| Message ID | 20260615115921.706829-4-richard.purdie@linuxfoundation.org |
|---|---|
| State | Accepted, archived |
| Commit | c71eed3b591439df99f23b1a89c4ed39348a3761 |
| Headers | show |
| Series | [1/4] python3-pytest: upgrade 9.0.3 -> 9.1.0 | expand |
Thank you for your submission. Patchtest identified one or more issues with the patch. Please see the log below for more information: --- Testing patch /home/patchtest/share/mboxes/4-4-alsa-lib-upgrade-1.2.15.3---1.2.16.1.patch FAIL: test commit message presence: Please include a commit message on your patch explaining the change (test_mbox.TestMbox.test_commit_message_presence) PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence) PASS: test author valid (test_mbox.TestMbox.test_author_valid) PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags) PASS: test mbox format (test_mbox.TestMbox.test_mbox_format) PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade) PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format) PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length) PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list) SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint) SKIP: test CVE tag format: No new CVE patches introduced (test_patch.TestPatch.test_cve_tag_format) SKIP: test Signed-off-by presence: No new CVE patches introduced (test_patch.TestPatch.test_signed_off_by_presence) SKIP: test Upstream-Status presence: No new CVE patches introduced (test_patch.TestPatch.test_upstream_status_presence_format) SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format) SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint) SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head) --- Please address the issues identified and submit a new revision of the patch, or alternatively, reply to this email with an explanation of why the patch should be accepted. If you believe these results are due to an error in patchtest, please submit a bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category under 'Yocto Project Subprojects'). For more information on specific failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank you!
diff --git a/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch deleted file mode 100644 index 9bb24c24e28..00000000000 --- a/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40 Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela <perex@perex.cz> -Date: Thu, 29 Jan 2026 16:51:09 +0100 -Subject: [PATCH] topology: decoder - add boundary check for channel mixer - count - -Malicious binary topology file may cause heap corruption. - -CVE: CVE-2026-25068 - -Signed-off-by: Jaroslav Kysela <perex@perex.cz> - -Upstream-Status: Backport [https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40] -Signed-off-by: Peter Marko <peter.marko@siemens.com> ---- - src/topology/ctl.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/src/topology/ctl.c b/src/topology/ctl.c -index a0c24518..322c461c 100644 ---- a/src/topology/ctl.c -+++ b/src/topology/ctl.c -@@ -1250,6 +1250,11 @@ int tplg_decode_control_mixer1(snd_tplg_t *tplg, - if (mc->num_channels > 0) { - map = tplg_calloc(heap, sizeof(*map)); - map->num_channels = mc->num_channels; -+ if (map->num_channels > SND_TPLG_MAX_CHAN || -+ map->num_channels > SND_SOC_TPLG_MAX_CHAN) { -+ snd_error(TOPOLOGY, "mixer: unexpected channel count %d", map->num_channels); -+ return -EINVAL; -+ } - for (i = 0; i < map->num_channels; i++) { - map->channel[i].reg = mc->channel[i].reg; - map->channel[i].shift = mc->channel[i].shift; diff --git a/meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb b/meta/recipes-multimedia/alsa/alsa-lib_1.2.16.1.bb similarity index 91% rename from meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb rename to meta/recipes-multimedia/alsa/alsa-lib_1.2.16.1.bb index 1ebb3569256..0c81e3cb3b9 100644 --- a/meta/recipes-multimedia/alsa/alsa-lib_1.2.15.3.bb +++ b/meta/recipes-multimedia/alsa/alsa-lib_1.2.16.1.bb @@ -10,8 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a916467b91076e631dd8edb7424769c7 \ " SRC_URI = "https://www.alsa-project.org/files/pub/lib/${BP}.tar.bz2" -SRC_URI += "file://CVE-2026-25068.patch" -SRC_URI[sha256sum] = "7b079d614d582cade7ab8db2364e65271d0877a37df8757ac4ac0c8970be861e" +SRC_URI[sha256sum] = "f740db7f488255944ffd4428416ee3390a96742856916433df468c281436480e" inherit autotools pkgconfig
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> --- .../alsa/alsa-lib/CVE-2026-25068.patch | 34 ------------------- ...a-lib_1.2.15.3.bb => alsa-lib_1.2.16.1.bb} | 3 +- 2 files changed, 1 insertion(+), 36 deletions(-) delete mode 100644 meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch rename meta/recipes-multimedia/alsa/{alsa-lib_1.2.15.3.bb => alsa-lib_1.2.16.1.bb} (91%)