diff mbox series

[OE-core,scartgap,2/4] imagemagick: Fix CVE-2026-23874

Message ID 20260217065123.1001038-2-bhabu.bindu@kpit.com
State New
Headers show
Series [OE-core,scartgap,1/4] imagemagick: Fix CVE-2026-22770 | expand

Commit Message

Bhabu Bindu Feb. 17, 2026, 6:51 a.m. UTC 
Fix CVE-2026-23874 with patch provided by Debian from fixed version.

Link: https://security-tracker.debian.org/tracker/CVE-2026-23874

Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
---
 .../imagemagick/CVE-2026-23874.patch          | 40 +++++++++++++++++++
 .../imagemagick/imagemagick_7.1.1.bb          |  1 +
 2 files changed, 41 insertions(+)
 create mode 100644 meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-23874.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-23874.patch b/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-23874.patch
new file mode 100644
index 0000000000..59fa8354e2
--- /dev/null
+++ b/meta-oe/recipes-support/imagemagick/imagemagick/CVE-2026-23874.patch
@@ -0,0 +1,40 @@ 
+From 2a09644b10a5b146e0a7c63b778bd74a112ebec3 Mon Sep 17 00:00:00 2001
+From: Cristy <urban-warrior@imagemagick.org>
+Date: Thu, 15 Jan 2026 17:50:19 -0500
+Subject: [PATCH] MSL: Stack overflow via infinite recursion in
+ ProcessMSLScript
+
+CVE: CVE-2026-23874
+Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/2a09644b10a5b146e0a7c63b778bd74a112ebec3]
+Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
+---
+ coders/msl.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/coders/msl.c b/coders/msl.c
+index 5b182b5922f..53e3a95d14b 100644
+--- a/coders/msl.c
++++ b/coders/msl.c
+@@ -7041,9 +7041,19 @@ static void MSLStartElement(void *context,const xmlChar *tag,
+ 
+           /* process */
+           {
+-            *msl_info->image_info[n]->magick='\0';
+-            (void) WriteImage(msl_info->image_info[n], msl_info->image[n],
+-              msl_info->exception);
++            (void) CopyMagickString(msl_info->image_info[n]->filename,
++              msl_info->image[n]->filename,MagickPathExtent);
++            (void) SetImageInfo(msl_info->image_info[n],1,exception);
++            if (LocaleCompare(msl_info->image_info[n]->magick,"msl") != 0)
++              {
++                *msl_info->image_info[n]->magick='\0';
++                (void) WriteImage(msl_info->image_info[n],msl_info->image[n],
++                  msl_info->exception);
++              }
++            else
++              (void) ThrowMagickException(msl_info->exception,GetMagickModule(),
++                FileOpenError,"UnableToWriteFile","`%s'",
++                msl_info->image[n]->filename);
+             break;
+           }
+         }
diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.1.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.1.bb
index 94b2df10a2..0a1d34e313 100644
--- a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.1.bb
+++ b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.1.bb
@@ -26,6 +26,7 @@  SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=htt
            file://CVE-2025-62171.patch \
            file://CVE-2025-65955.patch \
            file://CVE-2026-22770.patch \
+           file://CVE-2026-23874.patch \
            "
 SRCREV = "82572afc879b439cbf8c9c6f3a9ac7626adf98fb"