Hi Yoann, I compared the submitted backport with upstream. curl 8.7.1 lacks first.h and uses the older test.h harness. Its res_easy_setopt() and res_global_init() macros assign to res, requiring the rename in init1647() and test(). run1647() retains upstream’s result. Following your earlier feedback [1], init1647() also retains the CURLcode type. With those adjustments, the test passes; reversing the library fix reproduces the Digest header leak. [1] https://www.mail-archive.com/openembedded-core%40lists.openembedded.org/msg226412.html Regards, Devansh ________________________________ From: Yoann Congal <[email protected]> Sent: Wednesday, October 14, 2026 01:40 To: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Subject: Re: [OE-core][scarthgap][PATCH 5/8] curl: fix CVE-2026-8927
Hello, On Wed Oct 7, 2026 at 1:24 PM CEST, Devansh Patel via lists.openembedded.org wrote: > From: Devansh Patel <[email protected]> > > This patch applies the upstream fix as referenced in [3], using the > commits shown in [1] and [2]. > > [1] > https://github.com/curl/curl/commit/1968b32afd8e41fbb87f8911d15c552c6b705385 > [2] > https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567 > [3] https://curl.se/docs/CVE-2026-8927.html > > Signed-off-by: Devansh Patel <[email protected]> > --- > .../curl/curl/CVE-2026-8927-dependent.patch | 41 ++ > .../curl/curl/CVE-2026-8927.patch | 378 ++++++++++++++++++ > meta/recipes-support/curl/curl_8.7.1.bb | 2 + > 3 files changed, 421 insertions(+) > create mode 100644 > meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch > create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch > > diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927.patch > b/meta/recipes-support/curl/curl/CVE-2026-8927.patch > +diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c > +new file mode 100644 > +index 0000000000..16dc9d711c > +--- /dev/null > ++++ b/tests/libtest/lib1647.c > ++/* > ++ * argv1 = the first URL > ++ * argv2 = URL2 > ++ * argv3 = credentials 1 > ++ * argv4 = credentials 2 > ++ */ > ++ > ++#include "test.h" > ++#include "testutil.h" > ++ > ++/* this is meant to pick up the proxy from the environment variable */ > ++static CURLcode init1647(CURL *curl, const char *url, const char *userpwd) > ++{ > ++ CURLcode res = CURLE_OK; Hello, This patch contains changed code from the upstream patch. For exemple, result -> res. This might seen minor but it might hide more problematic changes. Can you check by comparing with upstream patch that the diff is minimal? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247869): https://lists.openembedded.org/g/openembedded-core/message/247869 Mute This Topic: https://lists.openembedded.org/mt/121625923/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
