Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27631
Backport the patches referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <[email protected]> --- .../exiv2/exiv2/CVE-2026-27631-1.patch | 63 +++++++++++++++++++ .../exiv2/exiv2/CVE-2026-27631-2.patch | 26 ++++++++ meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb | 2 + 3 files changed, 91 insertions(+) create mode 100644 meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-1.patch create mode 100644 meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-2.patch diff --git a/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-1.patch b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-1.patch new file mode 100644 index 0000000000..918c9a234a --- /dev/null +++ b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-1.patch @@ -0,0 +1,63 @@ +From 70edff9f6f5af7314b65d6aab04b208f752f8953 Mon Sep 17 00:00:00 2001 +From: Kevin Backhouse <[email protected]> +Date: Thu, 26 Feb 2026 21:14:10 +0000 +Subject: [PATCH] Regression test for + https://github.com/Exiv2/exiv2/issues/3513 + +CVE: CVE-2026-27631 +Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/7adedce8c779e9c7bce843cbaf9eff26bc1659b6] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + test/data/issue_3513_poc.psd | Bin 0 -> 206 bytes + tests/bugfixes/github/test_issue_3513.py | 17 +++++++++++++++++ + .../test_regression_allfiles.py | 1 + + 3 files changed, 18 insertions(+) + create mode 100644 test/data/issue_3513_poc.psd + create mode 100644 tests/bugfixes/github/test_issue_3513.py + +diff --git a/test/data/issue_3513_poc.psd b/test/data/issue_3513_poc.psd +new file mode 100644 +index 0000000000000000000000000000000000000000..b8cf982ccc29e4574783b1317347a8494bce4240 +GIT binary patch +literal 206 +zcmcC;3J7LkWXND(VPIfj2I6QSp2oldW&@cF4i-+HzAOnKCIbVQ%?V)xNk#^S{{sU! +VK$eS7U=ZX2Ii>-KnHh{ttN=+HebfK| + +literal 0 +HcmV?d00001 + +diff --git a/tests/bugfixes/github/test_issue_3513.py b/tests/bugfixes/github/test_issue_3513.py +new file mode 100644 +index 000000000..5383470e4 +--- /dev/null ++++ b/tests/bugfixes/github/test_issue_3513.py +@@ -0,0 +1,17 @@ ++# -*- coding: utf-8 -*- ++ ++import system_tests ++ ++ ++class test_issue_3513_PsdImage_readResourceBlock(metaclass=system_tests.CaseMeta): ++ url = "https://github.com/Exiv2/exiv2/issues/3513"; ++ ++ filename = "$data_path/issue_3513_poc.psd" ++ commands = ["$exiv2 -pp $filename"] ++ retval = [1] ++ stderr = [ ++ """$exiv2_exception_message $filename: ++$kerCorruptedMetadata ++""" ++ ] ++ stdout = [""] +diff --git a/tests/regression_tests/test_regression_allfiles.py b/tests/regression_tests/test_regression_allfiles.py +index 34bea3b03..ef7b066e0 100644 +--- a/tests/regression_tests/test_regression_allfiles.py ++++ b/tests/regression_tests/test_regression_allfiles.py +@@ -124,6 +124,7 @@ def get_valid_files(data_dir): + "pocIssue283.jpg", + "poc_1522.jp2", + "xmpsdk.xmp", ++ "issue_3513_poc.psd", + "issue_3511_poc.eps", + # large file that creates 11Mb of output so let's exclude it + "ReaganLargeTiff.tiff", diff --git a/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-2.patch b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-2.patch new file mode 100644 index 0000000000..e762b10b6d --- /dev/null +++ b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-2.patch @@ -0,0 +1,26 @@ +From 5a6dd6015d436c1f64b55b47bb50ef8fa72f11d2 Mon Sep 17 00:00:00 2001 +From: Kevin Backhouse <[email protected]> +Date: Fri, 27 Feb 2026 10:38:22 +0000 +Subject: [PATCH] Check for integer overflow. + +CVE: CVE-2026-27631 +Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/284b4e20229dd6edf492e712871878ae320801fc] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + src/psdimage.cpp | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/psdimage.cpp b/src/psdimage.cpp +index 1a8e4c61c..b2f5247a2 100644 +--- a/src/psdimage.cpp ++++ b/src/psdimage.cpp +@@ -287,6 +287,9 @@ void PsdImage::readResourceBlock(uint16_t resourceId, uint32_t resourceSize) { + nativePreview.height_ = getLong(buf + 8, bigEndian); + const uint32_t format = getLong(buf + 0, bigEndian); + ++ Internal::enforce(nativePreview.size_ <= static_cast<size_t>(std::numeric_limits<long>::max()), ++ Exiv2::ErrorCode::kerCorruptedMetadata); ++ + if (nativePreview.size_ > 0 && nativePreview.position_ > 0) { + io_->seek(static_cast<long>(nativePreview.size_), BasicIo::cur); + if (io_->error() || io_->eof()) diff --git a/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb b/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb index 9ec2f48a77..f9ccdc079f 100644 --- a/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb +++ b/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb @@ -12,6 +12,8 @@ SRC_URI = "git://github.com/Exiv2/exiv2.git;protocol=https;branch=0.28.x \ file://CVE-2026-25884-2.patch \ file://CVE-2026-27596-1.patch \ file://CVE-2026-27596-2.patch \ + file://CVE-2026-27631-1.patch \ + file://CVE-2026-27631-2.patch \ " SRCREV = "a6a79ef064f131ffd03c110acce2d3edb84ffa2e" S = "${WORKDIR}/git"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#125080): https://lists.openembedded.org/g/openembedded-devel/message/125080 Mute This Topic: https://lists.openembedded.org/mt/118257440/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
