protochain"
+                        * with backward jumps, so sign-extend pc->k.
+@@ -396,10 +473,10 @@ DIAG_ON_DEFAULT_ONLY_SWITCH
+ }
+ 
+ u_int
+-pcap_filter(const struct bpf_insn *pc, const u_char *p, u_int wirelen,
+-    u_int buflen)
++pcap_filter(const struct bpf_insn *pc, const u_int proglen, const u_char *p,
++    u_int wirelen, u_int buflen)
+ {
+-      return pcap_filter_with_aux_data(pc, p, wirelen, buflen, NULL);
++      return pcap_filter_with_aux_data(pc, proglen, p, wirelen, buflen, NULL);
+ }
+ 
+ /*
+@@ -419,7 +496,7 @@ pcap_validate_filter(const struct bpf_insn *f, int len)
+       u_int i, from;
+       const struct bpf_insn *p;
+ 
+-      if (len < 1)
++      if (len < 1 || (u_int)len > BPF_MAXINSNS || f + len < f)
+               return 0;
+ 
+       for (i = 0; i < (u_int)len; ++i) {
+@@ -485,33 +562,45 @@ pcap_validate_filter(const struct bpf_insn *f, int len)
+               case BPF_JMP:
+                       /*
+                        * Check that jumps are within the code block,
+-                       * and that unconditional branches don't go
+-                       * backwards as a result of an overflow.
++                       * regardless of the direction.  libpcap uses
++                       * backward jumps to implement the "protochain"
++                       * primitive.  All offsets that mean a backward
++                       * jump in libpcap (whether in-range or not) in
++                       * kernel BPF implementations mean out-of-range
++                       * or overflow forward jumps -- kernel
++                       * implementations must reject that.
++                       *
+                        * Unconditional branches have a 32-bit offset,
+                        * so they could overflow; we check to make
+                        * sure they don't.  Conditional branches have
+                        * an 8-bit offset, and the from address is <=
+-                       * BPF_MAXINSNS, and we assume that BPF_MAXINSNS
++                       * BPF_MAXINSNS, and we know that BPF_MAXINSNS
+                        * is sufficiently small that adding 255 to it
+                        * won't overflow.
+                        *
+                        * We know that len is <= BPF_MAXINSNS, and we
+-                       * assume that BPF_MAXINSNS is < the maximum size
++                       * know that BPF_MAXINSNS is < the maximum value
+                        * of a u_int, so that i + 1 doesn't overflow.
+-                       *
+-                       * For userland, we don't know that the from
+-                       * or len are <= BPF_MAXINSNS, but we know that
+-                       * from <= len, and, except on a 64-bit system,
+-                       * it's unlikely that len, if it truly reflects
+-                       * the size of the program we've been handed,
+-                       * will be anywhere near the maximum size of
+-                       * a u_int.  We also don't check for backward
+-                       * branches, as we currently support them in
+-                       * userland for the protochain operation.
+                        */
+                       from = i + 1;
+                       switch (BPF_OP(p->code)) {
+                       case BPF_JA:
++                              /*
++                               * So long as both 'from' and bpf_insn.k are
++                               * 32-bit unsigned, this check rejects any jump
++                               * offset that points outside of the valid BPF
++                               * address space of the filter program no
++                               * matter whether signed interpretation of the
++                               * offset is positive or negative.
++                               *
++                               * Note that this condition is necessary, but
++                               * not sufficient to get correct results from
++                               * respective pointer arithmetic in the process
++                               * address space.  Other necessary conditions
++                               * are that BPF_MAXINSNS is correctly defined
++                               * and enforced, and that the pointer does not
++                               * overflow.
++                               */
+                               if (from + p->k >= (u_int)len)
+                                       return 0;
+                               break;
+@@ -539,12 +628,14 @@ pcap_validate_filter(const struct bpf_insn *f, int len)
+ 
+ /*
+  * Exported because older versions of libpcap exported them.
++ * This function is deprecated and unsafe, use pcap_offline_filter() instead.
+  */
+ u_int
+ bpf_filter(const struct bpf_insn *pc, const u_char *p, u_int wirelen,
+     u_int buflen)
+ {
+-      return pcap_filter(pc, p, wirelen, buflen);
++      // The actual length of the filter program is not known.
++      return pcap_filter(pc, BPF_MAXINSNS, p, wirelen, buflen);
+ }
+ 
+ int
+diff --git a/dlpisubs.c b/dlpisubs.c
+index 6815b0ec..790acf28 100644
+--- a/dlpisubs.c
++++ b/dlpisubs.c
+@@ -195,7 +195,8 @@ pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char 
*user,
+               bufp += caplen;
+ #endif
+               ++pd->stat.ps_recv;
+-              if (pcap_filter(p->fcode.bf_insns, pk, origlen, caplen)) {
++              if (pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++                                 pk, origlen, caplen)) {
+ #ifdef HAVE_SYS_BUFMOD_H
+                       pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
+                       pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
+diff --git a/pcap-bpf.c b/pcap-bpf.c
+index 2898e598..04b5620d 100644
+--- a/pcap-bpf.c
++++ b/pcap-bpf.c
+@@ -1255,7 +1255,8 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, 
u_char *user)
+ #endif
+                */
+               if (pb->filtering_in_kernel ||
+-                  pcap_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, 
caplen)) {
++                  pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++                                 datap, bhp->bh_datalen, caplen)) {
+                       struct pcap_pkthdr pkthdr;
+ #ifdef BIOCSTSTAMP
+                       struct bintime bt;
+diff --git a/pcap-bt-linux.c b/pcap-bt-linux.c
+index c7bfef1d..dcf3b575 100644
+--- a/pcap-bt-linux.c
++++ b/pcap-bt-linux.c
+@@ -394,7 +394,8 @@ bt_read_linux(pcap_t *handle, int max_packets _U_, 
pcap_handler callback, u_char
+       pkth.caplen+=sizeof(pcap_bluetooth_h4_header);
+       pkth.len = pkth.caplen;
+       if (handle->fcode.bf_insns == NULL ||
+-          pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, pkth.caplen)) {
++          pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++                         pktd, pkth.len, pkth.caplen)) {
+               callback(user, &pkth, pktd);
+               return 1;
+       }
+diff --git a/pcap-bt-monitor-linux.c b/pcap-bt-monitor-linux.c
+index 206e65b5..3f9d5b49 100644
+--- a/pcap-bt-monitor-linux.c
++++ b/pcap-bt-monitor-linux.c
+@@ -151,7 +151,8 @@ bt_monitor_read(pcap_t *handle, int max_packets _U_, 
pcap_handler callback, u_ch
+     bthdr->opcode = htons(hdr.opcode);
+ 
+     if (handle->fcode.bf_insns == NULL ||
+-        pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, pkth.caplen)) {
++        pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++                       pktd, pkth.len, pkth.caplen)) {
+         callback(user, &pkth, pktd);
+         return 1;
+     }
+diff --git a/pcap-dag.c b/pcap-dag.c
+index f261ead0..c3fe1dbd 100644
+--- a/pcap-dag.c
++++ b/pcap-dag.c
+@@ -668,8 +668,9 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char 
*user)
+                       caplen = p->snapshot;
+ 
+               /* Run the packet filter if there is one. */
+-              if ((p->fcode.bf_insns == NULL) || 
pcap_filter(p->fcode.bf_insns, dp, packet_len, caplen)) {
+-
++              if (p->fcode.bf_insns == NULL ||
++                  pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++                                 dp, packet_len, caplen)) {
+                       /* convert between timestamp formats */
+                       register unsigned long long ts;
+ 
+diff --git a/pcap-dbus.c b/pcap-dbus.c
+index 506f150f..760bb9ba 100644
+--- a/pcap-dbus.c
++++ b/pcap-dbus.c
+@@ -91,7 +91,8 @@ dbus_read(pcap_t *handle, int max_packets _U_, pcap_handler 
callback, u_char *us
+ 
+               gettimeofday(&pkth.ts, NULL);
+               if (handle->fcode.bf_insns == NULL ||
+-                  pcap_filter(handle->fcode.bf_insns, (u_char *)raw_msg, 
pkth.len, pkth.caplen)) {
++                  pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++                                 (u_char *)raw_msg, pkth.len, pkth.caplen)) {
+                       handlep->packets_read++;
+                       callback(user, &pkth, (u_char *)raw_msg);
+                       count++;
+diff --git a/pcap-dpdk.c b/pcap-dpdk.c
+index 025a6748..cc31d2f2 100644
+--- a/pcap-dpdk.c
++++ b/pcap-dpdk.c
+@@ -407,7 +407,9 @@ static int pcap_dpdk_dispatch(pcap_t *p, int max_cnt, 
pcap_handler cb, u_char *c
+ 
+                       }
+                       if (bp){
+-                              if (p->fcode.bf_insns==NULL || 
pcap_filter(p->fcode.bf_insns, bp, pcap_header.len, pcap_header.caplen)){
++                              if (p->fcode.bf_insns==NULL ||
++                                  pcap_filter(p->fcode.bf_insns, 
p->fcode.bf_len,
++                                                 bp, pcap_header.len, 
pcap_header.caplen)){
+                                       cb(cb_arg, &pcap_header, bp);
+                               }else{
+                                       pd->bpf_drop++;
+diff --git a/pcap-int.h b/pcap-int.h
+index 894e74af..11ca3c56 100644
+--- a/pcap-int.h
++++ b/pcap-int.h
+@@ -619,13 +619,15 @@ struct pcap_bpf_aux_data {
+  * Filtering routine that takes the auxiliary data as an additional
+  * argument.
+  */
+-u_int pcap_filter_with_aux_data(const struct bpf_insn *,
+-    const u_char *, u_int, u_int, const struct pcap_bpf_aux_data *);
++u_int pcap_filter_with_aux_data(const struct bpf_insn *, const u_int,
++    const u_char *, const u_int, const u_int,
++    const struct pcap_bpf_aux_data *);
+ 
+ /*
+  * Filtering routine that doesn't.
+  */
+-u_int pcap_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
++u_int pcap_filter(const struct bpf_insn *, const u_int, const u_char *,
++    u_int, u_int);
+ 
+ /*
+  * Routine to validate a BPF program.
+diff --git a/pcap-linux.c b/pcap-linux.c
+index 13bd8529..b2b2ca70 100644
+--- a/pcap-linux.c
++++ b/pcap-linux.c
+@@ -3993,6 +3993,7 @@ static int pcap_handle_packet_mmap(
+               aux_data.vlan_tag = tp_vlan_tci & 0x0fff;
+ 
+               if (pcap_filter_with_aux_data(handle->fcode.bf_insns,
++                                            handle->fcode.bf_len,
+                                             bp,
+                                             tp_len,
+                                             snaplen,
+diff --git a/pcap-netfilter-linux.c b/pcap-netfilter-linux.c
+index 2eb0fc8c..5b5f5c18 100644
+--- a/pcap-netfilter-linux.c
++++ b/pcap-netfilter-linux.c
+@@ -259,8 +259,8 @@ netfilter_read_linux(pcap_t *handle, int max_packets, 
pcap_handler callback, u_c
+ 
+                               gettimeofday(&pkth.ts, NULL);
+                               if (handle->fcode.bf_insns == NULL ||
+-                                              
pcap_filter(handle->fcode.bf_insns, payload, pkth.len, pkth.caplen))
+-                              {
++                                  pcap_filter(handle->fcode.bf_insns, 
handle->fcode.bf_len,
++                                                 payload, pkth.len, 
pkth.caplen)) {
+                                       handlep->packets_read++;
+                                       callback(user, &pkth, payload);
+                                       count++;
+diff --git a/pcap-netmap.c b/pcap-netmap.c
+index 27d36e5b..bcfd6e93 100644
+--- a/pcap-netmap.c
++++ b/pcap-netmap.c
+@@ -81,7 +81,8 @@ pcap_netmap_filter(u_char *arg, struct pcap_pkthdr *h, const 
u_char *buf)
+       const struct bpf_insn *pc = p->fcode.bf_insns;
+ 
+       ++pn->rx_pkts;
+-      if (pc == NULL || pcap_filter(pc, buf, h->len, h->caplen))
++      if (pc == NULL ||
++          pcap_filter(pc, p->fcode.bf_len, buf, h->len, h->caplen))
+               pn->cb(pn->cb_arg, h, buf);
+ }
+ 
+diff --git a/pcap-npf.c b/pcap-npf.c
+index 99b5981e..a4364353 100644
+--- a/pcap-npf.c
++++ b/pcap-npf.c
+@@ -682,7 +682,8 @@ pcap_read_npf(pcap_t *p, int cnt, pcap_handler callback, 
u_char *user)
+                */
+               if (pw->filtering_in_kernel ||
+                   p->fcode.bf_insns == NULL ||
+-                  pcap_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, 
caplen)) {
++                  pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++                                 datap, bhp->bh_datalen, caplen)) {
+ #ifdef ENABLE_REMOTE
+                       switch (p->rmt_samp.method) {
+ 
+diff --git a/pcap-rdmasniff.c b/pcap-rdmasniff.c
+index d63ca898..c8763b33 100644
+--- a/pcap-rdmasniff.c
++++ b/pcap-rdmasniff.c
+@@ -172,7 +172,8 @@ rdmasniff_read(pcap_t *handle, int max_packets, 
pcap_handler callback, u_char *u
+               pktd = (u_char *) handle->buffer + wc.wr_id * 
RDMASNIFF_RECEIVE_SIZE;
+ 
+               if (handle->fcode.bf_insns == NULL ||
+-                  pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, 
pkth.caplen)) {
++                  pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++                                 pktd, pkth.len, pkth.caplen)) {
+                       callback(user, &pkth, pktd);
+                       ++priv->packets_recv;
+                       ++count;
+diff --git a/pcap-snf.c b/pcap-snf.c
+index fe9cc9c8..16ce9c8e 100644
+--- a/pcap-snf.c
++++ b/pcap-snf.c
+@@ -192,7 +192,8 @@ snf_read(pcap_t *p, int cnt, pcap_handler callback, u_char 
*user)
+                       caplen = p->snapshot;
+ 
+               if ((p->fcode.bf_insns == NULL) ||
+-                   pcap_filter(p->fcode.bf_insns, req.pkt_addr, req.length, 
caplen)) {
++                   pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++                               req.pkt_addr, req.length, caplen)) {
+                       hdr.ts = snf_timestamp_to_timeval(req.timestamp, 
p->opt.tstamp_precision);
+                       hdr.caplen = caplen;
+                       hdr.len = req.length;
+diff --git a/pcap-usb-linux.c b/pcap-usb-linux.c
+index 726e4a8a..44b2bf30 100644
+--- a/pcap-usb-linux.c
++++ b/pcap-usb-linux.c
+@@ -735,8 +735,8 @@ usb_read_linux_bin(pcap_t *handle, int max_packets _U_, 
pcap_handler callback, u
+       pkth.ts.tv_usec = info.hdr->ts_usec;
+ 
+       if (handle->fcode.bf_insns == NULL ||
+-          pcap_filter(handle->fcode.bf_insns, handle->buffer,
+-            pkth.len, pkth.caplen)) {
++          pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++                         handle->buffer, pkth.len, pkth.caplen)) {
+               handlep->packets_read++;
+               callback(user, &pkth, handle->buffer);
+               return 1;
+@@ -904,8 +904,8 @@ usb_read_linux_mmap(pcap_t *handle, int max_packets, 
pcap_handler callback, u_ch
+                       pkth.ts.tv_usec = hdr->ts_usec;
+ 
+                       if (handle->fcode.bf_insns == NULL ||
+-                          pcap_filter(handle->fcode.bf_insns, (u_char*) hdr,
+-                            pkth.len, pkth.caplen)) {
++                          pcap_filter(handle->fcode.bf_insns, 
handle->fcode.bf_len,
++                                         (u_char*) hdr, pkth.len, 
pkth.caplen)) {
+                               handlep->packets_read++;
+                               callback(user, &pkth, (u_char*) hdr);
+                               packets++;
+diff --git a/pcap.c b/pcap.c
+index ef1bbb71..9ee83f98 100644
+--- a/pcap.c
++++ b/pcap.c
+@@ -4179,7 +4179,7 @@ pcap_offline_filter(const struct bpf_program *fp, const 
struct pcap_pkthdr *h,
+       const struct bpf_insn *fcode = fp->bf_insns;
+ 
+       if (fcode != NULL)
+-              return (pcap_filter(fcode, pkt, h->len, h->caplen));
++              return (pcap_filter(fcode, fp->bf_len, pkt, h->len, h->caplen));
+       else
+               return (0);
+ }
+diff --git a/savefile.c b/savefile.c
+index db8a3aa0..e9708b23 100644
+--- a/savefile.c
++++ b/savefile.c
+@@ -687,7 +687,8 @@ pcap_offline_read(pcap_t *p, int cnt, pcap_handler 
callback, u_char *user)
+                * and, if it passes, process it.
+                */
+               if ((fcode = p->fcode.bf_insns) == NULL ||
+-                  pcap_filter(fcode, data, h.len, h.caplen)) {
++                  pcap_filter(fcode, p->fcode.bf_len,
++                                 data, h.len, h.caplen)) {
+                       (*callback)(user, &h, data);
+                       n++;    /* count the packet */
+                       if (n >= cnt)
diff --git a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb 
b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb
index 692fdf606c..323cca3d98 100644
--- a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb
+++ b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb
@@ -18,6 +18,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \
            file://CVE-2025-11961-02.patch \
            file://CVE-2025-11964.patch \
            file://01-CVE-2026-0799.patch \
+           file://02-CVE-2026-31912.patch \
           "
 
 SRC_URI[sha256sum] = 
"ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f"
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#245893): 
https://lists.openembedded.org/g/openembedded-core/message/245893
Mute This Topic: https://lists.openembedded.org/mt/121267544/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub 
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-

Reply via email to