diff mbox series

[scarthgap] libpcre2: update to latest release branch hash 50b3c0d7ce

Message ID 20261016220249.3564587-1-peter.marko@siemens.com
State New
Headers show
Series [scarthgap] libpcre2: update to latest release branch hash 50b3c0d7ce | expand

Commit Message

Peter Marko Oct. 16, 2026, 10:02 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Handles CVE-2026-103111, CVE-2026-86145, CVE-2026-89158, CVE-2026-89160,
CVE-2026-89157, CVE-2026-89156 and CVE-2026-89161.

The project committed to have 5 year security support for each release
on a dedicated release branch.
Switch from release tarball to git fetcher to use this feature.

Git log with all changes and manually created CVE annotations:
$ git log --oneline pcre2-10.43..50b3c0d7ceaf23578d04e644c02781c322ef6cb0
50b3c0d7 Backport of pcre2-10.49-Fix-large-stack-allocation.patch [CVE-2026-103111]
b7d3ffd4 Backport of pcre2-10.48-Fix-DFA-workspace-overflows.patch [CVE-2026-86145]
9c11f0dc Backport of pcre2-10.48-Fix-compiler-integer-overflows.patch [CVE-2026-89158]
2866e543 Backport of pcre2-10.48-Fix-invalid-UTF-backwards-scans.patch [CVE-2026-89160]
714e1062 Backport of pcre2-10.48-Fix-allocation-byte-sizing.patch [CVE-2026-89157]
91759151 Backport of pcre2-10.48-Check-JIT-mode-before-validation.patch [CVE-2026-89156]
87f50503 Backport of pcre2-10.48-Fix-JIT-match-context-reuse.patch [CVE-2026-89161]
ed0e58f5 Backport of pcre2-10.48-Fix-JIT-STR_END.patch
dc733f56 Backport of pcre2-10.44-Fix-incorrect-compiling.patch
7f3e5400 Backport of pcre2-10.44-Fix-locking-region.patch

Diff of release tarball and git repository is:
Only in pcre2-10.43/: aclocal.m4
Only in pcre2-10.43/: ar-lib
Only in libpcre2-10.43+git/: autogen.sh
Only in libpcre2-10.43+git/: .bazelrc
Only in libpcre2-10.43+git/: BUILD.bazel
Only in libpcre2-10.43+git/: build.zig
Only in pcre2-10.43/: compile
Only in pcre2-10.43/: config.guess
Only in pcre2-10.43/: config.sub
Only in pcre2-10.43/: configure
Only in pcre2-10.43/: depcomp
Only in libpcre2-10.43+git/: .git
Only in libpcre2-10.43+git/: .github
Only in libpcre2-10.43+git/: .gitignore
Only in libpcre2-10.43+git/: index.md
Only in pcre2-10.43/: INSTALL
Only in pcre2-10.43/: install-sh
Only in pcre2-10.43/: ltmain.sh
Only in pcre2-10.43/m4: libtool.m4
Only in pcre2-10.43/m4: lt~obsolete.m4
Only in pcre2-10.43/m4: ltoptions.m4
Only in pcre2-10.43/m4: ltsugar.m4
Only in pcre2-10.43/m4: ltversion.m4
Only in libpcre2-10.43+git/: maint
Only in pcre2-10.43/: Makefile.in
Only in pcre2-10.43/: missing
Only in libpcre2-10.43+git/: MODULE.bazel
Only in libpcre2-10.43+git/: pcre2_fuzzer_16.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer_16.options
Only in libpcre2-10.43+git/: pcre2_fuzzer_32.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer_32.options
Only in libpcre2-10.43+git/: pcre2_fuzzer.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer.options
Only in libpcre2-10.43+git/: README.md
Only in pcre2-10.43/: test-driver
Only in libpcre2-10.43+git/: WORKSPACE.bazel

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../recipes-support/libpcre/libpcre2_10.43.bb | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)
diff mbox series

Patch

diff --git a/meta/recipes-support/libpcre/libpcre2_10.43.bb b/meta/recipes-support/libpcre/libpcre2_10.43.bb
index f744df88fad..743b0ec04e5 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.43.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.43.bb
@@ -10,23 +10,27 @@  SECTION = "devel"
 LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENCE;md5=321a5eb46acae6b6c1ff2c7a866d836a"
 
-SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2"
-
-GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
-UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
-
-SRC_URI[sha256sum] = "e2a53984ff0b07dfdb5ae4486bbb9b21cca8e7df2434096cc9bf1b728c350bcb"
+BASE_VER = "${@d.getVar('PV').split('+')[0]}"
+SRC_URI = "git://github.com/PCRE2Project/pcre2;protocol=https;branch=release/pcre2-${BASE_VER}"
+SRCREV = "50b3c0d7ceaf23578d04e644c02781c322ef6cb0"
+PV .= "+git"
 
 CVE_PRODUCT = "pcre2"
 
-S = "${WORKDIR}/pcre2-${PV}"
+CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
+CVE_STATUS_STABLE_BACKPORTS = "CVE-2026-103111 CVE-2026-86145 CVE-2026-89158 CVE-2026-89160 \
+    CVE-2026-89157 CVE-2026-89156 CVE-2026-89161 \
+"
+CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
+
+S = "${WORKDIR}/git"
 
 PROVIDES += "pcre2"
 DEPENDS += "bzip2 zlib"
 
 BINCONFIG = "${bindir}/pcre2-config"
 
-inherit autotools binconfig-disabled github-releases
+inherit autotools binconfig-disabled
 
 EXTRA_OECONF = "\
     --enable-newline-is-lf \