diff mbox series

[meta-oe,wrynose,13/28] editorconfig-core-c: patch CVE-2026-40489

Message ID 20260902100511.2105916-13-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/28] libmxml: upgrade 4.0.4 -> 4.0.5 | expand

Commit Message

Ankur Tyagi Sept. 2, 2026, 10:04 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-40489

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../editorconfig-core-c/CVE-2026-40489.patch  | 39 +++++++++++++++++++
 .../editorconfig-core-c_0.12.9.bb             |  4 +-
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch
new file mode 100644
index 0000000000..e328052314
--- /dev/null
+++ b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch
@@ -0,0 +1,39 @@ 
+From 4d5fcd42739f0ae349efe4e9208c0f109bb7c141 Mon Sep 17 00:00:00 2001
+From: Hong Xu <hong@topbug.net>
+Date: Tue, 14 Apr 2026 23:11:39 -0700
+Subject: [PATCH] Merge commit from fork
+
+Completes the buffer-overflow fix from #87, which bounded writes into
+`pcre_str` but left the initial `strcpy` of `pattern` into `l_pattern`
+at the top of `ec_glob` unguarded. Sufficiently long patterns smash the
+stack before any of the bounds-checked code runs.
+
+Fix CVE-2026-40489
+
+(cherry picked from commit 5159be88ad50641d9843289adda791ba300421ff)
+
+CVE: CVE-2026-40489
+Upstream-Status: Backport [https://github.com/editorconfig/editorconfig-core-c/commit/5159be88ad50641d9843289adda791ba300421ff]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/lib/ec_glob.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/ec_glob.c b/src/lib/ec_glob.c
+index d36076d..0e7f7ac 100644
+--- a/src/lib/ec_glob.c
++++ b/src/lib/ec_glob.c
+@@ -96,8 +96,12 @@ int ec_glob(const char *pattern, const char *string)
+     _Bool                     are_braces_paired = 1;
+     UT_array *                nums;     /* number ranges */
+     int                       ret = 0;
++    size_t                    pattern_len = strlen(pattern);
+ 
+-    strcpy(l_pattern, pattern);
++    /* Reject patterns that would overflow l_pattern in the copy below. */
++    if (pattern_len >= sizeof(l_pattern))
++        return -1;
++    memcpy(l_pattern, pattern, pattern_len + 1);
+     p_pcre = pcre_str + 1;
+     pcre_str_end = pcre_str + 2 * PATTERN_MAX;
+ 
diff --git a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb
index 319c1724c0..8d182d0cd0 100644
--- a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb
+++ b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb
@@ -4,7 +4,9 @@  SECTION = "libs"
 LICENSE = "BSD-2-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=38f617473e9f7373b5e79baf437accf8"
 
-SRC_URI = "git://github.com/editorconfig/editorconfig-core-c.git;protocol=https;branch=master"
+SRC_URI = "git://github.com/editorconfig/editorconfig-core-c.git;protocol=https;branch=master \
+           file://CVE-2026-40489.patch \
+"
 
 SRCREV = "e082c947e7f7b14240195d55c060a6e1eda1b0a1"