| Message ID | 20260707143421.34255-1-jaipaul.cheernam@est.tech |
|---|---|
| State | Superseded, archived |
| Headers | show |
| Series | gzip: fix CVE-2026-41992 | expand |
On Tue Jul 7, 2026 at 4:34 PM CEST, Jaipaul Cheernam via lists.openembedded.org wrote: > Backport upstream fix for a global buffer overflow in the LZH > decompression logic (unlzh.c). The left[] and right[] global arrays > shared across LZW and LZH decompression routines are not reinitialized > between files processed in the same invocation, allowing an > out-of-bounds read in the LZH decoder. > > Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41992 > Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> > --- > .../gzip/gzip-1.14/CVE-2026-41992.patch | 32 +++++++++++++++++++ > meta/recipes-extended/gzip/gzip_1.14.bb | 1 + > 2 files changed, 33 insertions(+) > create mode 100644 meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch > > diff --git a/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch b/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch > new file mode 100644 > index 0000000000..5d3534fcb1 > --- /dev/null > +++ b/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch > @@ -0,0 +1,32 @@ > +From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001 > +From: Paul Eggert <eggert@cs.ucla.edu> > +Date: Wed, 15 Apr 2026 12:00:17 -0700 > +Subject: gzip: don't mishandle .lzh after .Z > + > +Problem reported by Michal Majchrowicz. > +* unlzh.c (read_c_len): Clear left and right when n == 0. > + > +CVE: CVE-2026-41992 > +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681] > +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Hello, This patch is slightly different from upstream (without explanation): -Subject: =?UTF-8?q?gzip:=20don=E2=80=99t=20mishandle=20.lzh=20after=20.Z?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit +Subject: gzip: don't mishandle .lzh after .Z -Problem reported by Michał Majchrowicz. +Problem reported by Michal Majchrowicz. ... and the THANKS file was dropped. Michał name was transcribed as Michal. I don't know how "nitpickery" it is... Regards,
Hi Yoann, Something went wrong from myside. I will check and share v2 . Apologies for the confusion. Regards, Jaipaul
diff --git a/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch b/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch new file mode 100644 index 0000000000..5d3534fcb1 --- /dev/null +++ b/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch @@ -0,0 +1,32 @@ +From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001 +From: Paul Eggert <eggert@cs.ucla.edu> +Date: Wed, 15 Apr 2026 12:00:17 -0700 +Subject: gzip: don't mishandle .lzh after .Z + +Problem reported by Michal Majchrowicz. +* unlzh.c (read_c_len): Clear left and right when n == 0. + +CVE: CVE-2026-41992 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681] +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> +--- + unlzh.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/unlzh.c b/unlzh.c +index 3320196..a6cf109 100644 +--- a/unlzh.c ++++ b/unlzh.c +@@ -232,6 +232,12 @@ read_c_len () + c = getbits(CBIT); + for (i = 0; i < NC; i++) c_len[i] = 0; + for (i = 0; i < 4096; i++) c_table[i] = c; ++ ++ /* Needed in case LEFT and RIGHT are reused from a previous ++ LZW decompression. It may be overkill to clear all of both ++ arrays, but nobody has had time to analyze this carefully. */ ++ memzero(left, (2 * NC - 1) * sizeof *left); ++ memzero(right, (2 * NC - 1) * sizeof *left); + } else { + i = 0; + while (i < n) { diff --git a/meta/recipes-extended/gzip/gzip_1.14.bb b/meta/recipes-extended/gzip/gzip_1.14.bb index c7837cdae0..99174a58c5 100644 --- a/meta/recipes-extended/gzip/gzip_1.14.bb +++ b/meta/recipes-extended/gzip/gzip_1.14.bb @@ -6,6 +6,7 @@ LICENSE = "GPL-3.0-or-later" SRC_URI = "${GNU_MIRROR}/gzip/${BP}.tar.gz \ file://run-ptest \ + file://CVE-2026-41992.patch \ " SRC_URI:append:class-target = " file://wrong-path-fix.patch"
Backport upstream fix for a global buffer overflow in the LZH decompression logic (unlzh.c). The left[] and right[] global arrays shared across LZW and LZH decompression routines are not reinitialized between files processed in the same invocation, allowing an out-of-bounds read in the LZH decoder. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41992 Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> --- .../gzip/gzip-1.14/CVE-2026-41992.patch | 32 +++++++++++++++++++ meta/recipes-extended/gzip/gzip_1.14.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch