diff mbox series

[meta-oe,blacksail,2/16] apitrace: patch CVE-2026-126050

Message ID 20261112044426.3933391-2-ankur.tyagi85@gmail.com
State Under Review
Delegated to: Ankur Tyagi
Headers show
Series [meta-oe,blacksail,1/16] 7zip: upgrade 26.05 -> 26.06 | expand

Commit Message

Ankur Tyagi Nov. 12, 2026, 4:44 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-126050

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../apitrace/apitrace/CVE-2026-126050.patch   | 39 +++++++++++++++++++
 .../apitrace/apitrace_14.0.bb                 |  1 +
 2 files changed, 40 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch b/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch
new file mode 100644
index 0000000000..4b0d3b2768
--- /dev/null
+++ b/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch
@@ -0,0 +1,39 @@ 
+From a7c7db06b56f22235eeea2da608ef84dd401f3b6 Mon Sep 17 00:00:00 2001
+From: Deus Rex research team <research@deusrex.ai>
+Date: Tue, 10 Nov 2026 13:05:32 +0000
+Subject: [PATCH] trace: Fix heap out-of-bounds write in
+ SnappyFile::flushReadCache().
+
+The Snappy trace reader takes each chunk's compressed length from a
+4-byte field in the file and reads that many bytes into
+m_compressedCache, a heap buffer allocated once with a fixed size of
+snappy::MaxCompressedLength(1 MiB) = 1223370 bytes.  The length is never
+compared with that size, so a .trace file that declares and supplies a
+longer chunk makes the read write past the end of the buffer.
+
+(cherry picked from commit 3890c5a448addfd75ccbe1bd09e3075de6fb3395)
+CVE: CVE-2026-126050.patch
+Upstream-Status: Backport [https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ lib/trace/trace_file_snappy.cpp | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/lib/trace/trace_file_snappy.cpp b/lib/trace/trace_file_snappy.cpp
+index 5b60ec9d..9b0a681d 100644
+--- a/lib/trace/trace_file_snappy.cpp
++++ b/lib/trace/trace_file_snappy.cpp
+@@ -224,6 +224,13 @@ void SnappyFile::flushReadCache(size_t skipLength)
+         return;
+     }
+ 
++    if (compressedLength > snappy::MaxCompressedLength(SNAPPY_CHUNK_SIZE)) {
++        std::cerr << "error: invalid compressed chunk length in trace\n";
++        m_stream.setstate(std::ios_base::failbit);
++        createCache(0);
++        return;
++    }
++
+     m_stream.read((char*)m_compressedCache, compressedLength);
+     if (m_stream.fail()) {
+         std::cerr << "warning: unexpected end of file while reading trace\n";
diff --git a/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb b/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb
index cb5ee92e04..7c51f45842 100644
--- a/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb
+++ b/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb
@@ -8,6 +8,7 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=aeb969185a143c3c25130bc2c3ef9a50 \
 SRCREV = "18cfd388ac47a9e00978b34d6c20341f3e2cdb56"
 SRC_URI = "gitsm://github.com/${BPN}/${BPN}.git;branch=master;protocol=https;tag=${PV} \
            file://0001-zstd-disable-the-x86-64-BMI2-assembly-fast-loops.patch \
+           file://CVE-2026-126050.patch \
            "
 
 DEPENDS += "zlib libpng python3-native"