new file mode 100644
@@ -0,0 +1,74 @@
+From c2640fe5171c59f87c58dc9fcb195b2d18b010ee Mon Sep 17 00:00:00 2001
+From: Arkadi Vainbrand <arkadva8@gmail.com>
+Date: Tue, 13 Jan 2026 12:22:04 +0200
+Subject: [PATCH] Fix buffer size handling in filename conversion
+
+* src/url.c (convert_fname): Fix buffer overflow.
+
+Copyright-paperwork-exempt: Yes
+
+CVE: CVE-2026-58471
+
+Upstream-Status: Backport [https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee]
+
+Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
+Signed-off-by: Ghanshyam Banait <Ghanshyam.BanaitSanjay@windriver.com>
+---
+ src/url.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/src/url.c b/src/url.c
+index 7540e90f..f334456c 100644
+--- a/src/url.c
++++ b/src/url.c
+@@ -1614,7 +1614,7 @@ convert_fname (char *fname)
+ const char *from_encoding = opt.encoding_remote;
+ const char *to_encoding = opt.locale;
+ iconv_t cd;
+- size_t len, done, inlen, outlen;
++ size_t len, inlen, outlen;
+ char *s;
+ const char *orig_fname;
+
+@@ -1636,7 +1636,6 @@ convert_fname (char *fname)
+ inlen = strlen (fname);
+ len = outlen = inlen * 2;
+ converted_fname = s = xmalloc (outlen + 1);
+- done = 0;
+
+ for (;;)
+ {
+@@ -1644,7 +1643,7 @@ convert_fname (char *fname)
+ if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
+ && iconv (cd, NULL, NULL, &s, &outlen) == 0)
+ {
+- *(converted_fname + len - outlen - done) = '\0';
++ *s = '\0';
+ iconv_close (cd);
+ DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
+ orig_fname, from_encoding, converted_fname, to_encoding));
+@@ -1667,10 +1666,17 @@ convert_fname (char *fname)
+ }
+ else if (errno == E2BIG) /* Output buffer full */
+ {
+- done = len;
+- len = outlen = done + inlen * 2;
+- converted_fname = xrealloc (converted_fname, outlen + 1);
+- s = converted_fname + done;
++ size_t used = s - converted_fname;
++ size_t newlen = used + inlen * 2 + 1;
++
++ /* Ensure we actually grow the buffer */
++ if (newlen <= len)
++ newlen = len * 2;
++
++ converted_fname = xrealloc (converted_fname, newlen + 1);
++ len = newlen;
++ s = converted_fname + used;
++ outlen = len - used;
+ }
+ else /* Weird, we got an unspecified error */
+ {
+--
+GitLab
+
@@ -20,6 +20,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
file://CVE-2026-58469-regression_p2.patch \
file://CVE-2026-58472.patch \
file://CVE-2026-58472-regression.patch \
+ file://CVE-2026-58471.patch \
"
SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"
Backport patch to fix CVE-2026-58471. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58471 Upstream fix: https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee Signed-off-by: Ghanshyam Banait <Ghanshyam.BanaitSanjay@windriver.com> --- .../wget/wget/CVE-2026-58471.patch | 74 +++++++++++++++++++ meta/recipes-extended/wget/wget_1.25.0.bb | 1 + 2 files changed, 75 insertions(+) create mode 100644 meta/recipes-extended/wget/wget/CVE-2026-58471.patch