Backport upstream fix for a global buffer overflow in the LZH decompression logic (unlzh.c). The left[] and right[] global arrays shared across LZW and LZH decompression routines are not reinitialized between files processed in the same invocation, allowing an out-of-bounds read in the LZH decoder.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41992 Signed-off-by: Jaipaul Cheernam <[email protected]> --- .../gzip/gzip-1.14/CVE-2026-41992.patch | 32 +++++++++++++++++++ meta/recipes-extended/gzip/gzip_1.14.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch diff --git a/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch b/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch new file mode 100644 index 0000000000..5d3534fcb1 --- /dev/null +++ b/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch @@ -0,0 +1,32 @@ +From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001 +From: Paul Eggert <[email protected]> +Date: Wed, 15 Apr 2026 12:00:17 -0700 +Subject: gzip: don't mishandle .lzh after .Z + +Problem reported by Michal Majchrowicz. +* unlzh.c (read_c_len): Clear left and right when n == 0. + +CVE: CVE-2026-41992 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681] +Signed-off-by: Jaipaul Cheernam <[email protected]> +--- + unlzh.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/unlzh.c b/unlzh.c +index 3320196..a6cf109 100644 +--- a/unlzh.c ++++ b/unlzh.c +@@ -232,6 +232,12 @@ read_c_len () + c = getbits(CBIT); + for (i = 0; i < NC; i++) c_len[i] = 0; + for (i = 0; i < 4096; i++) c_table[i] = c; ++ ++ /* Needed in case LEFT and RIGHT are reused from a previous ++ LZW decompression. It may be overkill to clear all of both ++ arrays, but nobody has had time to analyze this carefully. */ ++ memzero(left, (2 * NC - 1) * sizeof *left); ++ memzero(right, (2 * NC - 1) * sizeof *left); + } else { + i = 0; + while (i < n) { diff --git a/meta/recipes-extended/gzip/gzip_1.14.bb b/meta/recipes-extended/gzip/gzip_1.14.bb index c7837cdae0..99174a58c5 100644 --- a/meta/recipes-extended/gzip/gzip_1.14.bb +++ b/meta/recipes-extended/gzip/gzip_1.14.bb @@ -6,6 +6,7 @@ LICENSE = "GPL-3.0-or-later" SRC_URI = "${GNU_MIRROR}/gzip/${BP}.tar.gz \ file://run-ptest \ + file://CVE-2026-41992.patch \ " SRC_URI:append:class-target = " file://wrong-path-fix.patch" -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240394): https://lists.openembedded.org/g/openembedded-core/message/240394 Mute This Topic: https://lists.openembedded.org/mt/120157122/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
