From: Hetvi Thakar <[email protected]> This patch applies the upstream fix referenced by NVD in [2], using the commit shown in [1].
[1] https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56289 Signed-off-by: Hetvi Thakar <[email protected]> --- .../patch/patch/CVE-2026-56289.patch | 36 +++++++++++++++++++ meta/recipes-devtools/patch/patch_2.7.6.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-devtools/patch/patch/CVE-2026-56289.patch diff --git a/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch b/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch new file mode 100644 index 0000000000..cfcb2216c3 --- /dev/null +++ b/meta/recipes-devtools/patch/patch/CVE-2026-56289.patch @@ -0,0 +1,36 @@ +From a40c835ab06314526d623e62ae27830d0ad88752 Mon Sep 17 00:00:00 2001 +From: Paul Eggert <[email protected]> +Date: Tue, 21 Apr 2026 13:16:10 -0700 +Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20infloop=20on=20null=20ranges?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Problem reported by Michał Majchrowicz. +* src/patch.c (locate_hunk): Don’t attempt to optimize +matches of a null range. Instead, apply all the checks +we apply to non-null ranges. + +CVE: CVE-2026-56289 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9] + +(cherry picked from commit faba04ef4f2b410257f76c1b9dc85e350929c4b9) +Signed-off-by: Hetvi Thakar <[email protected]> +--- + src/patch.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/src/patch.c b/src/patch.c +index b348b5c..0e8d5c9 100644 +--- a/src/patch.c ++++ b/src/patch.c +@@ -1146,9 +1146,6 @@ locate_hunk (lin fuzz) + lin max_offset = MAX(max_pos_offset, max_neg_offset); + lin min_offset; + +- if (!pat_lines) /* null range matches always */ +- return first_guess; +- + /* Do not try lines <= 0. */ + if (first_guess <= max_neg_offset) + max_neg_offset = first_guess - 1; diff --git a/meta/recipes-devtools/patch/patch_2.7.6.bb b/meta/recipes-devtools/patch/patch_2.7.6.bb index e0e44f9c97..74d9085c6b 100644 --- a/meta/recipes-devtools/patch/patch_2.7.6.bb +++ b/meta/recipes-devtools/patch/patch_2.7.6.bb @@ -11,6 +11,7 @@ SRC_URI += "file://0001-Unset-need_charset_alias-when-building-for-musl.patch \ file://0001-Don-t-leak-temporary-file-on-failed-ed-style-patch.patch \ file://0001-Don-t-leak-temporary-file-on-failed-multi-file-ed.patch \ file://CVE-2019-20633.patch \ + file://CVE-2026-56289.patch \ " SRC_URI[md5sum] = "4c68cee989d83c87b00a3860bcd05600" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242098): https://lists.openembedded.org/g/openembedded-core/message/242098 Mute This Topic: https://lists.openembedded.org/mt/120466427/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
