| Message ID | 20261112062505.4067039-1-ankur.tyagi85@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [oe,meta-oe,blacksail,v2] mpv: patch CVE-2026-123095 | expand |
Thank you for your submission. Patchtest identified one or more issues with the patch. Please see the log below for more information: --- Testing patch /home/patchtest/share/mboxes/oe-meta-oe-blacksail-v2-mpv-patch-CVE-2026-123095.patch FAIL: test target mailing list: Series sent to the wrong mailing list or some patches from the series correspond to different mailing lists (test_mbox.TestMbox.test_target_mailing_list) PASS: test CVE tag format (test_patch.TestPatch.test_cve_tag_format) PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence) PASS: test Signed-off-by presence (test_patch.TestPatch.test_signed_off_by_presence) PASS: test Upstream-Status presence (test_patch.TestPatch.test_upstream_status_presence_format) PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice) PASS: test author valid (test_mbox.TestMbox.test_author_valid) PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence) PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags) PASS: test max line length (test_metadata.TestMetadata.test_max_line_length) PASS: test mbox format (test_mbox.TestMbox.test_mbox_format) PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade) PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format) PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length) SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint) SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files) SKIP: test CVE check ignore: No modified recipes or older target branch, skipping test (test_metadata.TestMetadata.test_cve_check_ignore) SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format) SKIP: test lic files chksum modified not mentioned: No modified recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned) SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence) SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence) SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint) SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head) SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files) SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence) --- Please address the issues identified and submit a new revision of the patch, or alternatively, reply to this email with an explanation of why the patch should be accepted. If you believe these results are due to an error in patchtest, please submit a bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category under 'Yocto Project Subprojects'). For more information on specific failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank you!
diff --git a/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch b/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch new file mode 100644 index 0000000000..1efa0fdee6 --- /dev/null +++ b/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch @@ -0,0 +1,37 @@ +From 2c6599aa7d16efd29ae49865757eb449d9306742 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <kasper93@gmail.com> +Date: Wed, 4 Nov 2026 20:28:57 +0100 +Subject: [PATCH] ytdl_hook: reject playlist entry URLs with control characters + +The entries are joined into a memory:// M3U playlist, one URL per line. +A URL with a line break became several entries, and only the first line +went through url_is_safe(). The other lines were loaded with the origin +of the opened URL, so any protocol was allowed. Skip any URLs with +control characters. + +Fixes: e6e6b0dcc7 +Fixes: GHSA-p99g-m25w-x8xv +(cherry picked from commit c3096515dcd26c14004f985538b5aa41db613856) + +CVE: CVE-2026-123095 +Upstream-Status: Backport [https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856] + +Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> +--- + player/lua/ytdl_hook.lua | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/player/lua/ytdl_hook.lua b/player/lua/ytdl_hook.lua +index 65ef859595..2b0edb193a 100644 +--- a/player/lua/ytdl_hook.lua ++++ b/player/lua/ytdl_hook.lua +@@ -1111,6 +1111,9 @@ local function run_ytdl_hook(url) + -- links without protocol as returned by --flat-playlist + if not site then + msg.error("Playlist entry does not have unique URL, can't add it.") ++ elseif site:find("%c") then ++ -- a line break would add entries to the playlist ++ msg.error("Playlist entry URL contains control characters, can't add it.") + elseif not site:find("://") then + -- youtube extractor provides only IDs, + -- others come prefixed with the extractor name and ":" diff --git a/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb b/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb index f37ae4ac50..0c99e354e7 100644 --- a/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb +++ b/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb @@ -27,6 +27,7 @@ SRC_URI = " \ git://github.com/mpv-player/mpv;name=mpv;branch=release/${@oe.utils.trim_version('${PV}', 2)};protocol=https;tag=v${PV} \ file://0001-opengl-context-require-swap_buffers-param-for-FenceS.patch \ file://0002-hwdec_drmprime_overlay-make-the-framebuffer-the-whole-frame.patch \ + file://CVE-2026-123095.patch \ " inherit meson pkgconfig mime-xdg