From patchwork Fri Dec 12 15:39:54 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 76381 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18AECD59D68 for ; Fri, 12 Dec 2025 15:40:16 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15354.1765554013341230784 for ; Fri, 12 Dec 2025 07:40:13 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=qvJ2xcIR; spf=softfail (domain: sakoman.com, ip: 209.85.214.177, mailfrom: steve@sakoman.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-295548467c7so16134715ad.2 for ; Fri, 12 Dec 2025 07:40:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1765554012; x=1766158812; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=RZcbCTznQpLU7e3tx45mfU0avwWWUvLdma7vm5TVduU=; b=qvJ2xcIRRgB+LGq+KQLLK61u/a6g7E5B9nQ3GIn00jHlWxvDZi2wm/CuioIoaVXqLH zMlNJiT6uVV9aIuK5rVlGWNaVmQ8rOynKOIu7yDOxoqaborFuaGGP+rTMLWAr2syzCQ0 eLkBUTEfmsMZPLvLK7mcFAk7EXFV0vWYIi1epP8BDw4telHMXCBEK5lm/Zw8GuNM7E+q r97VD34PVemCfILHeqJ2YHcxFchX9x+mZLhjCb8bJ/Kfbhf3eUEtFxES8fzDEd5AUC/0 PEYseaOoxd0svs4bWmrVfv7aqa3MLtGiEcfoUBhHFL/yKjOzST4ZKmIs2iAR6+JADzJL LnCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765554012; x=1766158812; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=RZcbCTznQpLU7e3tx45mfU0avwWWUvLdma7vm5TVduU=; b=r3ssNEtzWD5pxFfjszzZZZfsfuoulA3JfNDR70EscaXA8jFVj+2vPKsedR+4jVSHfM tIQIgRReDN/H4PSTbU1m6vXvxd4zp2Ssu6c1+VMPHu7YOuyWvo/wi0mgitnXDn41kLhn 9w1vcoUp2Y9NGId6UVHtO+APnV57Lx6h1LVGaus6nFz6ALQdVBTbslJpxMAMdp7pLIA9 SJeeLqqTFGsyrjPuQe3kDiADUdJD4sQIrE6DYJl8q1tNdvwZgto4x2ajDT8EwceVQB+D dpf+0AxdATJiyOU71zgXdDiFSC3eUSa5ubqqlt83zZHeYrVAMcHUVYINPT9KSDrzOCSZ x96Q== X-Gm-Message-State: AOJu0YzfdmG+xFLecFREPzuHHoIiAeVC1d5fH1KWceqXVJK1xqo+Fp+l /HfkD6Ii3ulCrqwR+2HLLREdpbsOVExZpvKVzv2xJg30HvJQKIVyofZloFkrOzvwlnLwBqe42Ue QjkYJ X-Gm-Gg: AY/fxX7e47snw71kb1f6V5bCV8vo/fqUzjsZTGEf3lmDCWTGmx3KYxB08Ti/JbsULwP 3G9HOwzrcaKycPHLz+iGMzeeyEeEM3rKpZfCcrTb2uKuRcBnLaKnDTILechKE0rG4y7pXKsSFnX Y72rnKcW3m/FrfUB+IkbojVm4xCQWYKk/f0bTfcoU29f7JV7TS4XKsqkZBh0x3NkKHd4/6OBIng qkhB8Y40lAQ7gdB49u/te7JU8AHN0iQDpmoEFkcSd/HVhYTXWg9+IWMtGWRC3nOC3in3CzEe7rw DG8TNYgyC8/YWPvLbe4slrCt2f14v4LvVmwVRWJRfwVrRP5MhAKMOA4JviJ3TN6mTD7CI7xPeMh p1gcnq3dA7h5sI8t4iZXY155ZkV6cL4mjNAwixj+05RmXmCDQAvcwM5k+BET2lXds1srL/vC/wF 4eig== X-Google-Smtp-Source: AGHT+IHssg9Xgeant2yZEOLgAqpeUx4P0L7SsJuusDZ6HJKqA7MW3db9gvuPYHQcW80oP6fkUfbH4Q== X-Received: by 2002:a17:902:d4cb:b0:29f:1bc6:ac92 with SMTP id d9443c01a7336-29f26eefe9dmr17547185ad.51.1765554012585; Fri, 12 Dec 2025 07:40:12 -0800 (PST) Received: from hexa.. ([2602:feb4:3b:2100:5e34:462b:e2f0:5898]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34abe23edc4sm917549a91.1.2025.12.12.07.40.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Dec 2025 07:40:12 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 1/7] classes/create-spdx-2.2: Define SPDX_VERSION to 2.2 Date: Fri, 12 Dec 2025 07:39:54 -0800 Message-ID: <04cc49593a0ba2c51e4f4d477d4587079735b624.1765553842.git.steve@sakoman.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 12 Dec 2025 15:40:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/227601 From: Daniel Turull SPDX_VERSION is used in DEPLOY_DIR_SPDX but if is not defined, will default to SPDX-1.1 Define SPDX_VERSION to have the correct deploy path, to align with master branch behaviour. The change in path was introduced in 8996d0899d CC: Kamel Bouhara (Schneider Electric) CC: JPEWhacker@gmail.com Signed-off-by: Daniel Turull Signed-off-by: Steve Sakoman --- meta/classes/create-spdx-2.2.bbclass | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass index 2351a3d5a1..aaa2e78fe2 100644 --- a/meta/classes/create-spdx-2.2.bbclass +++ b/meta/classes/create-spdx-2.2.bbclass @@ -4,6 +4,8 @@ # SPDX-License-Identifier: GPL-2.0-only # +SPDX_VERSION = "2.2" + DEPLOY_DIR_SPDX ??= "${DEPLOY_DIR}/spdx/${SPDX_VERSION}" # The product name that the CVE database uses. Defaults to BPN, but may need to From patchwork Fri Dec 12 15:39:55 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 76383 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25E80D59D6B for ; Fri, 12 Dec 2025 15:40:16 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15356.1765554015138855671 for ; Fri, 12 Dec 2025 07:40:15 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=MTy6J9bu; spf=softfail (domain: sakoman.com, ip: 209.85.216.49, mailfrom: steve@sakoman.com) Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-34c213f7690so209862a91.2 for ; Fri, 12 Dec 2025 07:40:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1765554014; x=1766158814; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=f7uu3iMTiclVBPf9HT8oF5LhP1jcfTDNfDz6OosPOxk=; b=MTy6J9bulTFbK8QsEIcTIujw0bxFnLHClVD8WoJ5AdkMmvFZ2tFnH+5vdqJBaS+RhL Zv4HY4jCGa9IHV5p5V3kz8jaEdewSxV2I2KOnX8AgFLlSWa9WMxQyioieEhbKDSsfCP9 L9BQYOuwot03qkDqTZA1mbQf8lZUxgcOifcBO9stu6g56hI0ieB2vFVpWLHh1Rmbqkfo ROkoKM3oQbGnBnyktZiGzpzL1n1gapyhOwvWlJgBNPZaGLn1KKY3v7xuNuWLu4I7vVyL FhTA/rT46w6i96uyLnAb3Q7qMT/yUWD6YPs91LgCzhbp7pfgGQChKZwOnEMZqlzthT1d Eh9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765554014; x=1766158814; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=f7uu3iMTiclVBPf9HT8oF5LhP1jcfTDNfDz6OosPOxk=; b=VyfnNbcX9ZvWYW/lg6JKQD136Gx7f5xYZg47BRTCUs3STDbs6jjyeRBf7uZ7dCRa3I OIhgGfTqH65JWtGzlBqF9DrxNYgSCxZdMnMn3BgZnsvIAsM3G89tQRsweNbvz7tbvgK8 b/ElxQoDEuPBvNmLs1VNREttY+OVQSSTJq09AvzE6hAk9enLyJmhVfhfJx47Tck8LTfQ 56KvYtTM5g8hrxQ+fahZsB4HajtZCn0n8DgjsaC/ZUhoeDyGSDM681Zs6vdO1nkJ36fh KYecnArWFdTNoV9/StfaKuKL53xdVEvcPPUgNtWW8KJ6fVYF0szWAk7Hk+F2M6reFIoR tJ5g== X-Gm-Message-State: AOJu0Yyn3lY2xSuLS/m+MNIR3cg8VoICETk94gjqqPWJuoUQXyY47UzG cWq7auJ2TENomoMGeJfAq9fmMPi0aUstj99XgJ61gVCDARWw01tvEWqaMZ9Lz3nYp3cQrlOL/a3 Bpbrt X-Gm-Gg: AY/fxX68BIeSZl4FoupnYr0brTV2KLc+IjtaMjslYe3kvVetxN23wq1kRu1HvfgfYk8 R6DWQ76S/0oXrm6m2/kkAFB/Wvx6gsSMpdViRPJy3Z1THvEYQRdFW8xLMykzYzHxChg6bSdgcBv Q31pxwBe4WIFaP3TR3WyIe/RSbhfnZ4oGaKIK0Z7JdqlO+PvaGim4p7Eu2Rp/ArB7+zt6UqLOGK 4kXmyDFJEqA0dkvyW8t2THof5mt+T31DfdmVZ4dk3cyF9i3Yl3zWrYL8MQWAyTcX2wlOMyFClcn h3pOSl78dQg85GGZ/1U9DPInz+Ul3mNhAnWZCB5Aed72tYuuaEVo2ukY57W3Aqrr1F86jhhmmuU G62iOH2sMaUObIF434HRYFavms7DauwmUi4gID5/sNMwIyjgR/Dk1w1t6+OEG01YS0DCQiqjbup NCUw1251HK5W0B X-Google-Smtp-Source: AGHT+IEuIEJ3cvIY1EuFrgrkc0LroX6bhHDj7d6r9tYTWHsszNtSW8FlN4pU8auVR2TKQaGgAi/7Rw== X-Received: by 2002:a17:90b:4cc8:b0:340:a5b2:c305 with SMTP id 98e67ed59e1d1-34abd6c6991mr1929139a91.2.1765554014246; Fri, 12 Dec 2025 07:40:14 -0800 (PST) Received: from hexa.. ([2602:feb4:3b:2100:5e34:462b:e2f0:5898]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34abe23edc4sm917549a91.1.2025.12.12.07.40.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Dec 2025 07:40:13 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 2/7] libpng: patch CVE-2025-66293 Date: Fri, 12 Dec 2025 07:39:55 -0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 12 Dec 2025 15:40:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/227602 From: Peter Marko Pick patches per nvd report [1] and github advisory [2]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-66293 [2] https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- .../libpng/files/CVE-2025-66293-01.patch | 60 +++++++++ .../libpng/files/CVE-2025-66293-02.patch | 125 ++++++++++++++++++ .../libpng/libpng_1.6.42.bb | 2 + 3 files changed, 187 insertions(+) create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch diff --git a/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch new file mode 100644 index 0000000000..0b958b9f1b --- /dev/null +++ b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch @@ -0,0 +1,60 @@ +From 788a624d7387a758ffd5c7ab010f1870dea753a1 Mon Sep 17 00:00:00 2001 +From: Cosmin Truta +Date: Sat, 29 Nov 2025 00:39:16 +0200 +Subject: [PATCH] Fix an out-of-bounds read in `png_image_read_composite` + +Add a defensive bounds check before calling PNG_sRGB_FROM_LINEAR to +prevent reading up to 506 entries (1012 bytes) past `png_sRGB_base[]`. + +For palette images with gamma, `png_init_read_transformations` +clears PNG_COMPOSE after compositing on the palette, but it leaves +PNG_FLAG_OPTIMIZE_ALPHA set. The simplified API then calls +`png_image_read_composite` with sRGB data (not linear premultiplied), +causing the index to reach 1017. (The maximum valid index is 511.) + +NOTE: +This is a defensive fix that addresses the security issue (out-of-bounds +read) but *NOT* the correctness issue (wrong output). When the clamp +triggers, the affected pixels are clamped to white instead of the +correct composited color. Valid PNG images may render incorrectly with +the simplified API. + +TODO: +We already know the root cause is a flag synchronization error. +For palette images with gamma, `png_init_read_transformations` +clears PNG_COMPOSE but leaves PNG_FLAG_OPTIMIZE_ALPHA set, causing +`png_image_read_composite` to misinterpret sRGB data as linear +premultiplied. However, we have yet to implement an architectural fix +that requires coordinating the simplified API with the transformation +pipeline. + +Reported-by: flyfish101 + +CVE: CVE-2025-66293 +Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1] +Signed-off-by: Peter Marko +--- + pngread.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/pngread.c b/pngread.c +index 79917daaa..ab62edd9d 100644 +--- a/pngread.c ++++ b/pngread.c +@@ -3406,9 +3406,14 @@ png_image_read_composite(png_voidp argument) + component += (255-alpha)*png_sRGB_table[outrow[c]]; + + /* So 'component' is scaled by 255*65535 and is +- * therefore appropriate for the sRGB to linear +- * conversion table. ++ * therefore appropriate for the sRGB-to-linear ++ * conversion table. Clamp to the valid range ++ * as a defensive measure against an internal ++ * libpng bug where the data is sRGB rather than ++ * linear premultiplied. + */ ++ if (component > 255*65535) ++ component = 255*65535; + component = PNG_sRGB_FROM_LINEAR(component); + } + diff --git a/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch new file mode 100644 index 0000000000..ba563e1c5a --- /dev/null +++ b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch @@ -0,0 +1,125 @@ +From a05a48b756de63e3234ea6b3b938b8f5f862484a Mon Sep 17 00:00:00 2001 +From: Cosmin Truta +Date: Mon, 1 Dec 2025 22:31:54 +0200 +Subject: [PATCH] Finalize the fix for out-of-bounds read in + `png_image_read_composite` + +Following up on commit 788a624d7387a758ffd5c7ab010f1870dea753a1. + +The previous commit added a defensive bounds check to address the +security issue (out-of-bounds read), but noted that the correctness +issue remained: when the clamp triggered, the affected pixels were +clamped to white instead of the correct composited color. + +This commit addresses the correctness issue by fixing the flag +synchronization error identified in the previous commit's TODO: + +1. In `png_init_read_transformations`: + Clear PNG_FLAG_OPTIMIZE_ALPHA when clearing PNG_COMPOSE for palette + images. This correctly signals that the data is sRGB, not linear + premultiplied. + +2. In `png_image_read_composite`: + Check PNG_FLAG_OPTIMIZE_ALPHA and use the appropriate composition + formula. When set, use the existing linear composition. When cleared + (palette composition already done), use sRGB composition to match + what was done to the palette. + +Retain the previous clamp to the valid range as belt-and-suspenders +protection against any other unforeseen cases. + +CVE: CVE-2025-66293 +Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a] +Signed-off-by: Peter Marko +--- + pngread.c | 56 ++++++++++++++++++++++++++++++++++++------------------ + pngrtran.c | 1 + + 2 files changed, 39 insertions(+), 18 deletions(-) + +diff --git a/pngread.c b/pngread.c +index ab62edd9d..f8ca2b7e3 100644 +--- a/pngread.c ++++ b/pngread.c +@@ -3340,6 +3340,7 @@ png_image_read_composite(png_voidp argument) + ptrdiff_t step_row = display->row_bytes; + unsigned int channels = + (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1; ++ int optimize_alpha = (png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0; + int pass; + + for (pass = 0; pass < passes; ++pass) +@@ -3396,25 +3397,44 @@ png_image_read_composite(png_voidp argument) + + if (alpha < 255) /* else just use component */ + { +- /* This is PNG_OPTIMIZED_ALPHA, the component value +- * is a linear 8-bit value. Combine this with the +- * current outrow[c] value which is sRGB encoded. +- * Arithmetic here is 16-bits to preserve the output +- * values correctly. +- */ +- component *= 257*255; /* =65535 */ +- component += (255-alpha)*png_sRGB_table[outrow[c]]; ++ if (optimize_alpha != 0) ++ { ++ /* This is PNG_OPTIMIZED_ALPHA, the component value ++ * is a linear 8-bit value. Combine this with the ++ * current outrow[c] value which is sRGB encoded. ++ * Arithmetic here is 16-bits to preserve the output ++ * values correctly. ++ */ ++ component *= 257*255; /* =65535 */ ++ component += (255-alpha)*png_sRGB_table[outrow[c]]; + +- /* So 'component' is scaled by 255*65535 and is +- * therefore appropriate for the sRGB-to-linear +- * conversion table. Clamp to the valid range +- * as a defensive measure against an internal +- * libpng bug where the data is sRGB rather than +- * linear premultiplied. +- */ +- if (component > 255*65535) +- component = 255*65535; +- component = PNG_sRGB_FROM_LINEAR(component); ++ /* Clamp to the valid range to defend against ++ * unforeseen cases where the data might be sRGB ++ * instead of linear premultiplied. ++ * (Belt-and-suspenders for GitHub Issue #764.) ++ */ ++ if (component > 255*65535) ++ component = 255*65535; ++ ++ /* So 'component' is scaled by 255*65535 and is ++ * therefore appropriate for the sRGB-to-linear ++ * conversion table. ++ */ ++ component = PNG_sRGB_FROM_LINEAR(component); ++ } ++ else ++ { ++ /* Compositing was already done on the palette ++ * entries. The data is sRGB premultiplied on black. ++ * Composite with the background in sRGB space. ++ * This is not gamma-correct, but matches what was ++ * done to the palette. ++ */ ++ png_uint_32 background = outrow[c]; ++ component += ((255-alpha) * background + 127) / 255; ++ if (component > 255) ++ component = 255; ++ } + } + + outrow[c] = (png_byte)component; +diff --git a/pngrtran.c b/pngrtran.c +index 2f5202255..507d11381 100644 +--- a/pngrtran.c ++++ b/pngrtran.c +@@ -1760,6 +1760,7 @@ png_init_read_transformations(png_structrp png_ptr) + * transformations elsewhere. + */ + png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA); ++ png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA; + } /* color_type == PNG_COLOR_TYPE_PALETTE */ + + /* if (png_ptr->background_gamma_type!=PNG_BACKGROUND_GAMMA_UNKNOWN) */ diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb index 2d5216cb65..6dc7ffe272 100644 --- a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb +++ b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb @@ -19,6 +19,8 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz file://CVE-2025-64720.patch \ file://CVE-2025-65018-01.patch \ file://CVE-2025-65018-02.patch \ + file://CVE-2025-66293-01.patch \ + file://CVE-2025-66293-02.patch \ " SRC_URI[sha256sum] = "c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450" From patchwork Fri Dec 12 15:39:56 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 76385 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE329D59D6F for ; Fri, 12 Dec 2025 15:40:25 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15532.1765554017112866143 for ; Fri, 12 Dec 2025 07:40:17 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=RQxdHvzU; spf=softfail (domain: sakoman.com, ip: 209.85.216.47, mailfrom: steve@sakoman.com) Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-34a4078f669so1480400a91.1 for ; Fri, 12 Dec 2025 07:40:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1765554016; x=1766158816; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=kR5qLeilTkSPc0BT14rZ5c7ooyX+rF5+tAquxzNcQeM=; b=RQxdHvzU1jZrJdTPyoqg2XmHWNbt6IUzWoXfpByAqZvpo/TnhtecO4CHQJuSKUfz5W xWFuAH0k+dTYkBwkouk5cEtv5C//gIAqws6JzDBGoMI9Ic+LvNR8tCAPOQF0resOdxHs s9WHUOj/wygww5qUgyiR2JCOe7WODC93q+yAQZen+lo+1nPIlbGOuNkg9YiPdz+cdXJp 80gN2l/FKW0ZBbbc0NTrKj5NADKBwndNbtgBy6nfAEExGhX7ZitUHcXQhvZVx29TCVjS EQ0XxafNnHstDWhS71J4U1Y06w+JXzbbsB/PNvSwCLstfRY6j6e9ZmtLWc7e62iizw8k gNkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765554016; x=1766158816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=kR5qLeilTkSPc0BT14rZ5c7ooyX+rF5+tAquxzNcQeM=; b=jNSfPqZd1NdWXukc6rAwqWRtpPrX1iqtc9eP/r2EGRPKr61bLEZU5e/dgPq1Y8MYGW MIJRav5RFNogC7ZCAPl2RwdM/j3KOYlKSqVWP6hCeNWK6uLSbRS5hq5zFRhnXz9W428i YmyE4IA9r2GTK8i3nfe7aWuZ1uZqvPU9B4iTMLu9Te7+P626lr4LxC1uhCjHdQXHrRW8 zMOIp6zODrNjkeYuaeot3CzvWtYckMwz+mSiVNEtHpEZuJmwoYH/KCegtJr4KHKVKFw4 Se6SqvM69uYPJDkcAuJCkGNazrotOEMd/rw5IkkxRgEM8W69w1tNhr/C0a4t9gS0f+Vl WE9g== X-Gm-Message-State: AOJu0Yz+9O38ReCm8cEDRFzPLmFcy8pq2k3iC8hzYvQKNGJwrWmqm/6J tY8uA23WPvv9v17h0ImELwqQOFgRLgHQloyApds4iDcDlFXCr1q1iAfn1LOfbA158rq5BYWXUrm 7ID2m X-Gm-Gg: AY/fxX7DIcaqRQPgOKcUQlCubLR48DuqIvUfBXbIIRk09zSdRzkmQstsDr/NQWxVzdL fdjOI9TeZ2TpYkEqTOX8t+fAWfxml5ncDneGXDZCTgAAsJRwu7qwEI3RTFrMzm2ZBcmYUkllccG KG6tcwkS4nlANTO9+NYTpI6xCeweaPJCyVFRAToL9cub+KScPvvpmwLJZuGGi7sMN2Ra35uH93i l8Hd8nzny+8kE5pw2qKQL9B9G90/VOJsOpm08flvDRnpaUPxbyvyfc993uSFft6KC0b6HmGe6bK 7I+JpbTj2prFtTX4H6hAxe9mApxpJkRLHBhxTwWZfZgxGzTHHzwW0rKrDbuJ2m0VqyuI6m9hv+k LXohQ8kIbqa9JDA8F1NoYIuvWRAWo5w3dasttuxpm4bgC0AZ+ymIlRQjZLR+ZpXfBomaJufbudO l/Jg== X-Google-Smtp-Source: AGHT+IFpuV3fOk0DZKGB66+5nyYKjxu70mzmKPbR8GcOkxwDuUcqlMXOutrIkSaAVbpSWLunYV09sA== X-Received: by 2002:a17:90a:d407:b0:343:c3d1:8b9b with SMTP id 98e67ed59e1d1-34abd768603mr2127782a91.19.1765554015904; Fri, 12 Dec 2025 07:40:15 -0800 (PST) Received: from hexa.. ([2602:feb4:3b:2100:5e34:462b:e2f0:5898]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34abe23edc4sm917549a91.1.2025.12.12.07.40.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Dec 2025 07:40:15 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 3/7] libxml2: Security fix for CVE-2025-7425 Date: Fri, 12 Dec 2025 07:39:56 -0800 Message-ID: <315882f25ac3c5e5d210557fd863b3a0fff28850.1765553842.git.steve@sakoman.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 12 Dec 2025 15:40:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/227603 From: Hitendra Prajapati CVE-2025-7425 libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption Origin: https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu3.6 Ref : https://security-tracker.debian.org/tracker/CVE-2025-7425 Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxslt/-/issues/140 Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman --- .../libxml/libxml2/CVE-2025-7425.patch | 802 ++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 803 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch new file mode 100644 index 0000000000..870ada53b8 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch @@ -0,0 +1,802 @@ +From 87786d6200ae1f5ac98d21f04d451e17ff25a216 Mon Sep 17 00:00:00 2001 +From: David Kilzer +Reviewed-By: Aron Xu +Date: Mon, 23 Jun 2025 14:41:56 -0700 +Subject: [PATCH] libxslt: heap-use-after-free in xmlFreeID caused by `atype` + corruption + +* include/libxml/tree.h: +(XML_ATTR_CLEAR_ATYPE): Add. +(XML_ATTR_GET_ATYPE): Add. +(XML_ATTR_SET_ATYPE): Add. +(XML_NODE_ADD_EXTRA): Add. +(XML_NODE_CLEAR_EXTRA): Add. +(XML_NODE_GET_EXTRA): Add. +(XML_NODE_SET_EXTRA): Add. +(XML_DOC_ADD_PROPERTIES): Add. +(XML_DOC_CLEAR_PROPERTIES): Add. +(XML_DOC_GET_PROPERTIES): Add. +(XML_DOC_SET_PROPERTIES): Add. +- Add macros for accessing fields with upper bits that may be set by + libxslt. + +* HTMLparser.c: +(htmlNewDocNoDtD): +* SAX2.c: +(xmlSAX2StartDocument): +(xmlSAX2EndDocument): +* parser.c: +(xmlParseEntityDecl): +(xmlParseExternalSubset): +(xmlParseReference): +(xmlCtxtParseDtd): +* runxmlconf.c: +(xmlconfTestInvalid): +(xmlconfTestValid): +* tree.c: +(xmlNewDoc): +(xmlFreeProp): +(xmlNodeSetDoc): +(xmlSetNsProp): +(xmlDOMWrapAdoptBranch): +* valid.c: +(xmlFreeID): +(xmlAddIDInternal): +(xmlValidateAttributeValueInternal): +(xmlValidateOneAttribute): +(xmlValidateRef): +* xmlreader.c: +(xmlTextReaderStartElement): +(xmlTextReaderStartElementNs): +(xmlTextReaderValidateEntity): +(xmlTextReaderRead): +(xmlTextReaderNext): +(xmlTextReaderIsEmptyElement): +(xmlTextReaderPreserve): +* xmlschemas.c: +(xmlSchemaPValAttrNodeID): +* xmlschemastypes.c: +(xmlSchemaValAtomicType): +- Adopt macros by renaming the struct fields, recompiling and fixing + compiler failures, then changing the struct field names back. +Origin: https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu3.6 +Ref : https://security-tracker.debian.org/tracker/CVE-2025-7425 + +CVE: CVE-2025-7425 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxslt/-/issues/140] +Signed-off-by: Hitendra Prajapati +--- + HTMLparser.c | 1 + + SAX2.c | 6 ++-- + include/libxml/tree.h | 14 ++++++++- + parser.c | 8 ++--- + runxmlconf.c | 4 +-- + tree.c | 20 ++++++------- + valid.c | 68 +++++++++++++++++++++---------------------- + xmlreader.c | 30 +++++++++---------- + xmlschemas.c | 4 +-- + xmlschemastypes.c | 12 ++++---- + 10 files changed, 90 insertions(+), 77 deletions(-) + +diff --git a/HTMLparser.c b/HTMLparser.c +index ea6a4f2..9f439d6 100644 +--- a/HTMLparser.c ++++ b/HTMLparser.c +@@ -2459,6 +2459,7 @@ htmlNewDocNoDtD(const xmlChar *URI, const xmlChar *ExternalID) { + cur->refs = NULL; + cur->_private = NULL; + cur->charset = XML_CHAR_ENCODING_UTF8; ++ XML_DOC_SET_PROPERTIES(cur, XML_DOC_HTML | XML_DOC_USERBUILT); + cur->properties = XML_DOC_HTML | XML_DOC_USERBUILT; + if ((ExternalID != NULL) || + (URI != NULL)) +diff --git a/SAX2.c b/SAX2.c +index bb72e16..08786a3 100644 +--- a/SAX2.c ++++ b/SAX2.c +@@ -899,7 +899,7 @@ xmlSAX2StartDocument(void *ctx) + xmlSAX2ErrMemory(ctxt, "xmlSAX2StartDocument"); + return; + } +- ctxt->myDoc->properties = XML_DOC_HTML; ++ XML_DOC_SET_PROPERTIES(ctxt->myDoc, XML_DOC_HTML); + ctxt->myDoc->parseFlags = ctxt->options; + #else + xmlGenericError(xmlGenericErrorContext, +@@ -912,9 +912,9 @@ xmlSAX2StartDocument(void *ctx) + } else { + doc = ctxt->myDoc = xmlNewDoc(ctxt->version); + if (doc != NULL) { +- doc->properties = 0; ++ XML_DOC_CLEAR_PROPERTIES(doc); + if (ctxt->options & XML_PARSE_OLD10) +- doc->properties |= XML_DOC_OLD10; ++ XML_DOC_ADD_PROPERTIES(doc, XML_DOC_OLD10); + doc->parseFlags = ctxt->options; + doc->standalone = ctxt->standalone; + } else { +diff --git a/include/libxml/tree.h b/include/libxml/tree.h +index a90a174..a013232 100644 +--- a/include/libxml/tree.h ++++ b/include/libxml/tree.h +@@ -370,7 +370,6 @@ struct _xmlElement { + #endif + }; + +- + /** + * XML_LOCAL_NAMESPACE: + * +@@ -451,6 +450,10 @@ struct _xmlAttr { + void *psvi; /* for type/PSVI information */ + }; + ++#define XML_ATTR_CLEAR_ATYPE(attr) (((attr)->atype) = 0) ++#define XML_ATTR_GET_ATYPE(attr) (((attr)->atype) & ~(15U << 27)) ++#define XML_ATTR_SET_ATYPE(attr, type) ((attr)->atype = ((((attr)->atype) & (15U << 27)) | ((type) & ~(15U << 27)))) ++ + /** + * xmlID: + * +@@ -512,6 +515,11 @@ struct _xmlNode { + unsigned short extra; /* extra data for XPath/XSLT */ + }; + ++#define XML_NODE_ADD_EXTRA(node, type) ((node)->extra |= ((type) & ~(15U << 12))) ++#define XML_NODE_CLEAR_EXTRA(node) (((node)->extra) = 0) ++#define XML_NODE_GET_EXTRA(node) (((node)->extra) & ~(15U << 12)) ++#define XML_NODE_SET_EXTRA(node, type) ((node)->extra = ((((node)->extra) & (15U << 12)) | ((type) & ~(15U << 12)))) ++ + /** + * XML_GET_CONTENT: + * +@@ -589,6 +597,10 @@ struct _xmlDoc { + set at the end of parsing */ + }; + ++#define XML_DOC_ADD_PROPERTIES(doc, type) ((doc)->properties |= ((type) & ~(15U << 27))) ++#define XML_DOC_CLEAR_PROPERTIES(doc) (((doc)->properties) = 0) ++#define XML_DOC_GET_PROPERTIES(doc) (((doc)->properties) & ~(15U << 27)) ++#define XML_DOC_SET_PROPERTIES(doc, type) ((doc)->properties = ((((doc)->properties) & (15U << 27)) | ((type) & ~(15U << 27)))) + + typedef struct _xmlDOMWrapCtxt xmlDOMWrapCtxt; + typedef xmlDOMWrapCtxt *xmlDOMWrapCtxtPtr; +diff --git a/parser.c b/parser.c +index 6ab4bfe..19ae310 100644 +--- a/parser.c ++++ b/parser.c +@@ -5663,7 +5663,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) { + xmlErrMemory(ctxt, "New Doc failed"); + goto done; + } +- ctxt->myDoc->properties = XML_DOC_INTERNAL; ++ XML_DOC_SET_PROPERTIES(ctxt->myDoc, XML_DOC_INTERNAL); + } + if (ctxt->myDoc->intSubset == NULL) + ctxt->myDoc->intSubset = xmlNewDtd(ctxt->myDoc, +@@ -5734,7 +5734,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) { + xmlErrMemory(ctxt, "New Doc failed"); + goto done; + } +- ctxt->myDoc->properties = XML_DOC_INTERNAL; ++ XML_DOC_SET_PROPERTIES(ctxt->myDoc, XML_DOC_INTERNAL); + } + + if (ctxt->myDoc->intSubset == NULL) +@@ -7179,7 +7179,7 @@ xmlParseExternalSubset(xmlParserCtxtPtr ctxt, const xmlChar *ExternalID, + xmlErrMemory(ctxt, "New Doc failed"); + return; + } +- ctxt->myDoc->properties = XML_DOC_INTERNAL; ++ XML_DOC_SET_PROPERTIES(ctxt->myDoc, XML_DOC_INTERNAL); + } + if ((ctxt->myDoc != NULL) && (ctxt->myDoc->intSubset == NULL)) + xmlCreateIntSubset(ctxt->myDoc, NULL, ExternalID, SystemID); +@@ -7580,7 +7580,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) { + (nw != NULL) && + (nw->type == XML_ELEMENT_NODE) && + (nw->children == NULL)) +- nw->extra = 1; ++ XML_NODE_SET_EXTRA(nw, 1); + + break; + } +diff --git a/runxmlconf.c b/runxmlconf.c +index b5c3fd8..75fcfd6 100644 +--- a/runxmlconf.c ++++ b/runxmlconf.c +@@ -190,7 +190,7 @@ xmlconfTestInvalid(const char *id, const char *filename, int options) { + id, filename); + } else { + /* invalidity should be reported both in the context and in the document */ +- if ((ctxt->valid != 0) || (doc->properties & XML_DOC_DTDVALID)) { ++ if ((ctxt->valid != 0) || (XML_DOC_GET_PROPERTIES(doc) & XML_DOC_DTDVALID)) { + test_log("test %s : %s failed to detect invalid document\n", + id, filename); + nb_errors++; +@@ -222,7 +222,7 @@ xmlconfTestValid(const char *id, const char *filename, int options) { + ret = 0; + } else { + /* validity should be reported both in the context and in the document */ +- if ((ctxt->valid == 0) || ((doc->properties & XML_DOC_DTDVALID) == 0)) { ++ if ((ctxt->valid == 0) || ((XML_DOC_GET_PROPERTIES(doc) & XML_DOC_DTDVALID) == 0)) { + test_log("test %s : %s failed to validate a valid document\n", + id, filename); + nb_errors++; +diff --git a/tree.c b/tree.c +index f89e3cd..772ca62 100644 +--- a/tree.c ++++ b/tree.c +@@ -1160,7 +1160,7 @@ xmlNewDoc(const xmlChar *version) { + cur->compression = -1; /* not initialized */ + cur->doc = cur; + cur->parseFlags = 0; +- cur->properties = XML_DOC_USERBUILT; ++ XML_DOC_SET_PROPERTIES(cur, XML_DOC_USERBUILT); + /* + * The in memory encoding is always UTF8 + * This field will never change and would +@@ -2077,7 +2077,7 @@ xmlFreeProp(xmlAttrPtr cur) { + xmlDeregisterNodeDefaultValue((xmlNodePtr)cur); + + /* Check for ID removal -> leading to invalid references ! */ +- if ((cur->doc != NULL) && (cur->atype == XML_ATTRIBUTE_ID)) { ++ if ((cur->doc != NULL) && (XML_ATTR_GET_ATYPE(cur) == XML_ATTRIBUTE_ID)) { + xmlRemoveID(cur->doc, cur); + } + if (cur->children != NULL) xmlFreeNodeList(cur->children); +@@ -2794,7 +2794,7 @@ xmlSetTreeDoc(xmlNodePtr tree, xmlDocPtr doc) { + if(tree->type == XML_ELEMENT_NODE) { + prop = tree->properties; + while (prop != NULL) { +- if (prop->atype == XML_ATTRIBUTE_ID) { ++ if (XML_ATTR_GET_ATYPE(prop) == XML_ATTRIBUTE_ID) { + xmlRemoveID(tree->doc, prop); + } + +@@ -6836,9 +6836,9 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar *name, + /* + * Modify the attribute's value. + */ +- if (prop->atype == XML_ATTRIBUTE_ID) { ++ if (XML_ATTR_GET_ATYPE(prop) == XML_ATTRIBUTE_ID) { + xmlRemoveID(node->doc, prop); +- prop->atype = XML_ATTRIBUTE_ID; ++ XML_ATTR_SET_ATYPE(prop, XML_ATTRIBUTE_ID); + } + if (prop->children != NULL) + xmlFreeNodeList(prop->children); +@@ -6858,7 +6858,7 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar *name, + tmp = tmp->next; + } + } +- if (prop->atype == XML_ATTRIBUTE_ID) ++ if (XML_ATTR_GET_ATYPE(prop) == XML_ATTRIBUTE_ID) + xmlAddID(NULL, node->doc, value, prop); + return(prop); + } +@@ -9077,7 +9077,7 @@ ns_end: + if (cur->type == XML_ELEMENT_NODE) { + cur->psvi = NULL; + cur->line = 0; +- cur->extra = 0; ++ XML_NODE_CLEAR_EXTRA(cur); + /* + * Walk attributes. + */ +@@ -9093,11 +9093,11 @@ ns_end: + * Attributes. + */ + if ((sourceDoc != NULL) && +- (((xmlAttrPtr) cur)->atype == XML_ATTRIBUTE_ID)) ++ (XML_ATTR_GET_ATYPE((xmlAttrPtr) cur) == XML_ATTRIBUTE_ID)) + { + xmlRemoveID(sourceDoc, (xmlAttrPtr) cur); + } +- ((xmlAttrPtr) cur)->atype = 0; ++ XML_ATTR_CLEAR_ATYPE((xmlAttrPtr) cur); + ((xmlAttrPtr) cur)->psvi = NULL; + } + break; +@@ -9818,7 +9818,7 @@ xmlDOMWrapAdoptAttr(xmlDOMWrapCtxtPtr ctxt, + } + + XML_TREE_ADOPT_STR(attr->name); +- attr->atype = 0; ++ XML_ATTR_CLEAR_ATYPE(attr); + attr->psvi = NULL; + /* + * Walk content. +diff --git a/valid.c b/valid.c +index abefdc5..ae4bb82 100644 +--- a/valid.c ++++ b/valid.c +@@ -1736,7 +1736,7 @@ xmlScanIDAttributeDecl(xmlValidCtxtPtr ctxt, xmlElementPtr elem, int err) { + if (elem == NULL) return(0); + cur = elem->attributes; + while (cur != NULL) { +- if (cur->atype == XML_ATTRIBUTE_ID) { ++ if (XML_ATTR_GET_ATYPE(cur) == XML_ATTRIBUTE_ID) { + ret ++; + if ((ret > 1) && (err)) + xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_MULTIPLE_ID, +@@ -2109,7 +2109,7 @@ xmlDumpAttributeDecl(xmlBufferPtr buf, xmlAttributePtr attr) { + xmlBufferWriteChar(buf, ":"); + } + xmlBufferWriteCHAR(buf, attr->name); +- switch (attr->atype) { ++ switch (XML_ATTR_GET_ATYPE(attr)) { + case XML_ATTRIBUTE_CDATA: + xmlBufferWriteChar(buf, " CDATA"); + break; +@@ -2582,7 +2582,7 @@ xmlAddID(xmlValidCtxtPtr ctxt, xmlDocPtr doc, const xmlChar *value, + return(NULL); + } + if (attr != NULL) +- attr->atype = XML_ATTRIBUTE_ID; ++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ID); + return(ret); + } + +@@ -2661,7 +2661,7 @@ xmlIsID(xmlDocPtr doc, xmlNodePtr elem, xmlAttrPtr attr) { + if ((fullelemname != felem) && (fullelemname != elem->name)) + xmlFree(fullelemname); + +- if ((attrDecl != NULL) && (attrDecl->atype == XML_ATTRIBUTE_ID)) ++ if ((attrDecl != NULL) && (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_ID)) + return(1); + } + return(0); +@@ -2702,7 +2702,7 @@ xmlRemoveID(xmlDocPtr doc, xmlAttrPtr attr) { + + xmlHashRemoveEntry(table, ID, xmlFreeIDTableEntry); + xmlFree(ID); +- attr->atype = 0; ++ XML_ATTR_CLEAR_ATYPE(attr); + return(0); + } + +@@ -2987,8 +2987,8 @@ xmlIsRef(xmlDocPtr doc, xmlNodePtr elem, xmlAttrPtr attr) { + elem->name, attr->name); + + if ((attrDecl != NULL) && +- (attrDecl->atype == XML_ATTRIBUTE_IDREF || +- attrDecl->atype == XML_ATTRIBUTE_IDREFS)) ++ (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_IDREF || ++ XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_IDREFS)) + return(1); + } + return(0); +@@ -3372,7 +3372,7 @@ xmlIsMixedElement(xmlDocPtr doc, const xmlChar *name) { + + static int + xmlIsDocNameStartChar(xmlDocPtr doc, int c) { +- if ((doc == NULL) || (doc->properties & XML_DOC_OLD10) == 0) { ++ if ((doc == NULL) || (XML_DOC_GET_PROPERTIES(doc) & XML_DOC_OLD10) == 0) { + /* + * Use the new checks of production [4] [4a] amd [5] of the + * Update 5 of XML-1.0 +@@ -3402,7 +3402,7 @@ xmlIsDocNameStartChar(xmlDocPtr doc, int c) { + + static int + xmlIsDocNameChar(xmlDocPtr doc, int c) { +- if ((doc == NULL) || (doc->properties & XML_DOC_OLD10) == 0) { ++ if ((doc == NULL) || (XML_DOC_GET_PROPERTIES(doc) & XML_DOC_OLD10) == 0) { + /* + * Use the new checks of production [4] [4a] amd [5] of the + * Update 5 of XML-1.0 +@@ -3952,7 +3952,7 @@ xmlValidCtxtNormalizeAttributeValue(xmlValidCtxtPtr ctxt, xmlDocPtr doc, + + if (attrDecl == NULL) + return(NULL); +- if (attrDecl->atype == XML_ATTRIBUTE_CDATA) ++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_CDATA) + return(NULL); + + ret = xmlStrdup(value); +@@ -4014,7 +4014,7 @@ xmlValidNormalizeAttributeValue(xmlDocPtr doc, xmlNodePtr elem, + + if (attrDecl == NULL) + return(NULL); +- if (attrDecl->atype == XML_ATTRIBUTE_CDATA) ++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_CDATA) + return(NULL); + + ret = xmlStrdup(value); +@@ -4029,7 +4029,7 @@ xmlValidateAttributeIdCallback(void *payload, void *data, + const xmlChar *name ATTRIBUTE_UNUSED) { + xmlAttributePtr attr = (xmlAttributePtr) payload; + int *count = (int *) data; +- if (attr->atype == XML_ATTRIBUTE_ID) (*count)++; ++ if (XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_ID) (*count)++; + } + + /** +@@ -4061,7 +4061,7 @@ xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc, + /* Attribute Default Legal */ + /* Enumeration */ + if (attr->defaultValue != NULL) { +- val = xmlValidateAttributeValueInternal(doc, attr->atype, ++ val = xmlValidateAttributeValueInternal(doc, XML_ATTR_GET_ATYPE(attr), + attr->defaultValue); + if (val == 0) { + xmlErrValidNode(ctxt, (xmlNodePtr) attr, XML_DTD_ATTRIBUTE_DEFAULT, +@@ -4072,7 +4072,7 @@ xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc, + } + + /* ID Attribute Default */ +- if ((attr->atype == XML_ATTRIBUTE_ID)&& ++ if ((XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_ID)&& + (attr->def != XML_ATTRIBUTE_IMPLIED) && + (attr->def != XML_ATTRIBUTE_REQUIRED)) { + xmlErrValidNode(ctxt, (xmlNodePtr) attr, XML_DTD_ID_FIXED, +@@ -4082,7 +4082,7 @@ xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc, + } + + /* One ID per Element Type */ +- if (attr->atype == XML_ATTRIBUTE_ID) { ++ if (XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_ID) { + int nbId; + + /* the trick is that we parse DtD as their own internal subset */ +@@ -4341,9 +4341,9 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc, + attr->name, elem->name, NULL); + return(0); + } +- attr->atype = attrDecl->atype; ++ XML_ATTR_SET_ATYPE(attr, attrDecl->atype); + +- val = xmlValidateAttributeValueInternal(doc, attrDecl->atype, value); ++ val = xmlValidateAttributeValueInternal(doc, XML_ATTR_GET_ATYPE(attrDecl), value); + if (val == 0) { + xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_VALUE, + "Syntax of value for attribute %s of %s is not valid\n", +@@ -4362,19 +4362,19 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc, + } + + /* Validity Constraint: ID uniqueness */ +- if (attrDecl->atype == XML_ATTRIBUTE_ID) { ++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_ID) { + if (xmlAddID(ctxt, doc, value, attr) == NULL) + ret = 0; + } + +- if ((attrDecl->atype == XML_ATTRIBUTE_IDREF) || +- (attrDecl->atype == XML_ATTRIBUTE_IDREFS)) { ++ if ((XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_IDREF) || ++ (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_IDREFS)) { + if (xmlAddRef(ctxt, doc, value, attr) == NULL) + ret = 0; + } + + /* Validity Constraint: Notation Attributes */ +- if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) { ++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_NOTATION) { + xmlEnumerationPtr tree = attrDecl->tree; + xmlNotationPtr nota; + +@@ -4404,7 +4404,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc, + } + + /* Validity Constraint: Enumeration */ +- if (attrDecl->atype == XML_ATTRIBUTE_ENUMERATION) { ++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_ENUMERATION) { + xmlEnumerationPtr tree = attrDecl->tree; + while (tree != NULL) { + if (xmlStrEqual(tree->name, value)) break; +@@ -4429,7 +4429,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc, + + /* Extra check for the attribute value */ + ret &= xmlValidateAttributeValue2(ctxt, doc, attr->name, +- attrDecl->atype, value); ++ XML_ATTR_GET_ATYPE(attrDecl), value); + + return(ret); + } +@@ -4528,7 +4528,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) { + return(0); + } + +- val = xmlValidateAttributeValueInternal(doc, attrDecl->atype, value); ++ val = xmlValidateAttributeValueInternal(doc, XML_ATTR_GET_ATYPE(attrDecl), value); + if (val == 0) { + if (ns->prefix != NULL) { + xmlErrValidNode(ctxt, elem, XML_DTD_INVALID_DEFAULT, +@@ -4578,7 +4578,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) { + #endif + + /* Validity Constraint: Notation Attributes */ +- if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) { ++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_NOTATION) { + xmlEnumerationPtr tree = attrDecl->tree; + xmlNotationPtr nota; + +@@ -4620,7 +4620,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) { + } + + /* Validity Constraint: Enumeration */ +- if (attrDecl->atype == XML_ATTRIBUTE_ENUMERATION) { ++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_ENUMERATION) { + xmlEnumerationPtr tree = attrDecl->tree; + while (tree != NULL) { + if (xmlStrEqual(tree->name, value)) break; +@@ -4658,10 +4658,10 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) { + /* Extra check for the attribute value */ + if (ns->prefix != NULL) { + ret &= xmlValidateAttributeValue2(ctxt, doc, ns->prefix, +- attrDecl->atype, value); ++ XML_ATTR_GET_ATYPE(attrDecl), value); + } else { + ret &= xmlValidateAttributeValue2(ctxt, doc, BAD_CAST "xmlns", +- attrDecl->atype, value); ++ XML_ATTR_GET_ATYPE(attrDecl), value); + } + + return(ret); +@@ -6375,7 +6375,7 @@ xmlValidateRef(xmlRefPtr ref, xmlValidCtxtPtr ctxt, + while (IS_BLANK_CH(*cur)) cur++; + } + xmlFree(dup); +- } else if (attr->atype == XML_ATTRIBUTE_IDREF) { ++ } else if (XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_IDREF) { + id = xmlGetID(ctxt->doc, name); + if (id == NULL) { + xmlErrValidNode(ctxt, attr->parent, XML_DTD_UNKNOWN_ID, +@@ -6383,7 +6383,7 @@ xmlValidateRef(xmlRefPtr ref, xmlValidCtxtPtr ctxt, + attr->name, name, NULL); + ctxt->valid = 0; + } +- } else if (attr->atype == XML_ATTRIBUTE_IDREFS) { ++ } else if (XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_IDREFS) { + xmlChar *dup, *str = NULL, *cur, save; + + dup = xmlStrdup(name); +@@ -6583,7 +6583,7 @@ xmlValidateAttributeCallback(void *payload, void *data, + + if (cur == NULL) + return; +- switch (cur->atype) { ++ switch (XML_ATTR_GET_ATYPE(cur)) { + case XML_ATTRIBUTE_CDATA: + case XML_ATTRIBUTE_ID: + case XML_ATTRIBUTE_IDREF : +@@ -6598,7 +6598,7 @@ xmlValidateAttributeCallback(void *payload, void *data, + if (cur->defaultValue != NULL) { + + ret = xmlValidateAttributeValue2(ctxt, ctxt->doc, cur->name, +- cur->atype, cur->defaultValue); ++ XML_ATTR_GET_ATYPE(cur), cur->defaultValue); + if ((ret == 0) && (ctxt->valid == 1)) + ctxt->valid = 0; + } +@@ -6606,14 +6606,14 @@ xmlValidateAttributeCallback(void *payload, void *data, + xmlEnumerationPtr tree = cur->tree; + while (tree != NULL) { + ret = xmlValidateAttributeValue2(ctxt, ctxt->doc, +- cur->name, cur->atype, tree->name); ++ cur->name, XML_ATTR_GET_ATYPE(cur), tree->name); + if ((ret == 0) && (ctxt->valid == 1)) + ctxt->valid = 0; + tree = tree->next; + } + } + } +- if (cur->atype == XML_ATTRIBUTE_NOTATION) { ++ if (XML_ATTR_GET_ATYPE(cur) == XML_ATTRIBUTE_NOTATION) { + doc = cur->doc; + if (cur->elem == NULL) { + xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR, +diff --git a/xmlreader.c b/xmlreader.c +index 5fdeb2b..5de168c 100644 +--- a/xmlreader.c ++++ b/xmlreader.c +@@ -572,7 +572,7 @@ xmlTextReaderStartElement(void *ctx, const xmlChar *fullname, + if ((ctxt->node != NULL) && (ctxt->input != NULL) && + (ctxt->input->cur != NULL) && (ctxt->input->cur[0] == '/') && + (ctxt->input->cur[1] == '>')) +- ctxt->node->extra = NODE_IS_EMPTY; ++ XML_NODE_SET_EXTRA(ctxt->node, NODE_IS_EMPTY); + } + if (reader != NULL) + reader->state = XML_TEXTREADER_ELEMENT; +@@ -631,7 +631,7 @@ xmlTextReaderStartElementNs(void *ctx, + if ((ctxt->node != NULL) && (ctxt->input != NULL) && + (ctxt->input->cur != NULL) && (ctxt->input->cur[0] == '/') && + (ctxt->input->cur[1] == '>')) +- ctxt->node->extra = NODE_IS_EMPTY; ++ XML_NODE_SET_EXTRA(ctxt->node, NODE_IS_EMPTY); + } + if (reader != NULL) + reader->state = XML_TEXTREADER_ELEMENT; +@@ -1017,7 +1017,7 @@ skip_children: + xmlNodePtr tmp; + if (reader->entNr == 0) { + while ((tmp = node->last) != NULL) { +- if ((tmp->extra & NODE_IS_PRESERVED) == 0) { ++ if ((XML_NODE_GET_EXTRA(tmp) & NODE_IS_PRESERVED) == 0) { + xmlUnlinkNode(tmp); + xmlTextReaderFreeNode(reader, tmp); + } else +@@ -1265,7 +1265,7 @@ get_next_node: + if ((oldstate == XML_TEXTREADER_ELEMENT) && + (reader->node->type == XML_ELEMENT_NODE) && + (reader->node->children == NULL) && +- ((reader->node->extra & NODE_IS_EMPTY) == 0) ++ ((XML_NODE_GET_EXTRA(reader->node) & NODE_IS_EMPTY) == 0) + #ifdef LIBXML_XINCLUDE_ENABLED + && (reader->in_xinclude <= 0) + #endif +@@ -1279,7 +1279,7 @@ get_next_node: + xmlTextReaderValidatePop(reader); + #endif /* LIBXML_REGEXP_ENABLED */ + if ((reader->preserves > 0) && +- (reader->node->extra & NODE_IS_SPRESERVED)) ++ (XML_NODE_GET_EXTRA(reader->node) & NODE_IS_SPRESERVED)) + reader->preserves--; + reader->node = reader->node->next; + reader->state = XML_TEXTREADER_ELEMENT; +@@ -1295,7 +1295,7 @@ get_next_node: + (reader->node->prev != NULL) && + (reader->node->prev->type != XML_DTD_NODE)) { + xmlNodePtr tmp = reader->node->prev; +- if ((tmp->extra & NODE_IS_PRESERVED) == 0) { ++ if ((XML_NODE_GET_EXTRA(tmp) & NODE_IS_PRESERVED) == 0) { + if (oldnode == tmp) + oldnode = NULL; + xmlUnlinkNode(tmp); +@@ -1308,7 +1308,7 @@ get_next_node: + if ((oldstate == XML_TEXTREADER_ELEMENT) && + (reader->node->type == XML_ELEMENT_NODE) && + (reader->node->children == NULL) && +- ((reader->node->extra & NODE_IS_EMPTY) == 0)) {; ++ ((XML_NODE_GET_EXTRA(reader->node) & NODE_IS_EMPTY) == 0)) {; + reader->state = XML_TEXTREADER_END; + goto node_found; + } +@@ -1317,7 +1317,7 @@ get_next_node: + xmlTextReaderValidatePop(reader); + #endif /* LIBXML_REGEXP_ENABLED */ + if ((reader->preserves > 0) && +- (reader->node->extra & NODE_IS_SPRESERVED)) ++ (XML_NODE_GET_EXTRA(reader->node) & NODE_IS_SPRESERVED)) + reader->preserves--; + reader->node = reader->node->parent; + if ((reader->node == NULL) || +@@ -1341,7 +1341,7 @@ get_next_node: + #endif + (reader->entNr == 0) && + (oldnode->type != XML_DTD_NODE) && +- ((oldnode->extra & NODE_IS_PRESERVED) == 0)) { ++ ((XML_NODE_GET_EXTRA(oldnode) & NODE_IS_PRESERVED) == 0)) { + xmlUnlinkNode(oldnode); + xmlTextReaderFreeNode(reader, oldnode); + } +@@ -1354,7 +1354,7 @@ get_next_node: + #endif + (reader->entNr == 0) && + (reader->node->last != NULL) && +- ((reader->node->last->extra & NODE_IS_PRESERVED) == 0)) { ++ ((XML_NODE_GET_EXTRA(reader->node->last) & NODE_IS_PRESERVED) == 0)) { + xmlNodePtr tmp = reader->node->last; + xmlUnlinkNode(tmp); + xmlTextReaderFreeNode(reader, tmp); +@@ -1536,7 +1536,7 @@ xmlTextReaderNext(xmlTextReaderPtr reader) { + return(xmlTextReaderRead(reader)); + if (reader->state == XML_TEXTREADER_END || reader->state == XML_TEXTREADER_BACKTRACK) + return(xmlTextReaderRead(reader)); +- if (cur->extra & NODE_IS_EMPTY) ++ if (XML_NODE_GET_EXTRA(cur) & NODE_IS_EMPTY) + return(xmlTextReaderRead(reader)); + do { + ret = xmlTextReaderRead(reader); +@@ -2956,7 +2956,7 @@ xmlTextReaderIsEmptyElement(xmlTextReaderPtr reader) { + if (reader->in_xinclude > 0) + return(1); + #endif +- return((reader->node->extra & NODE_IS_EMPTY) != 0); ++ return((XML_NODE_GET_EXTRA(reader->node) & NODE_IS_EMPTY) != 0); + } + + /** +@@ -3818,15 +3818,15 @@ xmlTextReaderPreserve(xmlTextReaderPtr reader) { + return(NULL); + + if ((cur->type != XML_DOCUMENT_NODE) && (cur->type != XML_DTD_NODE)) { +- cur->extra |= NODE_IS_PRESERVED; +- cur->extra |= NODE_IS_SPRESERVED; ++ XML_NODE_ADD_EXTRA(cur, NODE_IS_PRESERVED); ++ XML_NODE_ADD_EXTRA(cur, NODE_IS_SPRESERVED); + } + reader->preserves++; + + parent = cur->parent;; + while (parent != NULL) { + if (parent->type == XML_ELEMENT_NODE) +- parent->extra |= NODE_IS_PRESERVED; ++ XML_NODE_ADD_EXTRA(parent, NODE_IS_PRESERVED); + parent = parent->parent; + } + return(cur); +diff --git a/xmlschemas.c b/xmlschemas.c +index 428e3c8..1f54acc 100644 +--- a/xmlschemas.c ++++ b/xmlschemas.c +@@ -5895,7 +5895,7 @@ xmlSchemaPValAttrNodeID(xmlSchemaParserCtxtPtr ctxt, xmlAttrPtr attr) + /* + * NOTE: the IDness might have already be declared in the DTD + */ +- if (attr->atype != XML_ATTRIBUTE_ID) { ++ if (XML_ATTR_GET_ATYPE(attr) != XML_ATTRIBUTE_ID) { + xmlIDPtr res; + xmlChar *strip; + +@@ -5918,7 +5918,7 @@ xmlSchemaPValAttrNodeID(xmlSchemaParserCtxtPtr ctxt, xmlAttrPtr attr) + NULL, NULL, "Duplicate value '%s' of simple " + "type 'xs:ID'", value, NULL); + } else +- attr->atype = XML_ATTRIBUTE_ID; ++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ID); + } + } else if (ret > 0) { + ret = XML_SCHEMAP_S4S_ATTR_INVALID_VALUE; +diff --git a/xmlschemastypes.c b/xmlschemastypes.c +index de95d94..76a7c87 100644 +--- a/xmlschemastypes.c ++++ b/xmlschemastypes.c +@@ -2969,7 +2969,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value, + /* + * NOTE: the IDness might have already be declared in the DTD + */ +- if (attr->atype != XML_ATTRIBUTE_ID) { ++ if (XML_ATTR_GET_ATYPE(attr) != XML_ATTRIBUTE_ID) { + xmlIDPtr res; + xmlChar *strip; + +@@ -2982,7 +2982,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value, + if (res == NULL) { + ret = 2; + } else { +- attr->atype = XML_ATTRIBUTE_ID; ++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ID); + } + } + } +@@ -3007,7 +3007,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value, + xmlFree(strip); + } else + xmlAddRef(NULL, node->doc, value, attr); +- attr->atype = XML_ATTRIBUTE_IDREF; ++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_IDREF); + } + goto done; + case XML_SCHEMAS_IDREFS: +@@ -3021,7 +3021,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value, + (node->type == XML_ATTRIBUTE_NODE)) { + xmlAttrPtr attr = (xmlAttrPtr) node; + +- attr->atype = XML_ATTRIBUTE_IDREFS; ++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_IDREFS); + } + goto done; + case XML_SCHEMAS_ENTITY:{ +@@ -3052,7 +3052,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value, + (node->type == XML_ATTRIBUTE_NODE)) { + xmlAttrPtr attr = (xmlAttrPtr) node; + +- attr->atype = XML_ATTRIBUTE_ENTITY; ++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ENTITY); + } + goto done; + } +@@ -3069,7 +3069,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value, + (node->type == XML_ATTRIBUTE_NODE)) { + xmlAttrPtr attr = (xmlAttrPtr) node; + +- attr->atype = XML_ATTRIBUTE_ENTITIES; ++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ENTITIES); + } + goto done; + case XML_SCHEMAS_NOTATION:{ +-- +2.50.1 + diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index a155c3708e..101be545c0 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -24,6 +24,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2025-49794-CVE-2025-49796.patch \ file://CVE-2025-49795.patch \ file://CVE-2025-6170.patch \ + file://CVE-2025-7425.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Fri Dec 12 15:39:57 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 76384 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC965D59D6A for ; Fri, 12 Dec 2025 15:40:25 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15533.1765554018325132394 for ; Fri, 12 Dec 2025 07:40:18 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=oUx7w6PR; spf=softfail (domain: sakoman.com, ip: 209.85.216.47, mailfrom: steve@sakoman.com) Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-34374febdefso1412738a91.0 for ; Fri, 12 Dec 2025 07:40:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1765554017; x=1766158817; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=QjfxDiWlNMb6THC92yGflMJ0ZoZqWODd4pNaxLUEjl8=; b=oUx7w6PR9MbuJNab+Nq0uAy0PJxlsq33h2tnyla9hj042sBjOhb4ZkR5L17FyYHRAJ SborIILHTHzwu2JMA4T+GuBI0Li1G1Zv//eV5ywrrmq28MxjjlXASfkby/uFO96NhaYN 9ELqyHdlxqcCiXjmKZfWVjzKwr+FME5pCRUcD/NobjaOseFP1DC22d16Sd7LGAf6Ece4 JTt5fnfLPb8x5TfGZmUUCLveqLpOeL9C+X/ErjJlRGqDBsl5Ipmuo757hOYP3cAHFUzo vGqjSjppYg5Bo1fzu9B2Gwox+8yYOi8hQHfFOh/9tD4tanl1xzW+414GiCBLDIPFWnl3 uKug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765554017; x=1766158817; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=QjfxDiWlNMb6THC92yGflMJ0ZoZqWODd4pNaxLUEjl8=; b=WeqmeeGlVTP/xd8cqzW2lLWz0WhVmvqf3SFA0sDRzW3gSC/Zu8c6ZDBqVnteM6vonx PjIKJnmRFfB8pabhntq4Nsk17F29EQKCKZE0zvqy8t9RNFDiUCjwPmt9TcXllzas+cbL Gytj2mUYvXT2FN9EnN/+n+U2Oi/BUl/P5HuRPB+3gPe74rIH+XEdtZomEFYftQibXwTd yP1sT+C/tYe3Xu+h3/FnF7fja4oIAkAY/bQH4dOlXfy8a1tIFLskrZbWptFPTg9n9A1l km/x/xz2uIdotFaQA+coA/a8GOnlwa7VqxABvpEYcr0bxG4jjvhOGfTctmVZvp6gwQZg DhYg== X-Gm-Message-State: AOJu0Yx3eaXFymWXZsw/+i15R5e0dcJZHFbZItj9SaK0WmnXDWeJOFfN RkZlVtWIstaWkTPY73OZASIH3otNoKKUeXdIZJVUT2C1V9yy2lPgdOpLFcQ9Xkt7VIdVH6+MfhY Bnk6Y X-Gm-Gg: AY/fxX4qCtX31Rq9s21dR5zKKutu+GgsuS/flF5DgQH7Z6CrUC0aSQtG2FKRAJwZ8RW 0/ZS3nzq/B2nSt/PZTJgvmgxC6jdyIIZgG8I0IfjEqkftKlwexmzp7PhCrBFHF5N+ReEkP3z+/b zs3oOeLOkUHSjyRXIl9dXnfqUu8z4AlRuu7ZDy83BnT96ZfsR4gFS5TBFXdG0XjMsK87MtUNtYE JSF/tY1L9nzrZn/XWpw8yzJMkWX46ghIGnteBd5DoT5ntgswYsZGHW/Kqlj44p4+EaqTDUuXVWY EMjU+SCqvjU9NdW7tK7rTX6R8G6lbFtY5ytAmOqxDJQXiEMOOgeCUfMQk9S/nKzDFSRB8jiXJ9C LXYKSv41dXQqfr+tbDW8bIsC8njsUmhNgVKbYX7k50LJ+422R0eo/DUWt5JK5/U1iSDDEnJk0J6 1K1A== X-Google-Smtp-Source: AGHT+IHKjEwQidGTG/NK3j3ZqEH98v2AZAzho5vTZh/Qdfo9pMjemQLeech1ENvq2OBSwWzLV3de/g== X-Received: by 2002:a17:90b:1d92:b0:32e:a5ae:d00 with SMTP id 98e67ed59e1d1-34abd6c867amr2691242a91.13.1765554017536; Fri, 12 Dec 2025 07:40:17 -0800 (PST) Received: from hexa.. ([2602:feb4:3b:2100:5e34:462b:e2f0:5898]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34abe23edc4sm917549a91.1.2025.12.12.07.40.16 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Dec 2025 07:40:17 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 4/7] libmicrohttpd: disable experimental code by default Date: Fri, 12 Dec 2025 07:39:57 -0800 Message-ID: <9e3c0ae261afb7b9ff9528dbc147fb6c89d5a624.1765553842.git.steve@sakoman.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 12 Dec 2025 15:40:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/227604 From: Peter Marko Introduce new packageconfig to explicitly avoid compilation of experimental code. Note that the code was not compiled by default also before this patch, this now makes it explicit and makes it possible to check for the flags in cve-check code. This is less intrusive change than a patch removing the code which was rejected in patch review. This will solve CVE-2025-59777 and CVE-2025-62689 as the vulnerable code is not compiled by default. Set appropriate CVE status for these CVEs based on new packageconfig. Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- meta/recipes-support/libmicrohttpd/libmicrohttpd_1.0.1.bb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/meta/recipes-support/libmicrohttpd/libmicrohttpd_1.0.1.bb b/meta/recipes-support/libmicrohttpd/libmicrohttpd_1.0.1.bb index 0628ee71b5..a22b0c9342 100644 --- a/meta/recipes-support/libmicrohttpd/libmicrohttpd_1.0.1.bb +++ b/meta/recipes-support/libmicrohttpd/libmicrohttpd_1.0.1.bb @@ -19,9 +19,13 @@ PACKAGECONFIG ?= "curl https" PACKAGECONFIG[curl] = "--enable-curl,--disable-curl,curl," PACKAGECONFIG[https] = "--enable-https,--disable-https,libgcrypt gnutls," +PACKAGECONFIG[experimental] = "--enable-experimental,--disable-experimental," do_compile:append() { sed -i s:-L${STAGING_LIBDIR}::g libmicrohttpd.pc } BBCLASSEXTEND = "native nativesdk" + +CVE_STATUS[CVE-2025-59777] = "${@bb.utils.contains('PACKAGECONFIG', 'experimental', 'unpatched', 'not-applicable-config: experimental code not compiled', d)}" +CVE_STATUS[CVE-2025-62689] = "${@bb.utils.contains('PACKAGECONFIG', 'experimental', 'unpatched', 'not-applicable-config: experimental code not compiled', d)}" From patchwork Fri Dec 12 15:39:58 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 76388 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07B39D59D71 for ; Fri, 12 Dec 2025 15:40:26 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15363.1765554020932893856 for ; Fri, 12 Dec 2025 07:40:21 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=jhOgnkCj; spf=softfail (domain: sakoman.com, ip: 209.85.216.51, mailfrom: steve@sakoman.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-343f52d15efso1414873a91.3 for ; Fri, 12 Dec 2025 07:40:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1765554020; x=1766158820; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=3OIl+3AwnxVcEJQFodX6qyVeHLgalN1YR50VCO0kEhM=; b=jhOgnkCj/wCIJ9oMW71E9IP0gsld9Xq9XqWlCdanMawIpOx/qAOJiV+Cl+2fAVKzRx mdkzM3791EEnCRpkktxqjUcyDHlrCNQOn7gJLjZtk/quuSEkl662Ydq3YzHWs5TGzxRN PaIv9GBiUdvjBfvncDgjv9GYaTH/9oM4fYv00o2yf0lhKmVXNvBU9AFEOjs079pshYmN qshGeF6QWGq/hNPlkLpBysMDlYZfu8IFa+TmWIzp/7Km9pc6u+8N1F4cMBSXtypuG29g 7kCaMKFPfgwGJ0Zb3JvSr5xX3/U1Tnbb6sN/yZRDcNqvD/0DUbTFJI/eWcpTi0FT9kHb G4tA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765554020; x=1766158820; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=3OIl+3AwnxVcEJQFodX6qyVeHLgalN1YR50VCO0kEhM=; b=hTwt8nFRBCn2MticjYc7bFr3qEnyw62MBgX58kRKT4RCNYuObTE17l0QhYeHbhGVqd pZWukVSCPwJZyoVcSuF0jI9ucB4c1EghIKZ2tXnQbnXzLsqgQByq2uHPy8LAsrF2mn8d Bbi7gf37NTqyVyWOlzx49lr5p33VTDLz5v1BRlGs/iYRqTH8Yrx8i+ru34HxkD64cmeU WdebBU7Qj8CK6Y9OBV2gxY2lyAFdr0/VrvKtGTzThyLjbww6y4FWpXaHDUvEkgDMxofY SN1FoZei8t2CXdcDl0Bu4C2mHX9aAM2PM9JTdeYTp7KzvV1i6Apqb1Bqvj+zKdfk6qKM XOtw== X-Gm-Message-State: AOJu0YyhLDP81Zf4rl92aO3ulcNDXUhfnehdyZH9XutJh0s7oOsMW/jv AC4EYMoJ03XpQ9QLfJSRi/NQyLeOE/u2AG+07veBo6sCCnLBhWdnCctCnY10QGd7ZXvfVcesUHf cDhaJ X-Gm-Gg: AY/fxX5tK/+KZataFixATWJaTPvCaCJZyFn8H3nSLjSBbVq2UjNq5b84tj/FydtOy17 NvRhlLnTpY9DG9Hvzi3MrIOm0U2VghJUnbb2uruvW83jSH3owSd546uYsLLWzEZIJxRYO87csvh Efo8cSuQ1ds7QD13hKpLFE6wDO7Rr1T8HqvuoNONzEKTNa5dKVVlcKQoqUMChauSB17ebEQXDd+ dvVNhXWcpr7faBSuSJeKWwjZdjivCih3l9G4frBAW8J+JTyafQzLStye0a0EpuFu7l3ieDM8m8O JOYrueRl9zyLRqNPklH8uPBPdAUCOvHt2t0x9TlTj7FCi809ALEJ5f1yXaUBxBcpIMTXpN23R9X 8kjK8CDht0j2R3Z08KhSwWMlrAzmHSBgYNtgL8MAKdh24GpiPzJFAUAHQECAn+zgFKYjCXH1krB ryOGzCacc8OgTk X-Google-Smtp-Source: AGHT+IF52JGGBYGvEOP5dCbHm7+t7wKvMy7jLScXlJznHkoIZz2Xx4Ry5yEVO1nUGAVt0+mIRwpomg== X-Received: by 2002:a17:90b:380f:b0:340:66f9:381 with SMTP id 98e67ed59e1d1-34abd6d873bmr2253350a91.10.1765554019908; Fri, 12 Dec 2025 07:40:19 -0800 (PST) Received: from hexa.. ([2602:feb4:3b:2100:5e34:462b:e2f0:5898]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34abe23edc4sm917549a91.1.2025.12.12.07.40.18 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Dec 2025 07:40:19 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 5/7] libssh2: upgrade 1.11.0 -> 1.11.1 Date: Fri, 12 Dec 2025 07:39:58 -0800 Message-ID: <71316433eb018e831d72a873365aa53ed04f14f4.1765553842.git.steve@sakoman.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 12 Dec 2025 15:40:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/227605 From: Vijay Anusuri Changelog: https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.1 Dropped CVE-2023-48795.patch which is already included in version 1.11.1 Resolves: https://github.com/libssh2/libssh2/issues/1326 License-Update: Copyright symbols were changed from (C) to lowercase (c) ptest results: root@qemux86-64:~# ptest-runner libssh2 START: ptest-runner 2025-12-08T12:37 BEGIN: /usr/lib/libssh2/ptest PASS: mansyntax.sh PASS: test_simple PASS: test_sshd.test DURATION: 6 END: /usr/lib/libssh2/ptest 2025-12-08T12:37 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman --- .../libssh2/libssh2/CVE-2023-48795.patch | 466 ------------------ .../{libssh2_1.11.0.bb => libssh2_1.11.1.bb} | 5 +- 2 files changed, 2 insertions(+), 469 deletions(-) delete mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch rename meta/recipes-support/libssh2/{libssh2_1.11.0.bb => libssh2_1.11.1.bb} (88%) diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch b/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch deleted file mode 100644 index ab0f419ac5..0000000000 --- a/meta/recipes-support/libssh2/libssh2/CVE-2023-48795.patch +++ /dev/null @@ -1,466 +0,0 @@ -From d4634630432594b139b3af6b9f254b890c0f275d Mon Sep 17 00:00:00 2001 -From: Michael Buckley -Date: Thu, 30 Nov 2023 15:08:02 -0800 -Subject: [PATCH] src: add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" - -Refs: -https://terrapin-attack.com/ -https://seclists.org/oss-sec/2023/q4/292 -https://osv.dev/list?ecosystem=&q=CVE-2023-48795 -https://github.com/advisories/GHSA-45x7-px36-x8w8 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795 - -Fixes #1290 -Closes #1291 - -CVE: CVE-2023-48795 -Upstream-Status: Backport -Signed-off-by: Ross Burton ---- - src/kex.c | 63 +++++++++++++++++++++++------------ - src/libssh2_priv.h | 18 +++++++--- - src/packet.c | 83 +++++++++++++++++++++++++++++++++++++++++++--- - src/packet.h | 2 +- - src/session.c | 3 ++ - src/transport.c | 12 ++++++- - 6 files changed, 149 insertions(+), 32 deletions(-) - -diff --git a/src/kex.c b/src/kex.c -index d4034a0a..b4b748ca 100644 ---- a/src/kex.c -+++ b/src/kex.c -@@ -3037,6 +3037,13 @@ kex_method_extension_negotiation = { - 0, - }; - -+static const LIBSSH2_KEX_METHOD -+kex_method_strict_client_extension = { -+ "kex-strict-c-v00@openssh.com", -+ NULL, -+ 0, -+}; -+ - static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = { - #if LIBSSH2_ED25519 - &kex_method_ssh_curve25519_sha256, -@@ -3055,6 +3062,7 @@ static const LIBSSH2_KEX_METHOD *libssh2_kex_methods[] = { - &kex_method_diffie_helman_group1_sha1, - &kex_method_diffie_helman_group_exchange_sha1, - &kex_method_extension_negotiation, -+ &kex_method_strict_client_extension, - NULL - }; - -@@ -3307,13 +3315,13 @@ static int kexinit(LIBSSH2_SESSION * session) - return 0; - } - --/* kex_agree_instr -+/* _libssh2_kex_agree_instr - * Kex specific variant of strstr() - * Needle must be preceded by BOL or ',', and followed by ',' or EOL - */ --static unsigned char * --kex_agree_instr(unsigned char *haystack, size_t haystack_len, -- const unsigned char *needle, size_t needle_len) -+unsigned char * -+_libssh2_kex_agree_instr(unsigned char *haystack, size_t haystack_len, -+ const unsigned char *needle, size_t needle_len) - { - unsigned char *s; - unsigned char *end_haystack; -@@ -3398,7 +3406,7 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session, - while(s && *s) { - unsigned char *p = (unsigned char *) strchr((char *) s, ','); - size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); -- if(kex_agree_instr(hostkey, hostkey_len, s, method_len)) { -+ if(_libssh2_kex_agree_instr(hostkey, hostkey_len, s, method_len)) { - const LIBSSH2_HOSTKEY_METHOD *method = - (const LIBSSH2_HOSTKEY_METHOD *) - kex_get_method_by_name((char *) s, method_len, -@@ -3432,9 +3440,9 @@ static int kex_agree_hostkey(LIBSSH2_SESSION * session, - } - - while(hostkeyp && (*hostkeyp) && (*hostkeyp)->name) { -- s = kex_agree_instr(hostkey, hostkey_len, -- (unsigned char *) (*hostkeyp)->name, -- strlen((*hostkeyp)->name)); -+ s = _libssh2_kex_agree_instr(hostkey, hostkey_len, -+ (unsigned char *) (*hostkeyp)->name, -+ strlen((*hostkeyp)->name)); - if(s) { - /* So far so good, but does it suit our purposes? (Encrypting vs - Signing) */ -@@ -3468,6 +3476,12 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex, - { - const LIBSSH2_KEX_METHOD **kexp = libssh2_kex_methods; - unsigned char *s; -+ const unsigned char *strict = -+ (unsigned char *)"kex-strict-s-v00@openssh.com"; -+ -+ if(_libssh2_kex_agree_instr(kex, kex_len, strict, 28)) { -+ session->kex_strict = 1; -+ } - - if(session->kex_prefs) { - s = (unsigned char *) session->kex_prefs; -@@ -3475,7 +3489,7 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex, - while(s && *s) { - unsigned char *q, *p = (unsigned char *) strchr((char *) s, ','); - size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); -- q = kex_agree_instr(kex, kex_len, s, method_len); -+ q = _libssh2_kex_agree_instr(kex, kex_len, s, method_len); - if(q) { - const LIBSSH2_KEX_METHOD *method = (const LIBSSH2_KEX_METHOD *) - kex_get_method_by_name((char *) s, method_len, -@@ -3509,9 +3523,9 @@ static int kex_agree_kex_hostkey(LIBSSH2_SESSION * session, unsigned char *kex, - } - - while(*kexp && (*kexp)->name) { -- s = kex_agree_instr(kex, kex_len, -- (unsigned char *) (*kexp)->name, -- strlen((*kexp)->name)); -+ s = _libssh2_kex_agree_instr(kex, kex_len, -+ (unsigned char *) (*kexp)->name, -+ strlen((*kexp)->name)); - if(s) { - /* We've agreed on a key exchange method, - * Can we agree on a hostkey that works with this kex? -@@ -3555,7 +3569,7 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session, - unsigned char *p = (unsigned char *) strchr((char *) s, ','); - size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); - -- if(kex_agree_instr(crypt, crypt_len, s, method_len)) { -+ if(_libssh2_kex_agree_instr(crypt, crypt_len, s, method_len)) { - const LIBSSH2_CRYPT_METHOD *method = - (const LIBSSH2_CRYPT_METHOD *) - kex_get_method_by_name((char *) s, method_len, -@@ -3577,9 +3591,9 @@ static int kex_agree_crypt(LIBSSH2_SESSION * session, - } - - while(*cryptp && (*cryptp)->name) { -- s = kex_agree_instr(crypt, crypt_len, -- (unsigned char *) (*cryptp)->name, -- strlen((*cryptp)->name)); -+ s = _libssh2_kex_agree_instr(crypt, crypt_len, -+ (unsigned char *) (*cryptp)->name, -+ strlen((*cryptp)->name)); - if(s) { - endpoint->crypt = *cryptp; - return 0; -@@ -3619,7 +3633,7 @@ static int kex_agree_mac(LIBSSH2_SESSION * session, - unsigned char *p = (unsigned char *) strchr((char *) s, ','); - size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); - -- if(kex_agree_instr(mac, mac_len, s, method_len)) { -+ if(_libssh2_kex_agree_instr(mac, mac_len, s, method_len)) { - const LIBSSH2_MAC_METHOD *method = (const LIBSSH2_MAC_METHOD *) - kex_get_method_by_name((char *) s, method_len, - (const LIBSSH2_COMMON_METHOD **) -@@ -3640,8 +3654,9 @@ static int kex_agree_mac(LIBSSH2_SESSION * session, - } - - while(*macp && (*macp)->name) { -- s = kex_agree_instr(mac, mac_len, (unsigned char *) (*macp)->name, -- strlen((*macp)->name)); -+ s = _libssh2_kex_agree_instr(mac, mac_len, -+ (unsigned char *) (*macp)->name, -+ strlen((*macp)->name)); - if(s) { - endpoint->mac = *macp; - return 0; -@@ -3672,7 +3687,7 @@ static int kex_agree_comp(LIBSSH2_SESSION *session, - unsigned char *p = (unsigned char *) strchr((char *) s, ','); - size_t method_len = (p ? (size_t)(p - s) : strlen((char *) s)); - -- if(kex_agree_instr(comp, comp_len, s, method_len)) { -+ if(_libssh2_kex_agree_instr(comp, comp_len, s, method_len)) { - const LIBSSH2_COMP_METHOD *method = - (const LIBSSH2_COMP_METHOD *) - kex_get_method_by_name((char *) s, method_len, -@@ -3694,8 +3709,9 @@ static int kex_agree_comp(LIBSSH2_SESSION *session, - } - - while(*compp && (*compp)->name) { -- s = kex_agree_instr(comp, comp_len, (unsigned char *) (*compp)->name, -- strlen((*compp)->name)); -+ s = _libssh2_kex_agree_instr(comp, comp_len, -+ (unsigned char *) (*compp)->name, -+ strlen((*compp)->name)); - if(s) { - endpoint->comp = *compp; - return 0; -@@ -3876,6 +3892,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, - session->local.kexinit = key_state->oldlocal; - session->local.kexinit_len = key_state->oldlocal_len; - key_state->state = libssh2_NB_state_idle; -+ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; - session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; - session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; - return -1; -@@ -3901,6 +3918,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, - session->local.kexinit = key_state->oldlocal; - session->local.kexinit_len = key_state->oldlocal_len; - key_state->state = libssh2_NB_state_idle; -+ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; - session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; - session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; - return -1; -@@ -3949,6 +3967,7 @@ _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, - session->remote.kexinit = NULL; - } - -+ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; - session->state &= ~LIBSSH2_STATE_KEX_ACTIVE; - session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; - -diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h -index 82c3afe2..ee1d8b5c 100644 ---- a/src/libssh2_priv.h -+++ b/src/libssh2_priv.h -@@ -699,6 +699,9 @@ struct _LIBSSH2_SESSION - /* key signing algorithm preferences -- NULL yields server order */ - char *sign_algo_prefs; - -+ /* Whether to use the OpenSSH Strict KEX extension */ -+ int kex_strict; -+ - /* (remote as source of data -- packet_read ) */ - libssh2_endpoint_data remote; - -@@ -870,6 +873,7 @@ struct _LIBSSH2_SESSION - int fullpacket_macstate; - size_t fullpacket_payload_len; - int fullpacket_packet_type; -+ uint32_t fullpacket_required_type; - - /* State variables used in libssh2_sftp_init() */ - libssh2_nonblocking_states sftpInit_state; -@@ -910,10 +914,11 @@ struct _LIBSSH2_SESSION - }; - - /* session.state bits */ --#define LIBSSH2_STATE_EXCHANGING_KEYS 0x00000001 --#define LIBSSH2_STATE_NEWKEYS 0x00000002 --#define LIBSSH2_STATE_AUTHENTICATED 0x00000004 --#define LIBSSH2_STATE_KEX_ACTIVE 0x00000008 -+#define LIBSSH2_STATE_INITIAL_KEX 0x00000001 -+#define LIBSSH2_STATE_EXCHANGING_KEYS 0x00000002 -+#define LIBSSH2_STATE_NEWKEYS 0x00000004 -+#define LIBSSH2_STATE_AUTHENTICATED 0x00000008 -+#define LIBSSH2_STATE_KEX_ACTIVE 0x00000010 - - /* session.flag helpers */ - #ifdef MSG_NOSIGNAL -@@ -1144,6 +1149,11 @@ ssize_t _libssh2_send(libssh2_socket_t socket, const void *buffer, - int _libssh2_kex_exchange(LIBSSH2_SESSION * session, int reexchange, - key_exchange_state_t * state); - -+unsigned char *_libssh2_kex_agree_instr(unsigned char *haystack, -+ size_t haystack_len, -+ const unsigned char *needle, -+ size_t needle_len); -+ - /* Let crypt.c/hostkey.c expose their method structs */ - const LIBSSH2_CRYPT_METHOD **libssh2_crypt_methods(void); - const LIBSSH2_HOSTKEY_METHOD **libssh2_hostkey_methods(void); -diff --git a/src/packet.c b/src/packet.c -index b5b41981..35d4d39e 100644 ---- a/src/packet.c -+++ b/src/packet.c -@@ -605,14 +605,13 @@ authagent_exit: - * layer when it has received a packet. - * - * The input pointer 'data' is pointing to allocated data that this function -- * is asked to deal with so on failure OR success, it must be freed fine. -- * The only exception is when the return code is LIBSSH2_ERROR_EAGAIN. -+ * will be freed unless return the code is LIBSSH2_ERROR_EAGAIN. - * - * This function will always be called with 'datalen' greater than zero. - */ - int - _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, -- size_t datalen, int macstate) -+ size_t datalen, int macstate, uint32_t seq) - { - int rc = 0; - unsigned char *message = NULL; -@@ -657,6 +656,70 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, - break; - } - -+ if(session->state & LIBSSH2_STATE_INITIAL_KEX) { -+ if(msg == SSH_MSG_KEXINIT) { -+ if(!session->kex_strict) { -+ if(datalen < 17) { -+ LIBSSH2_FREE(session, data); -+ session->packAdd_state = libssh2_NB_state_idle; -+ return _libssh2_error(session, -+ LIBSSH2_ERROR_BUFFER_TOO_SMALL, -+ "Data too short extracting kex"); -+ } -+ else { -+ const unsigned char *strict = -+ (unsigned char *)"kex-strict-s-v00@openssh.com"; -+ struct string_buf buf; -+ unsigned char *algs = NULL; -+ size_t algs_len = 0; -+ -+ buf.data = (unsigned char *)data; -+ buf.dataptr = buf.data; -+ buf.len = datalen; -+ buf.dataptr += 17; /* advance past type and cookie */ -+ -+ if(_libssh2_get_string(&buf, &algs, &algs_len)) { -+ LIBSSH2_FREE(session, data); -+ session->packAdd_state = libssh2_NB_state_idle; -+ return _libssh2_error(session, -+ LIBSSH2_ERROR_BUFFER_TOO_SMALL, -+ "Algs too short"); -+ } -+ -+ if(algs_len == 0 || -+ _libssh2_kex_agree_instr(algs, algs_len, strict, 28)) { -+ session->kex_strict = 1; -+ } -+ } -+ } -+ -+ if(session->kex_strict && seq) { -+ LIBSSH2_FREE(session, data); -+ session->socket_state = LIBSSH2_SOCKET_DISCONNECTED; -+ session->packAdd_state = libssh2_NB_state_idle; -+ libssh2_session_disconnect(session, "strict KEX violation: " -+ "KEXINIT was not the first packet"); -+ -+ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, -+ "strict KEX violation: " -+ "KEXINIT was not the first packet"); -+ } -+ } -+ -+ if(session->kex_strict && session->fullpacket_required_type && -+ session->fullpacket_required_type != msg) { -+ LIBSSH2_FREE(session, data); -+ session->socket_state = LIBSSH2_SOCKET_DISCONNECTED; -+ session->packAdd_state = libssh2_NB_state_idle; -+ libssh2_session_disconnect(session, "strict KEX violation: " -+ "unexpected packet type"); -+ -+ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, -+ "strict KEX violation: " -+ "unexpected packet type"); -+ } -+ } -+ - if(session->packAdd_state == libssh2_NB_state_allocated) { - /* A couple exceptions to the packet adding rule: */ - switch(msg) { -@@ -1341,6 +1404,15 @@ _libssh2_packet_ask(LIBSSH2_SESSION * session, unsigned char packet_type, - - return 0; - } -+ else if(session->kex_strict && -+ (session->state & LIBSSH2_STATE_INITIAL_KEX)) { -+ libssh2_session_disconnect(session, "strict KEX violation: " -+ "unexpected packet type"); -+ -+ return _libssh2_error(session, LIBSSH2_ERROR_SOCKET_DISCONNECT, -+ "strict KEX violation: " -+ "unexpected packet type"); -+ } - packet = _libssh2_list_next(&packet->node); - } - return -1; -@@ -1402,7 +1474,10 @@ _libssh2_packet_require(LIBSSH2_SESSION * session, unsigned char packet_type, - } - - while(session->socket_state == LIBSSH2_SOCKET_CONNECTED) { -- int ret = _libssh2_transport_read(session); -+ int ret; -+ session->fullpacket_required_type = packet_type; -+ ret = _libssh2_transport_read(session); -+ session->fullpacket_required_type = 0; - if(ret == LIBSSH2_ERROR_EAGAIN) - return ret; - else if(ret < 0) { -diff --git a/src/packet.h b/src/packet.h -index 79018bcf..6ea100a5 100644 ---- a/src/packet.h -+++ b/src/packet.h -@@ -71,6 +71,6 @@ int _libssh2_packet_burn(LIBSSH2_SESSION * session, - int _libssh2_packet_write(LIBSSH2_SESSION * session, unsigned char *data, - unsigned long data_len); - int _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, -- size_t datalen, int macstate); -+ size_t datalen, int macstate, uint32_t seq); - - #endif /* __LIBSSH2_PACKET_H */ -diff --git a/src/session.c b/src/session.c -index a4d602ba..f4bafb57 100644 ---- a/src/session.c -+++ b/src/session.c -@@ -464,6 +464,8 @@ libssh2_session_init_ex(LIBSSH2_ALLOC_FUNC((*my_alloc)), - session->abstract = abstract; - session->api_timeout = 0; /* timeout-free API by default */ - session->api_block_mode = 1; /* blocking API by default */ -+ session->state = LIBSSH2_STATE_INITIAL_KEX; -+ session->fullpacket_required_type = 0; - session->packet_read_timeout = LIBSSH2_DEFAULT_READ_TIMEOUT; - session->flag.quote_paths = 1; /* default behavior is to quote paths - for the scp subsystem */ -@@ -1186,6 +1188,7 @@ libssh2_session_disconnect_ex(LIBSSH2_SESSION *session, int reason, - const char *desc, const char *lang) - { - int rc; -+ session->state &= ~LIBSSH2_STATE_INITIAL_KEX; - session->state &= ~LIBSSH2_STATE_EXCHANGING_KEYS; - BLOCK_ADJUST(rc, session, - session_disconnect(session, reason, desc, lang)); -diff --git a/src/transport.c b/src/transport.c -index 6d902d33..3b30ff84 100644 ---- a/src/transport.c -+++ b/src/transport.c -@@ -187,6 +187,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) - struct transportpacket *p = &session->packet; - int rc; - int compressed; -+ uint32_t seq = session->remote.seqno; - - if(session->fullpacket_state == libssh2_NB_state_idle) { - session->fullpacket_macstate = LIBSSH2_MAC_CONFIRMED; -@@ -318,7 +319,7 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) - if(session->fullpacket_state == libssh2_NB_state_created) { - rc = _libssh2_packet_add(session, p->payload, - session->fullpacket_payload_len, -- session->fullpacket_macstate); -+ session->fullpacket_macstate, seq); - if(rc == LIBSSH2_ERROR_EAGAIN) - return rc; - if(rc) { -@@ -329,6 +330,11 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) - - session->fullpacket_state = libssh2_NB_state_idle; - -+ if(session->kex_strict && -+ session->fullpacket_packet_type == SSH_MSG_NEWKEYS) { -+ session->remote.seqno = 0; -+ } -+ - return session->fullpacket_packet_type; - } - -@@ -1091,6 +1097,10 @@ int _libssh2_transport_send(LIBSSH2_SESSION *session, - - session->local.seqno++; - -+ if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS) { -+ session->local.seqno = 0; -+ } -+ - ret = LIBSSH2_SEND(session, p->outbuf, total_length, - LIBSSH2_SOCKET_SEND_FLAGS(session)); - if(ret < 0) --- -2.34.1 - diff --git a/meta/recipes-support/libssh2/libssh2_1.11.0.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb similarity index 88% rename from meta/recipes-support/libssh2/libssh2_1.11.0.bb rename to meta/recipes-support/libssh2/libssh2_1.11.1.bb index 5100e6f7f9..fb63dea8b3 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.0.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -5,14 +5,13 @@ SECTION = "libs" DEPENDS = "zlib" LICENSE = "BSD-3-Clause" -LIC_FILES_CHKSUM = "file://COPYING;md5=24a33237426720395ebb1dd1349ca225" +LIC_FILES_CHKSUM = "file://COPYING;md5=2fbf8f834408079bf1fcbadb9814b1bc" SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://run-ptest \ - file://CVE-2023-48795.patch \ " -SRC_URI[sha256sum] = "3736161e41e2693324deb38c26cfdc3efe6209d634ba4258db1cecff6a5ad461" +SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" inherit autotools pkgconfig ptest From patchwork Fri Dec 12 15:39:59 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 76387 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F9AAD59D74 for ; Fri, 12 Dec 2025 15:40:26 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15364.1765554022187111175 for ; Fri, 12 Dec 2025 07:40:22 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=TJP7za7S; spf=softfail (domain: sakoman.com, ip: 209.85.216.44, mailfrom: steve@sakoman.com) Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-343dfb673a8so1451954a91.0 for ; Fri, 12 Dec 2025 07:40:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1765554021; x=1766158821; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=BPlo2VjZe9bgSiSLYOg96yJpdDLa29KBpzjD2F6ZQ4g=; b=TJP7za7SflrHWHiN/cYfE7C8s28xr4ejkngDRgnsLxELiiSXo38nwYwkPTC0TGk9Fp SEYzhZUQ1LLQG0oGBJswCVQaK8lYePvY4oycALVMrksSfZLltbVYpAYcbpneu9bbFZTH NVnnXykXiEG8rDD9JTibASxhD+HwBM3sq3p1Im3HFQwbBRBpURAxBH/rGlfQtVXJO8+r cMukaepxjHgC3uQT5HqDm+KNi1WW4PLFh89BOPYogGAiIza6w0kbsIuxReCbeLljZ1bo GPWWaumpadZRcl2dBHFdEfimhLLbuulg8/NlH9UIN/Fo07l2AH5Z/44asvTSaFi4tUXM K2sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765554021; x=1766158821; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=BPlo2VjZe9bgSiSLYOg96yJpdDLa29KBpzjD2F6ZQ4g=; b=Ac7KfHVZQ5yjSYdxuFuIliNUiDzPHoEcyvOOMsYyJ4Avso9yR/Hpvql9ex59I3wfqX tMoZqZiQLsNG2HBSpi+9Zj3/3FfGKw1u8LduTMH/Lpl5Vun8/QTYtlkQmMj7ITt/c49a y/C2QSAxPDOUL8NQ6hqQOnbw9inrSG+SLk9AR2eAg7WbnkKstVa+YuSY5BZtEhYGmLeN LMbtiYpLs7iQcuJ0/z4aaUrHID/yQwNAtXPo0qb139Sga0/uq4pxWtb/zSIjbw2VS3Np qCOXXPLkmNeG2UziI8MZ55HVAOdg4eDzim5fGZVjtH18y42Atkza+OMQ/e5CYp/B0mPE ihjg== X-Gm-Message-State: AOJu0Yz3eq5q1FHrJR39JtdGfJ4KHaCTkWqpbbiDu1glrfZ862FlDbkd 6ybwpGnbsD1iXXRFQ8l+egRdr7vfBfT7PnEDWhvVYKUZhjwhxMKjiAK5CCFyRKUNNmI3GbZLlCE GfyUZ X-Gm-Gg: AY/fxX55fsqf4/s/K7D+spnzMllwKFz60FMz3oVZQMsiT4VWlFJfev7J6GdYSHmMemw Bciur3iIMZf/svbBYIqSd/6q+Ig21YwwE9qyp/lmP4vBSXuAQCVZ5Bbuu4H12H8RN1QtLwKNlc+ fzIO9mWmrN5UgNh4DELfp2hygd298EkW+lMihPoyt/w3fWf27yJKekynaffCJRc4Ws3QxsH5swn +5Z4z7qArBI93vORdDwK0hp2Q6g5EQXYqe05Ur9xQMjsoI7dHwrgmqeTBsOiUM0aQph4GHGAYQm H/dfUzww/Wva+Tw580GSN9vFZPKrBt9zC3sgUxAEqus3Dd+eHPlmsROAUe0hDdopBwhwZgSK/M7 DFwC1PA764ig1ngL+KFrkqY+VJclCdXvNkLWk8GQMZagAOWqUl05P4uN26KZAhE5qGhZ3z9loA3 us4g== X-Google-Smtp-Source: AGHT+IGZEV61qCvEOvSiHn1b55rVQkhOQR++h16jEDzI/cZk9F55ZV/t1Vkcy/y0qfhzWr52yYI37Q== X-Received: by 2002:a17:90a:fc4e:b0:343:688e:3252 with SMTP id 98e67ed59e1d1-34abd6d3572mr2802860a91.12.1765554021351; Fri, 12 Dec 2025 07:40:21 -0800 (PST) Received: from hexa.. ([2602:feb4:3b:2100:5e34:462b:e2f0:5898]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34abe23edc4sm917549a91.1.2025.12.12.07.40.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Dec 2025 07:40:21 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 6/7] libssh2: fix regression in KEX method validation (GH-1553) Date: Fri, 12 Dec 2025 07:39:59 -0800 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 12 Dec 2025 15:40:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/227606 From: Vijay Anusuri Resolves: https://github.com/libssh2/libssh2/issues/1553 Regression caused by https://github.com/libssh2/libssh2/commit/00e2a07e824db8798d94809156e9fb4e70a42f89 Backport fix https://github.com/libssh2/libssh2/commit/4beed7245889ba149cc372f845d5969ce5103a5d Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman --- ...rror-if-user-KEX-methods-are-invalid.patch | 73 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 74 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/0001-Return-error-if-user-KEX-methods-are-invalid.patch diff --git a/meta/recipes-support/libssh2/libssh2/0001-Return-error-if-user-KEX-methods-are-invalid.patch b/meta/recipes-support/libssh2/libssh2/0001-Return-error-if-user-KEX-methods-are-invalid.patch new file mode 100644 index 0000000000..9e7bb9a905 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/0001-Return-error-if-user-KEX-methods-are-invalid.patch @@ -0,0 +1,73 @@ +From 4beed7245889ba149cc372f845d5969ce5103a5d Mon Sep 17 00:00:00 2001 +From: Will Cosgrove +Date: Fri, 28 Feb 2025 09:32:30 -0800 +Subject: [PATCH] Return error if user KEX methods are invalid #1553 (#1554) + +Notes: +Fixes #1553. Restores error case if user passes in invalid KEX method value to libssh2_session_method_pref. + +Credit: +Amy Lin + +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/4beed7245889ba149cc372f845d5969ce5103a5d] +Signed-off-by: Vijay Anusuri +--- + src/kex.c | 33 +++++++++++++++++++++------------ + 1 file changed, 21 insertions(+), 12 deletions(-) + +diff --git a/src/kex.c b/src/kex.c +index ebee54f987..bafda0e611 100644 +--- a/src/kex.c ++++ b/src/kex.c +@@ -4196,23 +4196,11 @@ libssh2_session_method_pref(LIBSSH2_SESSION * session, int method_type, + char *tmpprefs = NULL; + size_t prefs_len = strlen(prefs); + const LIBSSH2_COMMON_METHOD **mlist; +- const char *kex_extensions = "ext-info-c,kex-strict-c-v00@openssh.com,"; +- size_t kex_extensions_len = strlen(kex_extensions); + + switch(method_type) { + case LIBSSH2_METHOD_KEX: + prefvar = &session->kex_prefs; + mlist = (const LIBSSH2_COMMON_METHOD **)libssh2_kex_methods; +- tmpprefs = LIBSSH2_ALLOC(session, kex_extensions_len + prefs_len + 1); +- if(!tmpprefs) { +- return _libssh2_error(session, LIBSSH2_ERROR_ALLOC, +- "Error allocated space for kex method" +- " preferences"); +- } +- memcpy(tmpprefs, kex_extensions, kex_extensions_len); +- memcpy(tmpprefs + kex_extensions_len, prefs, prefs_len + 1); +- prefs = tmpprefs; +- prefs_len = strlen(prefs); + break; + + case LIBSSH2_METHOD_HOSTKEY: +@@ -4314,6 +4302,27 @@ libssh2_session_method_pref(LIBSSH2_SESSION * session, int method_type, + "supported"); + } + ++ /* add method kex extension to the start of the user list */ ++ if(method_type == LIBSSH2_METHOD_KEX) { ++ const char *kex_extensions = ++ "ext-info-c,kex-strict-c-v00@openssh.com,"; ++ size_t kex_extensions_len = strlen(kex_extensions); ++ size_t tmp_len = kex_extensions_len + strlen(newprefs); ++ tmpprefs = LIBSSH2_ALLOC(session, tmp_len + 1); ++ if(!tmpprefs) { ++ return _libssh2_error(session, LIBSSH2_ERROR_ALLOC, ++ "Error allocated space for kex method" ++ " preferences"); ++ } ++ ++ memcpy(tmpprefs, kex_extensions, kex_extensions_len); ++ memcpy(tmpprefs + kex_extensions_len, newprefs, strlen(newprefs)); ++ tmpprefs[tmp_len] = '\0'; ++ ++ LIBSSH2_FREE(session, newprefs); ++ newprefs = tmpprefs; ++ } ++ + if(*prefvar) { + LIBSSH2_FREE(session, *prefvar); + } diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index fb63dea8b3..49da9698a3 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -9,6 +9,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=2fbf8f834408079bf1fcbadb9814b1bc" SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://run-ptest \ + file://0001-Return-error-if-user-KEX-methods-are-invalid.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Fri Dec 12 15:40:00 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 76386 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF60CD59D70 for ; Fri, 12 Dec 2025 15:40:25 +0000 (UTC) Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15365.1765554023610546493 for ; Fri, 12 Dec 2025 07:40:23 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20230601.gappssmtp.com header.s=20230601 header.b=ZPblJmCV; spf=softfail (domain: sakoman.com, ip: 209.85.216.50, mailfrom: steve@sakoman.com) Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-343774bd9b4so1058540a91.2 for ; Fri, 12 Dec 2025 07:40:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20230601.gappssmtp.com; s=20230601; t=1765554023; x=1766158823; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=lK9EF/yeP0rsy2p7/ALVtrGX5u8vbtm7Zo7tyL6ybEw=; b=ZPblJmCVK3sI+jynBChq0uBNyVrnRp3h/gwrZcn0DHO4nTiVvQ2n3XRsVPCDaEgpEt vA8cGrx/mk2nP/BneZsgrwIYayHC4TzxY28AV1Kx1LlMTiF2ekF08d77CZIknPUGoig+ XTe89dNuH2s6Bk6ejk6C+yMQAVz1BOMgiENxTuTRll31k6w++3K08S2x62zwNkoSupH7 kCqKt03cSeH47vr18TbU7wc3FO2QCPNS+e01K6P+c5VQ05hij879XPq/7NDrswLVWVTP pHgJKcPGhZHIb0x9FC2qzt0UJTjeUKl1FrwkY//2vGTUd2er4x69JPhDig1NZQ3ro2iw 0PLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765554023; x=1766158823; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=lK9EF/yeP0rsy2p7/ALVtrGX5u8vbtm7Zo7tyL6ybEw=; b=YPRn/gx7LodQrvenFuiGohMMqkUvenz0wWUvvf3rImysGOKoLV+RC+U62yNRs/rZxI mgElJGTqdEo70MM5/vw0YlCEuOyFJolFecUYGyNitp0B9c3CLx/3X13j3VqNmKYaXGIW cta8YO2o80X0Ru4k96eimlWDRKYsA40Fjp1C+PMkIxqGbUnhxt7y5tk8Uh4mJyQ+iAgw dQUt/Xwi3Mwv/W7V9+rA6TzzLT9RZVKGEwOs8znZ37b12vSJvXUweTZmYquj61gdQx02 NdY+1IsrDYrkhyPmgj8/TymJ4TtHWE6jl9T7hhQaTuJ0qUC04jy3zdQpws1GBEQPdKl3 Y9iw== X-Gm-Message-State: AOJu0Yy+nBk8xYNSooH0dxSFYjMRSaETLzlVnFnVids+IIfkfDs/d5h+ jEnJAmFevtH9Ubl5Ol512CF67pzNutlPMynMb8L4Ib4yls29b5euZzMsyCXb2NLzxttI7K8jS8O o7tkp X-Gm-Gg: AY/fxX6gI3oaOlXD8O6Mlb7rZ2WbvzSPm/crPYCCf77ch5W9Ats8K6VHB1WGzTJmghL YYmZ4EQ+5y8OuGeQD78x0CQUZKwabq1mUYeP8GgdCUu8gmC6PuvZ79YNd3FFjKeOFl1cDIpPkZE z9ROnWEiX3CxzIUVz6f98LCRB8Ug/uxhT13S5rwIRuzbYn3ezQJPziLe4jBepcYIY1ain6BN4gc J3Ek4vwxlDftQR+ZCe2Hl/WwI19VCRTml72J/dx+LP8uA7Q2AOTrepZuY1AVUn8NnR+sc5ZLrih EsU0frplhcRXt7Ldb8BCIqadt4fvQyIaXq/51IXLhYcwyqmeznb3ZJ8zVgzTFLKO0p/VXH3goTG w1UMgBY1emzBnyd3Xzf002YjRxvjInhxZbqScb0QNc7rTdYT00KiX/SF8xdkV6XLO/bCSVfigie a/8w== X-Google-Smtp-Source: AGHT+IFC2NhNJtewCxTZmqa7w5A7VaLmg9a31oDOYNj41JJ5yNavxgQ2e6Y1ShNeKq5qMGLzjk4wpg== X-Received: by 2002:a17:90b:1d4c:b0:32d:e07f:3236 with SMTP id 98e67ed59e1d1-34abd817345mr2126125a91.22.1765554022771; Fri, 12 Dec 2025 07:40:22 -0800 (PST) Received: from hexa.. ([2602:feb4:3b:2100:5e34:462b:e2f0:5898]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34abe23edc4sm917549a91.1.2025.12.12.07.40.22 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Dec 2025 07:40:22 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 7/7] Revert "lib/oe/go: document map_arch, and raise an error on unknown architecture" Date: Fri, 12 Dec 2025 07:40:00 -0800 Message-ID: <2b3d2b671a149cbeea2bdc9ba42192da2015c3b7.1765553842.git.steve@sakoman.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 12 Dec 2025 15:40:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/227607 From: Peter Marko This reverts commit e6de433ccb2784581d6c775cce97f414ef9334b1. This introduced a breaking change which is not suitable for backport to stable LTS branches. Signed-off-by: Peter Marko Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- meta/lib/oe/go.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/meta/lib/oe/go.py b/meta/lib/oe/go.py index 4559dc63b2..dfd957d157 100644 --- a/meta/lib/oe/go.py +++ b/meta/lib/oe/go.py @@ -7,10 +7,6 @@ import re def map_arch(a): - """ - Map our architecture names to Go's GOARCH names. - See https://github.com/golang/go/blob/master/src/internal/syslist/syslist.go for the complete list. - """ if re.match('i.86', a): return '386' elif a == 'x86_64': @@ -35,4 +31,4 @@ def map_arch(a): return 'riscv64' elif a == 'loongarch64': return 'loong64' - raise KeyError(f"Cannot map architecture {a}") + return ''