On Tue Oct 6, 2026 at 9:36 PM CEST, Peter Marko via lists.openembedded.org wrote: > From: Peter Marko <[email protected]> > > Pick patch per [1]. > > [1] https://security-tracker.debian.org/tracker/CVE-2026-77214 > > Signed-off-by: Peter Marko <[email protected]> > --- > .../expat/expat/CVE-2026-77214.patch | 106 ++++++++++++++++++ > meta/recipes-core/expat/expat_2.8.3.bb | 1 + > 2 files changed, 107 insertions(+) > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-77214.patch > > diff --git a/meta/recipes-core/expat/expat/CVE-2026-77214.patch > b/meta/recipes-core/expat/expat/CVE-2026-77214.patch > new file mode 100644 > index 0000000000..6d74648705 > --- /dev/null > +++ b/meta/recipes-core/expat/expat/CVE-2026-77214.patch > @@ -0,0 +1,106 @@ > +From 4d9b1c499ecb66323260a7274edcf86c5eab0517 Mon Sep 17 00:00:00 2001 > +From: Filippo Tedeschi <[email protected]> > +Date: Fri, 25 Sep 2026 19:51:10 +0200 > +Subject: [PATCH] lib|tests: Validate len against buffer capacity in > + XML_ParseBuffer > + > +In XML_ParseBuffer(), if len exceeds the unoccupied capacity of the > +internal buffer (EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd)), > +parser->m_bufferEnd was previously advanced past parser->m_bufferLim. > +This violated the parser's internal pointer invariant (m_bufferEnd <= > +m_bufferLim) and caused callProcessor() to read unallocated or > +uninitialized heap memory beyond the buffer bounds. > + > +Validate that len <= EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd) for > +both XML_INITIALIZED and XML_PARSING states. If len exceeds the > +available buffer capacity, return XML_STATUS_ERROR with > +XML_ERROR_INVALID_ARGUMENT. > + > +Also add test_parse_buffer_exceeds_buffer in tests/basic_tests.c. > + > +Co-authored-by: Sebastian Pipping <[email protected]> > +Signed-off-by: Filippo Tedeschi <[email protected]> > + > +CVE: CVE-2026-77214 > +Upstream-Status: Backport > [https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517] > +Signed-off-by: Peter Marko <[email protected]> > +--- > + lib/xmlparse.c | 5 +++++ > + tests/basic_tests.c | 41 +++++++++++++++++++++++++++++++++++++++++ > + 2 files changed, 46 insertions(+)
I also believe this one is needed on blacksail. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247487): https://lists.openembedded.org/g/openembedded-core/message/247487 Mute This Topic: https://lists.openembedded.org/mt/121616565/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
