diff mbox series

[scarthgap,07/15] glibc: patch CVE-2026-77117

Message ID 20261022224711.3783258-7-peter.marko@siemens.com
State New
Headers show
Series [scarthgap,01/15] glibc: patch CVE-2026-5928 | expand

Commit Message

Marko, Peter Oct. 22, 2026, 10:47 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Pick patch referencing this CVE from 3.41 branch (oldest release
still receiving security updates).

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../glibc/glibc/0037-CVE-2026-77117.patch     | 32 +++++++++++++++++++
 meta/recipes-core/glibc/glibc_2.39.bb         |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch
diff mbox series

Patch

diff --git a/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch b/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch
new file mode 100644
index 00000000000..fa42a548c34
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch
@@ -0,0 +1,32 @@ 
+From e43e46f94398b3de446fec11da1e7633ea5202ec Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 28 Aug 2026 10:26:07 +0200
+Subject: [PATCH] iconvdata: SHIFT_JISX0213 decoding lacks pending character
+ reset (CVE-2026-77117)
+
+This fixes bug 34556.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+(cherry picked from commit 68d94bbe50b7577d48998107d632ef3a0df050e3)
+
+CVE: CVE-2026-77117
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=e43e46f94398b3de446fec11da1e7633ea5202ec]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ iconvdata/shift_jisx0213.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/iconvdata/shift_jisx0213.c b/iconvdata/shift_jisx0213.c
+index 364298dcff..834fa81322 100644
+--- a/iconvdata/shift_jisx0213.c
++++ b/iconvdata/shift_jisx0213.c
+@@ -226,6 +226,9 @@
+ 	    STANDARD_FROM_LOOP_ERR_HANDLER (1);				      \
+ 	  }								      \
+       }									      \
++    else 								      \
++      /* There was a pending character.  Clear it.  */			      \
++      *statep = 0;							      \
+ 									      \
+     put32 (outptr, ch);							      \
+     outptr += 4;							      \
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 567d53dd6f6..3090b9cd277 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -69,6 +69,7 @@  SRC_URI =  "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
            file://0034-CVE-2026-6368.patch \
            file://0035-CVE-2026-19542.patch \
            file://0036-CVE-2026-19499.patch \
+           file://0037-CVE-2026-77117.patch \
 "
 S = "${WORKDIR}/git"
 B = "${WORKDIR}/build-${TARGET_SYS}"