Sent under https://lists.openembedded.org/g/openembedded-core/message/247572
> -----Original Message----- > From: Yoann Congal <[email protected]> > Sent: Saturday, October 10, 2026 2:02 AM > To: Marko, Peter (FT D EU SK BFS1) <[email protected]>; > [email protected] > Subject: Re: [OE-core] [wrynose][PATCH 5/6] expat: patch CVE-2026-102633 > > On Tue Oct 6, 2026 at 9:36 PM CEST, Peter Marko via lists.openembedded.org > wrote: > > From: Peter Marko <[email protected]> > > > > Pick patch per [1]. > > > > [1] https://security-tracker.debian.org/tracker/CVE-2026-102633 > > > > Signed-off-by: Peter Marko <[email protected]> > > --- > > .../expat/expat/CVE-2026-102633.patch | 68 +++++++++++++++++++ > > meta/recipes-core/expat/expat_2.8.3.bb | 1 + > > 2 files changed, 69 insertions(+) > > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-102633.patch > > > > diff --git a/meta/recipes-core/expat/expat/CVE-2026-102633.patch > > b/meta/recipes- > core/expat/expat/CVE-2026-102633.patch > > new file mode 100644 > > index 0000000000..1785120126 > > --- /dev/null > > +++ b/meta/recipes-core/expat/expat/CVE-2026-102633.patch > > @@ -0,0 +1,68 @@ > > +From 69edbec09f2cd3e0bd6e0a093b55ea38af902d7d Mon Sep 17 00:00:00 2001 > > +From: Filippo Tedeschi <[email protected]> > > +Date: Thu, 24 Sep 2026 21:14:23 +0200 > > +Subject: [PATCH] lib|tests: Replace assert with runtime overflow check in > > + expat_realloc > > + > > +In expat_realloc, the size passed to realloc_fcn is calculated as > > +sizeof(size_t) + EXPAT_MALLOC_PADDING + size. Previously, expat_realloc > > +relied on an assertion: > > +assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size); > > +under the assumption that preceding accounting checks and parser > > +invariants preclude reaching an overflow state in practice. > > + > > +However, in release builds compiled with NDEBUG, assertions are > > +compiled out. Replace the assert with an explicit runtime check: > > +if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) { > > + return NULL; > > +} > > +immediately preceding the addition, ensuring consistent defensive > > +behavior across all build configurations. > > + > > +Also extend test_alloc_tracker_size_recorded in alloc_tests.c to > > +exercise SIZE_MAX and SIZE_MAX / 2 with expat_realloc, verifying > > +that the allocation fails and the recorded size remains unchanged. > > + > > +Signed-off-by: Filippo Tedeschi <[email protected]> > > + > > +CVE: CVE-2026-102633 > > +Upstream-Status: Backport > [https://github.com/libexpat/libexpat/commit/69edbec09f2cd3e0bd6e0a093b55ea38af9 > 02d7d] > > +Signed-off-by: Peter Marko <[email protected]> > > +--- > > + lib/xmlparse.c | 7 ++++--- > > + tests/alloc_tests.c | 4 ++++ > > + 2 files changed, 8 insertions(+), 3 deletions(-) > > Hello, > > I beleive this one is needed on blacksail as well. > Can you send it? > > Thanks! > -- > Yoann Congal > Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247574): https://lists.openembedded.org/g/openembedded-core/message/247574 Mute This Topic: https://lists.openembedded.org/mt/121616562/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
