diff mbox series

[meta-oe,kirkstone,3/5] raptor2: patch CVE-2024-57822

Message ID 20260112112016.515266-3-skandigraun@gmail.com
State New
Headers show
Series [meta-oe,kirkstone,1/5] raptor2: patch CVE-2017-18926 | expand

Commit Message

Gyorgy Sarvari Jan. 12, 2026, 11:20 a.m. UTC 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-57822

Pick the patch mentioned in the related github issue[1].
The issue contains fixes for 2 issues, but only the first
patch is related to this vulnerability.

[1]: https://github.com/dajobe/raptor/issues/70

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 .../raptor2/files/CVE-2024-57822.patch        | 42 +++++++++++++++++++
 .../recipes-support/raptor2/raptor2_2.0.15.bb |  1 +
 2 files changed, 43 insertions(+)
 create mode 100644 meta-oe/recipes-support/raptor2/files/CVE-2024-57822.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/raptor2/files/CVE-2024-57822.patch b/meta-oe/recipes-support/raptor2/files/CVE-2024-57822.patch
new file mode 100644
index 0000000000..ee31474cf9
--- /dev/null
+++ b/meta-oe/recipes-support/raptor2/files/CVE-2024-57822.patch
@@ -0,0 +1,42 @@ 
+From 9dc72f9534df6e2b94ce22ceb3d90224c1153184 Mon Sep 17 00:00:00 2001
+From: Dave Beckett <dave@dajobe.org>
+Date: Thu, 6 Feb 2025 21:12:37 -0800
+Subject: [PATCH] Fix Github issue 70 A) Integer Underflow in
+ raptor_uri_normalize_path()
+
+(raptor_uri_normalize_path): Return empty buffer if path gets to 0
+length
+
+CVE: CVE-2024-57822
+Upstream-Status: Backport [https://github.com/dajobe/raptor/commit/da7a79976bd0314c23cce55d22495e7d29301c44]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/raptor_rfc2396.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/raptor_rfc2396.c b/src/raptor_rfc2396.c
+index 89183d9..2f0195f 100644
+--- a/src/raptor_rfc2396.c
++++ b/src/raptor_rfc2396.c
+@@ -351,6 +351,10 @@ raptor_uri_normalize_path(unsigned char* path_buffer, size_t path_len)
+           *dest++ = *s++;
+         *dest = '\0';
+         path_len -= len;
++        if(path_len <= 0) {
++          *path_buffer = '\0';
++          return 0;
++        }
+ 
+         if(p && p < prev) {
+           /* We know the previous prev path component and we didn't do
+@@ -390,6 +394,10 @@ raptor_uri_normalize_path(unsigned char* path_buffer, size_t path_len)
+     /* Remove <component>/.. at the end of the path */
+     *prev = '\0';
+     path_len -= (s-prev);
++    if(path_len <= 0) {
++      *path_buffer = '\0';
++      return 0;
++    }
+   }
+ 
+ 
diff --git a/meta-oe/recipes-support/raptor2/raptor2_2.0.15.bb b/meta-oe/recipes-support/raptor2/raptor2_2.0.15.bb
index 7ee097b6ce..d110b8475f 100644
--- a/meta-oe/recipes-support/raptor2/raptor2_2.0.15.bb
+++ b/meta-oe/recipes-support/raptor2/raptor2_2.0.15.bb
@@ -13,6 +13,7 @@  SRC_URI = "http://download.librdf.org/source/${BPN}-${PV}.tar.gz \
            file://0001-configure.ac-do-additional-checks-on-libxml2-also-wh.patch \
            file://CVE-2017-18926.patch \
            file://CVE-2020-25713.patch \
+           file://CVE-2024-57822.patch \
            "
 SRC_URI[md5sum] = "a39f6c07ddb20d7dd2ff1f95fa21e2cd"
 SRC_URI[sha256sum] = "ada7f0ba54787b33485d090d3d2680533520cd4426d2f7fb4782dd4a6a1480ed"