diff mbox series

[meta-openembedded,scarthgap] cjson 1.7.18: Fix CVE-2025-57052

Message ID 20250919113331.2357-1-spushpka@cisco.com
State New
Headers show
Series [meta-openembedded,scarthgap] cjson 1.7.18: Fix CVE-2025-57052 | expand

Commit Message

Shubham Pushpkar -X (spushpka - E INFOCHIPS PRIVATE LIMITED at Cisco) Sept. 19, 2025, 11:33 a.m. UTC 
Upstream Repository: https://github.com/DaveGamble/cJSON.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57052
Type: Security Fix
CVE: CVE-2025-57052
Score: 9.8
Patch: https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa

Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
---
 .../cjson/cjson/CVE-2025-57052.patch          | 33 +++++++++++++++++++
 .../recipes-devtools/cjson/cjson_1.7.18.bb    |  1 +
 2 files changed, 34 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch

Comments

Ankur Tyagi Sept. 20, 2025, 6 a.m. UTC | #1 
Please send this patch for kirkstone and walnascar branch as well

On Fri, Sep 19, 2025 at 11:33 PM Shubham Pushpkar via
lists.openembedded.org <spushpka=cisco.com@lists.openembedded.org>
wrote:
>
> Upstream Repository: https://github.com/DaveGamble/cJSON.git
>
> Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57052
> Type: Security Fix
> CVE: CVE-2025-57052
> Score: 9.8
> Patch: https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa
>
> Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
> ---
>  .../cjson/cjson/CVE-2025-57052.patch          | 33 +++++++++++++++++++
>  .../recipes-devtools/cjson/cjson_1.7.18.bb    |  1 +
>  2 files changed, 34 insertions(+)
>  create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
>
> diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
> new file mode 100644
> index 0000000000..ed3d4a7eba
> --- /dev/null
> +++ b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
> @@ -0,0 +1,33 @@
> +From e53a1413304382d562176bed91609e00b4fcf87e Mon Sep 17 00:00:00 2001
> +From: Lee <peteralfredlee@gmail.com>
> +Date: Fri, 5 Sep 2025 14:53:20 +0800
> +Subject: [PATCH] fix the incorrect check in decode_array_index_from_pointer
> + (#957)
> +
> +this fixes CVE-2025-57052
> +
> +CVE: CVE-2025-57052
> +Upstream-Status: Backport [https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa]
> +
> +(cherry picked from commit 74e1ff4994aa4139126967f6d289b675b4b36fef)
> +Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
> +---
> + cJSON_Utils.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/cJSON_Utils.c b/cJSON_Utils.c
> +index 63651df..8fa24f8 100644
> +--- a/cJSON_Utils.c
> ++++ b/cJSON_Utils.c
> +@@ -282,7 +282,7 @@ static cJSON_bool decode_array_index_from_pointer(const unsigned char * const po
> +         return 0;
> +     }
> +
> +-    for (position = 0; (pointer[position] >= '0') && (pointer[0] <= '9'); position++)
> ++    for (position = 0; (pointer[position] >= '0') && (pointer[position] <= '9'); position++)
> +     {
> +         parsed_index = (10 * parsed_index) + (size_t)(pointer[position] - '0');
> +
> +--
> +2.44.1
> +
> diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
> index bdeab3055c..67d536cf24 100644
> --- a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
> +++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
> @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0"
>
>  SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \
>             file://run-ptest \
> +           file://CVE-2025-57052.patch \
>           "
>  SRCREV = "acc76239bee01d8e9c858ae2cab296704e52d916"
>
> --
> 2.35.6
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#119593): https://lists.openembedded.org/g/openembedded-devel/message/119593
> Mute This Topic: https://lists.openembedded.org/mt/115326142/3619737
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [ankur.tyagi85@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
Shubham Pushpkar -X (spushpka - E INFOCHIPS PRIVATE LIMITED at Cisco) Sept. 21, 2025, 3:19 p.m. UTC | #2 
Acknowledged. As suggested, I have prepared and shared the patch for both the kirkstone and walnascar Yocto release branches.

Thank you!


________________________________
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Sent: 20 September 2025 11:30
To: Shubham Pushpkar -X (spushpka - E INFOCHIPS PRIVATE LIMITED at Cisco) <spushpka@cisco.com>
Cc: openembedded-devel@lists.openembedded.org <openembedded-devel@lists.openembedded.org>; Viral Chavda (vchavda) <vchavda@cisco.com>; Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <deeratho@cisco.com>
Subject: Re: [oe] [meta-openembedded] [scarthgap] [PATCH] cjson 1.7.18: Fix CVE-2025-57052

Please send this patch for kirkstone and walnascar branch as well

On Fri, Sep 19, 2025 at 11:33 PM Shubham Pushpkar via
lists.openembedded.org <spushpka=cisco.com@lists.openembedded.org>
wrote:
>
> Upstream Repository: https://github.com/DaveGamble/cJSON.git
>
> Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57052
> Type: Security Fix
> CVE: CVE-2025-57052
> Score: 9.8
> Patch: https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa
>
> Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
> ---
>  .../cjson/cjson/CVE-2025-57052.patch          | 33 +++++++++++++++++++
>  .../recipes-devtools/cjson/cjson_1.7.18.bb    |  1 +
>  2 files changed, 34 insertions(+)
>  create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
>
> diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
> new file mode 100644
> index 0000000000..ed3d4a7eba
> --- /dev/null
> +++ b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
> @@ -0,0 +1,33 @@
> +From e53a1413304382d562176bed91609e00b4fcf87e Mon Sep 17 00:00:00 2001
> +From: Lee <peteralfredlee@gmail.com>
> +Date: Fri, 5 Sep 2025 14:53:20 +0800
> +Subject: [PATCH] fix the incorrect check in decode_array_index_from_pointer
> + (#957)
> +
> +this fixes CVE-2025-57052
> +
> +CVE: CVE-2025-57052
> +Upstream-Status: Backport [https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa]
> +
> +(cherry picked from commit 74e1ff4994aa4139126967f6d289b675b4b36fef)
> +Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
> +---
> + cJSON_Utils.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/cJSON_Utils.c b/cJSON_Utils.c
> +index 63651df..8fa24f8 100644
> +--- a/cJSON_Utils.c
> ++++ b/cJSON_Utils.c
> +@@ -282,7 +282,7 @@ static cJSON_bool decode_array_index_from_pointer(const unsigned char * const po
> +         return 0;
> +     }
> +
> +-    for (position = 0; (pointer[position] >= '0') && (pointer[0] <= '9'); position++)
> ++    for (position = 0; (pointer[position] >= '0') && (pointer[position] <= '9'); position++)
> +     {
> +         parsed_index = (10 * parsed_index) + (size_t)(pointer[position] - '0');
> +
> +--
> +2.44.1
> +
> diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
> index bdeab3055c..67d536cf24 100644
> --- a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
> +++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
> @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0"
>
>  SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \
>             file://run-ptest \
> +           file://CVE-2025-57052.patch \
>           "
>  SRCREV = "acc76239bee01d8e9c858ae2cab296704e52d916"
>
> --
> 2.35.6
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#119593): https://lists.openembedded.org/g/openembedded-devel/message/119593
> Mute This Topic: https://lists.openembedded.org/mt/115326142/3619737
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [ankur.tyagi85@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
Anuj Mittal Sept. 23, 2025, 2:16 a.m. UTC | #3 
On Fri, 2025-09-19 at 04:33 -0700, Shubham Pushpkar via
lists.openembedded.org wrote:
> Upstream Repository: https://github.com/DaveGamble/cJSON.git
> 
> Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57052
> Type: Security Fix
> CVE: CVE-2025-57052
> Score: 9.8
> Patch: https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa
> 
> Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>

Please fix your git config so the author information is correct when
sending patches.

Please see:
https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#fixing-your-from-identity

Thanks,

Anuj

> ---
>  .../cjson/cjson/CVE-2025-57052.patch          | 33
> +++++++++++++++++++
>  .../recipes-devtools/cjson/cjson_1.7.18.bb    |  1 +
>  2 files changed, 34 insertions(+)
>  create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2025-
> 57052.patch
> 
> diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-
> 57052.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-
> 57052.patch
> new file mode 100644
> index 0000000000..ed3d4a7eba
> --- /dev/null
> +++ b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
> @@ -0,0 +1,33 @@
> +From e53a1413304382d562176bed91609e00b4fcf87e Mon Sep 17 00:00:00
> 2001
> +From: Lee <peteralfredlee@gmail.com>
> +Date: Fri, 5 Sep 2025 14:53:20 +0800
> +Subject: [PATCH] fix the incorrect check in
> decode_array_index_from_pointer
> + (#957)
> +
> +this fixes CVE-2025-57052
> +
> +CVE: CVE-2025-57052
> +Upstream-Status: Backport
> [https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa]
> +
> +(cherry picked from commit 74e1ff4994aa4139126967f6d289b675b4b36fef)
> +Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
> +---
> + cJSON_Utils.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/cJSON_Utils.c b/cJSON_Utils.c
> +index 63651df..8fa24f8 100644
> +--- a/cJSON_Utils.c
> ++++ b/cJSON_Utils.c
> +@@ -282,7 +282,7 @@ static cJSON_bool
> decode_array_index_from_pointer(const unsigned char * const po
> +         return 0;
> +     }
> + 
> +-    for (position = 0; (pointer[position] >= '0') && (pointer[0] <=
> '9'); position++)
> ++    for (position = 0; (pointer[position] >= '0') &&
> (pointer[position] <= '9'); position++)
> +     {
> +         parsed_index = (10 * parsed_index) +
> (size_t)(pointer[position] - '0');
> + 
> +-- 
> +2.44.1
> +
> diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb b/meta-
> oe/recipes-devtools/cjson/cjson_1.7.18.bb
> index bdeab3055c..67d536cf24 100644
> --- a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
> +++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
> @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM =
> "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0"
>  
>  SRC_URI =
> "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \
>             file://run-ptest \
> +           file://CVE-2025-57052.patch \
>           "
>  SRCREV = "acc76239bee01d8e9c858ae2cab296704e52d916"
>  
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#119593):
> https://lists.openembedded.org/g/openembedded-devel/message/119593
> Mute This Topic: https://lists.openembedded.org/mt/115326142/3616702
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe:
> https://lists.openembedded.org/g/openembedded-devel/unsub [
> anuj.mittal@intel.com]
> -=-=-=-=-=-=-=-=-=-=-=-
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
new file mode 100644
index 0000000000..ed3d4a7eba
--- /dev/null
+++ b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch
@@ -0,0 +1,33 @@ 
+From e53a1413304382d562176bed91609e00b4fcf87e Mon Sep 17 00:00:00 2001
+From: Lee <peteralfredlee@gmail.com>
+Date: Fri, 5 Sep 2025 14:53:20 +0800
+Subject: [PATCH] fix the incorrect check in decode_array_index_from_pointer
+ (#957)
+
+this fixes CVE-2025-57052
+
+CVE: CVE-2025-57052
+Upstream-Status: Backport [https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa]
+
+(cherry picked from commit 74e1ff4994aa4139126967f6d289b675b4b36fef)
+Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
+---
+ cJSON_Utils.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cJSON_Utils.c b/cJSON_Utils.c
+index 63651df..8fa24f8 100644
+--- a/cJSON_Utils.c
++++ b/cJSON_Utils.c
+@@ -282,7 +282,7 @@ static cJSON_bool decode_array_index_from_pointer(const unsigned char * const po
+         return 0;
+     }
+ 
+-    for (position = 0; (pointer[position] >= '0') && (pointer[0] <= '9'); position++)
++    for (position = 0; (pointer[position] >= '0') && (pointer[position] <= '9'); position++)
+     {
+         parsed_index = (10 * parsed_index) + (size_t)(pointer[position] - '0');
+ 
+-- 
+2.44.1
+
diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
index bdeab3055c..67d536cf24 100644
--- a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
+++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb
@@ -6,6 +6,7 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0"
 
 SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \
            file://run-ptest \
+           file://CVE-2025-57052.patch \
          "
 SRCREV = "acc76239bee01d8e9c858ae2cab296704e52d916"