diff mbox series

[scarthgap] Backport patch to fix CVE-2026-12087.

Message ID 20261104104150.2043957-1-jakub.szczudlo@nokia.com
State Superseded, archived
Delegated to: Yoann Congal
Headers show
Series [scarthgap] Backport patch to fix CVE-2026-12087. | expand

Commit Message

Jakub Szczudlo (Nokia) Nov. 4, 2026, 10:41 a.m. UTC 
References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-12087

Upstream fix:
  https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb

Tested with ptest

Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
---
 .../perl/files/CVE-2026-12087.patch           | 165 ++++++++++++++++++
 meta/recipes-devtools/perl/perl_5.38.4.bb     |   1 +
 2 files changed, 166 insertions(+)
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-12087.patch

Comments

patchtest@automation.yoctoproject.org Nov. 4, 2026, 10:46 a.m. UTC | #1 
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/scarthgap-Backport-patch-to-fix-CVE-2026-12087..patch

FAIL: test shortlog format: Commit shortlog (first line of commit message) should follow the format "<target>: <summary>" (test_mbox.TestMbox.test_shortlog_format)

PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test CVE tag format (test_patch.TestPatch.test_cve_tag_format)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test Signed-off-by presence (test_patch.TestPatch.test_signed_off_by_presence)
PASS: test Upstream-Status presence (test_patch.TestPatch.test_upstream_status_presence_format)
PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
diff mbox series

Patch

diff --git a/meta/recipes-devtools/perl/files/CVE-2026-12087.patch b/meta/recipes-devtools/perl/files/CVE-2026-12087.patch
new file mode 100644
index 0000000000..535c9814d5
--- /dev/null
+++ b/meta/recipes-devtools/perl/files/CVE-2026-12087.patch
@@ -0,0 +1,165 @@ 
+From: Paul LeoNerd Evans <leonerd@leonerd.org.uk>
+Date: Mon, 4 May 2026 16:12:49 +0100
+Subject: cpan/Socket - Update to version 2.041
+
+2.041   2026-03-26
+        [CHANGES]
+         * Modernise Pod documentation formatting
+
+        [BUGFIXES]
+         * Fix reuse of `STRLEN len` variable in pack_ip_mreq_source()
+
+Backport changes:
+- Adjusted the upstream hunks to match the perl 5.38.4 code layout.
+- Drop not code files from the backport.
+
+CVE: CVE-2026-12087
+Upstream-Status: Backport [https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb]
+
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ cpan/Socket/Socket.xs | 87 +++++++++++++++++++++++++++++++++------------------
+ 1 file changed, 56 insertions(+), 31 deletions(-)
+
+diff --git a/cpan/Socket/Socket.xs b/cpan/Socket/Socket.xs
+index b4bccb7..5fc558b 100644
+--- a/cpan/Socket/Socket.xs
++++ b/cpan/Socket/Socket.xs
+@@ -1270,28 +1270,36 @@ pack_ip_mreq(multiaddr, interface=&PL_sv_undef)
+ 	struct ip_mreq mreq;
+ 	char * multiaddrbytes;
+ 	char * interfacebytes;
+-	STRLEN len;
+-	if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
+-		croak("Wide character in %s", "Socket::pack_ip_mreq");
+-	multiaddrbytes = SvPVbyte(multiaddr, len);
+-	if (len != sizeof(mreq.imr_multiaddr))
+-		croak("Bad arg length %s, length is %" UVuf
+-                      ", should be %" UVuf,
+-		      "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr));
++
++        {
++            if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
++                croak("Wide character in %s", "Socket::pack_ip_mreq");
++
++            STRLEN len;
++            multiaddrbytes = SvPVbyte(multiaddr, len);
++            if (len != sizeof(mreq.imr_multiaddr))
++                croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
++                        "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr));
++        }
++
+ 	Zero(&mreq, sizeof(mreq), char);
+ 	Copy(multiaddrbytes, &mreq.imr_multiaddr, sizeof(mreq.imr_multiaddr), char);
+ 	if(SvOK(interface)) {
+ 		if (DO_UTF8(interface) && !sv_utf8_downgrade(interface, 1))
+ 			croak("Wide character in %s", "Socket::pack_ip_mreq");
++
++            STRLEN len;
+ 		interfacebytes = SvPVbyte(interface, len);
+ 		if (len != sizeof(mreq.imr_interface))
+ 			croak("Bad arg length %s, length is %" UVuf
+                               ", should be %" UVuf,
+ 			      "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_interface));
++
+ 		Copy(interfacebytes, &mreq.imr_interface, sizeof(mreq.imr_interface), char);
+ 	}
+ 	else
+ 		mreq.imr_interface.s_addr = INADDR_ANY;
++
+ 	ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq)));
+ #else
+ 	not_here("pack_ip_mreq");
+@@ -1332,27 +1340,38 @@ pack_ip_mreq_source(multiaddr, source, interface=&PL_sv_undef)
+ 	char * multiaddrbytes;
+ 	char * sourcebytes;
+ 	char * interfacebytes;
+-	STRLEN len;
+-	if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
+-		croak("Wide character in %s", "Socket::pack_ip_mreq_source");
+-	multiaddrbytes = SvPVbyte(multiaddr, len);
+-	if (len != sizeof(mreq.imr_multiaddr))
+-		croak("Bad arg length %s, length is %" UVuf
+-                      ", should be %" UVuf,
+-		      "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr));
+-	if (DO_UTF8(source) && !sv_utf8_downgrade(source, 1))
+-		croak("Wide character in %s", "Socket::pack_ip_mreq_source");
+-	if (len != sizeof(mreq.imr_sourceaddr))
+-		croak("Bad arg length %s, length is %" UVuf
+-                      ", should be %" UVuf,
+-		      "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_sourceaddr));
+-	sourcebytes = SvPVbyte(source, len);
++
++        {
++            if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
++                croak("Wide character in %s", "Socket::pack_ip_mreq_source");
++
++            STRLEN len;
++            multiaddrbytes = SvPVbyte(multiaddr, len);
++            if (len != sizeof(mreq.imr_multiaddr))
++                croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
++                        "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr));
++        }
++
++        {
++            if (DO_UTF8(source) && !sv_utf8_downgrade(source, 1))
++                croak("Wide character in %s", "Socket::pack_ip_mreq_source");
++
++            STRLEN len;
++            sourcebytes = SvPVbyte(source, len);
++            if (len != sizeof(mreq.imr_sourceaddr))
++                croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
++                        "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_sourceaddr));
++        }
++
+ 	Zero(&mreq, sizeof(mreq), char);
+ 	Copy(multiaddrbytes, &mreq.imr_multiaddr, sizeof(mreq.imr_multiaddr), char);
+ 	Copy(sourcebytes, &mreq.imr_sourceaddr, sizeof(mreq.imr_sourceaddr), char);
++
+ 	if(SvOK(interface)) {
+ 		if (DO_UTF8(interface) && !sv_utf8_downgrade(interface, 1))
+ 			croak("Wide character in %s", "Socket::pack_ip_mreq");
++
++            STRLEN len;
+ 		interfacebytes = SvPVbyte(interface, len);
+ 		if (len != sizeof(mreq.imr_interface))
+ 			croak("Bad arg length %s, length is %" UVuf
+@@ -1362,6 +1381,7 @@ pack_ip_mreq_source(multiaddr, source, interface=&PL_sv_undef)
+ 	}
+ 	else
+ 		mreq.imr_interface.s_addr = INADDR_ANY;
++
+ 	ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq)));
+ #else
+ 	PERL_UNUSED_VAR(multiaddr);
+@@ -1403,17 +1423,22 @@ pack_ipv6_mreq(multiaddr, ifindex)
+ #ifdef HAS_IPV6_MREQ
+ 	struct ipv6_mreq mreq;
+ 	char * multiaddrbytes;
+-	STRLEN len;
+-	if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
+-		croak("Wide character in %s", "Socket::pack_ipv6_mreq");
+-	multiaddrbytes = SvPVbyte(multiaddr, len);
+-	if (len != sizeof(mreq.ipv6mr_multiaddr))
+-		croak("Bad arg length %s, length is %" UVuf
+-                      ", should be %" UVuf,
+-		      "Socket::pack_ipv6_mreq", (UV)len, (UV)sizeof(mreq.ipv6mr_multiaddr));
++
++        {
++            if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
++                croak("Wide character in %s", "Socket::pack_ipv6_mreq");
++
++            STRLEN len;
++            multiaddrbytes = SvPVbyte(multiaddr, len);
++            if (len != sizeof(mreq.ipv6mr_multiaddr))
++                croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
++                        "Socket::pack_ipv6_mreq", (UV)len, (UV)sizeof(mreq.ipv6mr_multiaddr));
++        }
++
+ 	Zero(&mreq, sizeof(mreq), char);
+ 	Copy(multiaddrbytes, &mreq.ipv6mr_multiaddr, sizeof(mreq.ipv6mr_multiaddr), char);
+ 	mreq.ipv6mr_interface = ifindex;
++
+ 	ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq)));
+ #else
+ 	PERL_UNUSED_VAR(multiaddr);
diff --git a/meta/recipes-devtools/perl/perl_5.38.4.bb b/meta/recipes-devtools/perl/perl_5.38.4.bb
index 8ce5d3f5d0..df0f3ed0fb 100644
--- a/meta/recipes-devtools/perl/perl_5.38.4.bb
+++ b/meta/recipes-devtools/perl/perl_5.38.4.bb
@@ -25,6 +25,7 @@  SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \
            file://CVE-2026-57432-02.patch \
            file://CVE-2025-40909.patch \
            file://CVE-2026-19487.patch \
+           file://CVE-2026-12087.patch \
            "
 SRC_URI:append:class-native = " \
            file://perl-configpm-switch.patch \