From: Gyorgy Sarvari <[email protected]> Details: https://nvd.nist.gov/vuln/detail/CVE-2026-22185
Pick the patch that is mentioned as a solution in the related upstream bug[1]. [1]: https://bugs.openldap.org/show_bug.cgi?id=10421 Signed-off-by: Gyorgy Sarvari <[email protected]> Signed-off-by: Khem Raj <[email protected]> (cherry picked from commit e0f86a4a7f8e413c682fbd4a9c01b12b0234cd71) Signed-off-by: Ankur Tyagi <[email protected]> --- .../lmdb/files/CVE-2026-22185.patch | 31 +++++++++++++++++++ meta-oe/recipes-dbs/lmdb/lmdb_0.9.31.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta-oe/recipes-dbs/lmdb/files/CVE-2026-22185.patch diff --git a/meta-oe/recipes-dbs/lmdb/files/CVE-2026-22185.patch b/meta-oe/recipes-dbs/lmdb/files/CVE-2026-22185.patch new file mode 100644 index 0000000000..6c85b2b8ed --- /dev/null +++ b/meta-oe/recipes-dbs/lmdb/files/CVE-2026-22185.patch @@ -0,0 +1,31 @@ +From 94ca20e5aed5d8730e045bb945fa3485b28a7981 Mon Sep 17 00:00:00 2001 +From: Gyorgy Sarvari <[email protected]> +Date: Tue, 6 Jan 2026 20:52:25 +0000 +Subject: [PATCH] ITS#10421 mdb_load: check for malicious input + +From: Howard Chu <[email protected]> + +CVE: CVE-2026-22185 +Upstream-Status: Backport [https://github.com/LMDB/lmdb/commit/8e1fda85532a3c74276df38a42d234dcdfa1e40d] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + libraries/liblmdb/mdb_load.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/libraries/liblmdb/mdb_load.c b/libraries/liblmdb/mdb_load.c +index d2a3cec..7eccf40 100644 +--- a/libraries/liblmdb/mdb_load.c ++++ b/libraries/liblmdb/mdb_load.c +@@ -208,6 +208,12 @@ badend: + + c1 = buf->mv_data; + len = strlen((char *)c1); ++ if (!len) { ++ /* This can only happen with an intentionally invalid input ++ * with a NUL byte after the leading SPACE ++ */ ++ goto badend; ++ } + l2 = len; + + /* Is buffer too short? */ diff --git a/meta-oe/recipes-dbs/lmdb/lmdb_0.9.31.bb b/meta-oe/recipes-dbs/lmdb/lmdb_0.9.31.bb index b2f1920f6b..0d06c74602 100644 --- a/meta-oe/recipes-dbs/lmdb/lmdb_0.9.31.bb +++ b/meta-oe/recipes-dbs/lmdb/lmdb_0.9.31.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/LMDB/lmdb.git;nobranch=1;protocol=https \ file://run-ptest \ file://0001-Makefile-use-libprefix-instead-of-libdir.patch \ file://0001-make-set-soname-on-liblmdb.patch;patchdir=../.. \ + file://CVE-2026-22185.patch;striplevel=3 \ " SRCREV = "ce201088de95d26fc0da36ba805bf2ddc2ba74ff"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#123552): https://lists.openembedded.org/g/openembedded-devel/message/123552 Mute This Topic: https://lists.openembedded.org/mt/117312037/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
