Send under https://lists.openembedded.org/g/openembedded-core/message/247573
> -----Original Message----- > From: Yoann Congal <[email protected]> > Sent: Saturday, October 10, 2026 2:03 AM > To: Marko, Peter (FT D EU SK BFS1) <[email protected]>; > [email protected] > Subject: Re: [OE-core] [wrynose][PATCH 6/6] expat: patch CVE-2026-77214 > > On Tue Oct 6, 2026 at 9:36 PM CEST, Peter Marko via lists.openembedded.org > wrote: > > From: Peter Marko <[email protected]> > > > > Pick patch per [1]. > > > > [1] https://security-tracker.debian.org/tracker/CVE-2026-77214 > > > > Signed-off-by: Peter Marko <[email protected]> > > --- > > .../expat/expat/CVE-2026-77214.patch | 106 ++++++++++++++++++ > > meta/recipes-core/expat/expat_2.8.3.bb | 1 + > > 2 files changed, 107 insertions(+) > > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-77214.patch > > > > diff --git a/meta/recipes-core/expat/expat/CVE-2026-77214.patch > > b/meta/recipes- > core/expat/expat/CVE-2026-77214.patch > > new file mode 100644 > > index 0000000000..6d74648705 > > --- /dev/null > > +++ b/meta/recipes-core/expat/expat/CVE-2026-77214.patch > > @@ -0,0 +1,106 @@ > > +From 4d9b1c499ecb66323260a7274edcf86c5eab0517 Mon Sep 17 00:00:00 2001 > > +From: Filippo Tedeschi <[email protected]> > > +Date: Fri, 25 Sep 2026 19:51:10 +0200 > > +Subject: [PATCH] lib|tests: Validate len against buffer capacity in > > + XML_ParseBuffer > > + > > +In XML_ParseBuffer(), if len exceeds the unoccupied capacity of the > > +internal buffer (EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd)), > > +parser->m_bufferEnd was previously advanced past parser->m_bufferLim. > > +This violated the parser's internal pointer invariant (m_bufferEnd <= > > +m_bufferLim) and caused callProcessor() to read unallocated or > > +uninitialized heap memory beyond the buffer bounds. > > + > > +Validate that len <= EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd) for > > +both XML_INITIALIZED and XML_PARSING states. If len exceeds the > > +available buffer capacity, return XML_STATUS_ERROR with > > +XML_ERROR_INVALID_ARGUMENT. > > + > > +Also add test_parse_buffer_exceeds_buffer in tests/basic_tests.c. > > + > > +Co-authored-by: Sebastian Pipping <[email protected]> > > +Signed-off-by: Filippo Tedeschi <[email protected]> > > + > > +CVE: CVE-2026-77214 > > +Upstream-Status: Backport > [https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5e > ab0517] > > +Signed-off-by: Peter Marko <[email protected]> > > +--- > > + lib/xmlparse.c | 5 +++++ > > + tests/basic_tests.c | 41 +++++++++++++++++++++++++++++++++++++++++ > > + 2 files changed, 46 insertions(+) > > I also believe this one is needed on blacksail. > > Regards, > -- > Yoann Congal > Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247575): https://lists.openembedded.org/g/openembedded-core/message/247575 Mute This Topic: https://lists.openembedded.org/mt/121616565/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
