new file mode 100644
@@ -0,0 +1,67 @@
+From 73ed7ce85cc78effb94daf028c9af6b4e5252e50 Mon Sep 17 00:00:00 2001
+From: Collin Funk <collin.funk1@gmail.com>
+Date: Mon, 20 Apr 2026 23:43:51 -0700
+Subject: [PATCH] diff3: check for integer overflows when reading line numbers
+ from diff
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported by Michał Majchrowicz.
+* NEWS: Mention the bug fix.
+* src/diff3.c (readnum): Return nullptr if the line number would
+overflow.
+
+CVE: CVE-2026-53910
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ NEWS | 8 ++++++++
+ THANKS | 1 +
+ src/diff3.c | 3 ++-
+ 3 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/NEWS b/NEWS
+index a8115f7..bfe20d4 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,5 +1,13 @@
+ GNU diffutils NEWS -*- outline -*-
+
++ * Noteworthy changes in release ?.? (????-??-??) [?]
++
++** Bug fixes
++
++ diff3 no longer overflows integers when reading line numbers from the
++ diff program.
++ [bug present since "the beginning"]
++
+ * Noteworthy changes in release 3.12 (2025-04-08) [stable]
+
+ ** Bug fixes
+diff --git a/THANKS b/THANKS
+index a96b68d..a372954 100644
+--- a/THANKS
++++ b/THANKS
+@@ -13,6 +13,7 @@ Chris Hanson <cph@gnu.org>
+ Jim Kingdon <kingdon@panix.com>
+ Tom Lord <lord@gnu.org>
+ David J. MacKenzie <djm@gnu.org>
++Michał Majchrowicz <mmajchrowicz@afine.com>
+ Roland McGrath <roland@redhat.com>
+ Jim Meyering <jim@meyering.net>
+ Gene Myers <gene@eecs.berkeley.edu>
+diff --git a/src/diff3.c b/src/diff3.c
+index 1dfba37..1a74407 100644
+--- a/src/diff3.c
++++ b/src/diff3.c
+@@ -1020,7 +1020,8 @@ readnum (char *s, lin *pnum)
+
+ do
+ {
+- num = c - '0' + num * 10;
++ if (ckd_mul (&num, num, 10) || ckd_add (&num, num, c - '0'))
++ return nullptr;
+ c = *++s;
+ }
+ while (c_isdigit (c));
new file mode 100644
@@ -0,0 +1,35 @@
+From 9ff04d5b84743e331e80b589335a52c5480d1815 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 21 Apr 2026 00:30:50 -0700
+Subject: [PATCH] diff3: prevent overflow in line offsets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* src/diff3.c (readnum): Limit line numbers to LIN_MAX / 2.
+
+CVE: CVE-2026-53910
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/diff3.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/diff3.c b/src/diff3.c
+index 4fed6a8..d32e6ad 100644
+--- a/src/diff3.c
++++ b/src/diff3.c
+@@ -1026,6 +1026,12 @@ readnum (char *s, lin *pnum)
+ }
+ while (c_isdigit (c));
+
++ /* Simplify overflow checking later, so that we can always add a
++ line number and a line count, or subtract two line numbers and
++ add 1 to the result, without worrying about overflow. */
++ if (LIN_MAX / 2 < num)
++ return nullptr;
++
+ *pnum = num;
+ return s;
+ }
@@ -6,6 +6,8 @@ require diffutils.inc
SRC_URI = "${GNU_MIRROR}/diffutils/diffutils-${PV}.tar.xz \
file://run-ptest \
file://0001-Skip-strip-trailing-cr-test-case.patch \
+ file://CVE-2026-53910-01.patch \
+ file://CVE-2026-53910-02.patch \
"
SRC_URI[sha256sum] = "7c8b7f9fc8609141fdea9cece85249d308624391ff61dedaf528fcb337727dfd"
@@ -21,6 +23,13 @@ inherit ptest
RDEPENDS:${PN}-ptest += "make perl"
+# patch for CVE-2026-53910 touches source file, so build is trying to
+# refresh the manual, which is failing in cross-compile environment;
+# remove this code on next upgrade
+do_compile:prepend() {
+ touch ${S}/man/diff3.1
+}
+
do_install_ptest() {
t=${D}${PTEST_PATH}
install -D ${S}/build-aux/test-driver $t/build-aux/test-driver