Backport patch to fix CVE-2026-56391. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-56391
Upstream fix: https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371 Signed-off-by: Leonid Iziumtsev <[email protected]> --- .../coreutils/coreutils/CVE-2026-56391.patch | 66 +++++++++++++++++++ meta/recipes-core/coreutils/coreutils_9.11.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch diff --git a/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch b/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch new file mode 100644 index 0000000000..85745bf572 --- /dev/null +++ b/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch @@ -0,0 +1,66 @@ +From dadd37b60ca43b436a2287d28d6497bcc5bf4b9a Mon Sep 17 00:00:00 2001 +From: Paul Eggert <[email protected]> +Date: Tue, 28 Apr 2026 11:25:00 -0700 +Subject: [PATCH] uniq: fix read overrun with -w +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Problem reported by Michał Majchrowicz. +* src/uniq.c (find_field): Fix typo. +* tests/uniq/uniq.pl (add_z_variants): Test for the bug. + +CVE: CVE-2026-56391 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371] + +Backport Changes: +- The NEWS file has not been updated. + +Signed-off-by: Leonid Iziumtsev <[email protected]> +--- + THANKS.in | 1 + + src/uniq.c | 4 ++-- + tests/uniq/uniq.pl | 3 +++ + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/THANKS.in b/THANKS.in +index 35fee75..5a2fd35 100644 +--- a/THANKS.in ++++ b/THANKS.in +@@ -459,6 +459,7 @@ Michail Litvak [email protected] + Michal Politowski [email protected] + Michal Svec [email protected] + Michal Trunecka [email protected] ++Michał Majchrowicz [email protected] + Michel Robitaille [email protected] + Michiel Bacchiani [email protected] + Mike Castle [email protected] +diff --git a/src/uniq.c b/src/uniq.c +index 3046359..5834596 100644 +--- a/src/uniq.c ++++ b/src/uniq.c +@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen) + else + { + char *ep = lp; +- for (idx_t i = check_chars; 0 < i && lp < lim; i--) +- ep += mcel_scan (lp, lim).len; ++ for (idx_t i = check_chars; 0 < i && ep < lim; i--) ++ ep += mcel_scan (ep, lim).len; + len = ep - lp; + } + +diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl +index b558fb3..0df7ec6 100755 +--- a/tests/uniq/uniq.pl ++++ b/tests/uniq/uniq.pl +@@ -234,6 +234,9 @@ my @Tests = + " - 'separate'\n" . + " - 'both'\n" . + "Try '$prog --help' for more information.\n"}], ++ # Test for read buffer overrun. ++ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n"; ++ ['146', '-w256', {IN => $longline x 2}, {OUT => $longline}] }, + ); + + # Locale related tests diff --git a/meta/recipes-core/coreutils/coreutils_9.11.bb b/meta/recipes-core/coreutils/coreutils_9.11.bb index ea2d237c3d..3e4f5fc7dc 100644 --- a/meta/recipes-core/coreutils/coreutils_9.11.bb +++ b/meta/recipes-core/coreutils/coreutils_9.11.bb @@ -16,6 +16,7 @@ inherit autotools gettext texinfo SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \ file://remove-usr-local-lib-from-m4.patch \ file://run-ptest \ + file://CVE-2026-56391.patch \ " SRC_URI[sha256sum] = "394024eda0a5955217ceda9cd1201e65dc8fa3aa29c2951135a49521d57c3cc3"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242432): https://lists.openembedded.org/g/openembedded-core/message/242432 Mute This Topic: https://lists.openembedded.org/mt/120532930/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
