diff mbox series

[blacksail,07/19] libpcre2: upgrade 10.48 -> 10.49

Message ID b87070e1fd10efb8f12d724faebf391ba1fd5a35.1791299195.git.yoann.congal@smile.fr
State New
Headers show
Series [blacksail,01/19] alsa-lib: patch CVE-2026-90781 | expand

Commit Message

Yoann Congal Oct. 6, 2026, 3:45 p.m. UTC 
From: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>

Version 10.49 28-September-2026
-------------------------------

This is a security-only release, to address GHSA-r9hj-j2rw-4q3m.

Compared to 10.48, this release has only a minimal code change to prevent an
out-of-bounds write with arbitrary data. An attacker-controlled regex pattern
is required, and applications are only affected if using the
pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable
JIT stack, and then matching against a pattern with unusually high JIT stack
usage, such as a large number of capturing groups.

The implications of an out-of-bounds write could include arbitrary code
execution.

The issue is not a regression and affects releases 10.48 and earlier.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fd7f3e10c98a1dc75473efae8ab14ea5bcfb1819)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: See: https://github.com/PCRE2Project/pcre2/compare/pcre2-10.48...pcre2-10.49 ]
---
 .../libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb}            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-support/libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} (96%)
diff mbox series

Patch

diff --git a/meta/recipes-support/libpcre/libpcre2_10.48.bb b/meta/recipes-support/libpcre/libpcre2_10.49.bb
similarity index 96%
rename from meta/recipes-support/libpcre/libpcre2_10.48.bb
rename to meta/recipes-support/libpcre/libpcre2_10.49.bb
index 56791171c23..5fa7c3db3b4 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.48.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb
@@ -20,7 +20,7 @@  SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
 GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
 UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
 
-SRC_URI[sha256sum] = "b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed"
+SRC_URI[sha256sum] = "53c156e1ba416a20da8e65395daa132da0d80e76910424caca3fcdae7831d384"
 
 CVE_PRODUCT = "pcre2"