On Tue Oct 6, 2026 at 9:36 PM CEST, Peter Marko via lists.openembedded.org wrote: > From: Peter Marko <[email protected]> > > Pick patch per [1]. > > [1] https://security-tracker.debian.org/tracker/CVE-2026-102633 > > Signed-off-by: Peter Marko <[email protected]> > --- > .../expat/expat/CVE-2026-102633.patch | 68 +++++++++++++++++++ > meta/recipes-core/expat/expat_2.8.3.bb | 1 + > 2 files changed, 69 insertions(+) > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-102633.patch > > diff --git a/meta/recipes-core/expat/expat/CVE-2026-102633.patch > b/meta/recipes-core/expat/expat/CVE-2026-102633.patch > new file mode 100644 > index 0000000000..1785120126 > --- /dev/null > +++ b/meta/recipes-core/expat/expat/CVE-2026-102633.patch > @@ -0,0 +1,68 @@ > +From 69edbec09f2cd3e0bd6e0a093b55ea38af902d7d Mon Sep 17 00:00:00 2001 > +From: Filippo Tedeschi <[email protected]> > +Date: Thu, 24 Sep 2026 21:14:23 +0200 > +Subject: [PATCH] lib|tests: Replace assert with runtime overflow check in > + expat_realloc > + > +In expat_realloc, the size passed to realloc_fcn is calculated as > +sizeof(size_t) + EXPAT_MALLOC_PADDING + size. Previously, expat_realloc > +relied on an assertion: > +assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size); > +under the assumption that preceding accounting checks and parser > +invariants preclude reaching an overflow state in practice. > + > +However, in release builds compiled with NDEBUG, assertions are > +compiled out. Replace the assert with an explicit runtime check: > +if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) { > + return NULL; > +} > +immediately preceding the addition, ensuring consistent defensive > +behavior across all build configurations. > + > +Also extend test_alloc_tracker_size_recorded in alloc_tests.c to > +exercise SIZE_MAX and SIZE_MAX / 2 with expat_realloc, verifying > +that the allocation fails and the recorded size remains unchanged. > + > +Signed-off-by: Filippo Tedeschi <[email protected]> > + > +CVE: CVE-2026-102633 > +Upstream-Status: Backport > [https://github.com/libexpat/libexpat/commit/69edbec09f2cd3e0bd6e0a093b55ea38af902d7d] > +Signed-off-by: Peter Marko <[email protected]> > +--- > + lib/xmlparse.c | 7 ++++--- > + tests/alloc_tests.c | 4 ++++ > + 2 files changed, 8 insertions(+), 3 deletions(-)
Hello, I beleive this one is needed on blacksail as well. Can you send it? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247486): https://lists.openembedded.org/g/openembedded-core/message/247486 Mute This Topic: https://lists.openembedded.org/mt/121616562/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
