[meta-oe,6/6] mpv: patch CVE-2026-123095

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-123095

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../mplayer/mpv/CVE-2026-123095.patch         | 37 +++++++++++++++++++
 .../recipes-multimedia/mplayer/mpv_0.41.0.bb  |  1 +
 2 files changed, 38 insertions(+)
 create mode 100644 meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch

There is upgrade to 0.42 patch staged where this is already included. I
will drop this one.

On Wed, Nov 11, 2026 at 11:14 PM Ankur Tyagi via openembedded-devel
<ankur.tyagi85=gmail.com@lists.openembedded.org> wrote:

> From: Ankur Tyagi <ankur.tyagi85@gmail.com>
>
> Details:
> https://nvd.nist.gov/vuln/detail/cve-2026-123095
>
> Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
> ---
>  .../mplayer/mpv/CVE-2026-123095.patch         | 37 +++++++++++++++++++
>  .../recipes-multimedia/mplayer/mpv_0.41.0.bb  |  1 +
>  2 files changed, 38 insertions(+)
>  create mode 100644
> meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch
>
> diff --git a/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch
> b/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch
> new file mode 100644
> index 0000000000..1efa0fdee6
> --- /dev/null
> +++ b/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch
> @@ -0,0 +1,37 @@
> +From 2c6599aa7d16efd29ae49865757eb449d9306742 Mon Sep 17 00:00:00 2001
> +From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com>
> +Date: Wed, 4 Nov 2026 20:28:57 +0100
> +Subject: [PATCH] ytdl_hook: reject playlist entry URLs with control
> characters
> +
> +The entries are joined into a memory:// M3U playlist, one URL per line.
> +A URL with a line break became several entries, and only the first line
> +went through url_is_safe(). The other lines were loaded with the origin
> +of the opened URL, so any protocol was allowed. Skip any URLs with
> +control characters.
> +
> +Fixes: e6e6b0dcc7
> +Fixes: GHSA-p99g-m25w-x8xv
> +(cherry picked from commit c3096515dcd26c14004f985538b5aa41db613856)
> +
> +CVE: CVE-2026-123095
> +Upstream-Status: Backport [
> https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856
> ]
> +
> +Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
> +---
> + player/lua/ytdl_hook.lua | 3 +++
> + 1 file changed, 3 insertions(+)
> +
> +diff --git a/player/lua/ytdl_hook.lua b/player/lua/ytdl_hook.lua
> +index 65ef859595..2b0edb193a 100644
> +--- a/player/lua/ytdl_hook.lua
> ++++ b/player/lua/ytdl_hook.lua
> +@@ -1111,6 +1111,9 @@ local function run_ytdl_hook(url)
> +                 -- links without protocol as returned by --flat-playlist
> +                 if not site then
> +                     msg.error("Playlist entry does not have unique URL,
> can't add it.")
> ++                elseif site:find("%c") then
> ++                    -- a line break would add entries to the playlist
> ++                    msg.error("Playlist entry URL contains control
> characters, can't add it.")
> +                 elseif not site:find("://") then
> +                     -- youtube extractor provides only IDs,
> +                     -- others come prefixed with the extractor name and
> ":"
> diff --git a/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb
> b/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb
> index f37ae4ac50..0c99e354e7 100644
> --- a/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb
> +++ b/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb
> @@ -27,6 +27,7 @@ SRC_URI = " \
>      git://
> github.com/mpv-player/mpv;name=mpv;branch=release/${@oe.utils.trim_version('${PV}
> <http://github.com/mpv-player/mpv;name=mpv;branch=release/$%7B@oe.utils.trim_version('$%7BPV%7D>',
> 2)};protocol=https;tag=v${PV} \
>
>  file://0001-opengl-context-require-swap_buffers-param-for-FenceS.patch \
>
>  file://0002-hwdec_drmprime_overlay-make-the-framebuffer-the-whole-frame.patch
> \
> +    file://CVE-2026-123095.patch \
>  "
>
>  inherit meson pkgconfig mime-xdg
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#132205):
> https://lists.openembedded.org/g/openembedded-devel/message/132205
> Mute This Topic: https://lists.openembedded.org/mt/122226695/1997914
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [
> raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>