From patchwork Fri Mar 6 07:22:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82661 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE8AEF47CD1 for ; Fri, 6 Mar 2026 07:23:09 +0000 (UTC) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.64681.1772781781314431746 for ; Thu, 05 Mar 2026 23:23:01 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Sb8miqhq; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-48069a48629so93016135e9.0 for ; Thu, 05 Mar 2026 23:23:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781779; x=1773386579; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=1bLPa5jY4pi+3Y6AVIFMHps4m5gKi3qzllo2uEN40RU=; b=Sb8miqhqRK7wm4NWn8wdtn1OEds3bmx2qbfun8o4aBsjpfOBVOYT4pYkADknmnIS4N 9LpFquzfsBcgnkGyvsZ8ZHsLrti0UJicLQspXglIzptCEFeMpk5JoDlDwZVcCafTVtm7 VLcPE/jaGfhLT/PCN10NdYb7s2KO0riV7Tybg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781779; x=1773386579; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=1bLPa5jY4pi+3Y6AVIFMHps4m5gKi3qzllo2uEN40RU=; b=MzCNVInhqeRJEn8jGXNwokh4uP5a5O2RQuFhpdy93KCZLCklPDnK8eB03Cm+Q6xJ/O 6SkUElNuM3UwWWvokKXM9BTA1kNOB61yObMdhZAfYwsE+QFlYhQ8iAAYFvHSP9C5vRAA 26iAsOVtOpC1kW8mkZ/5x/rHuTJpBp/VsVTcinHbymtRZDhIaEyyupKeTeemKAKb+Jtu QJg71hyhY3W5zBsWRy2LMCno8zY5pm0hkG939YaB8HL1pgOswveC+XvatZ/IXq2b0c+P SMTPYudqdS1KxfSKjwp8ahoMvwuiyIMIJW6+shGkMbjjGrtu8wOh1lvBfbyLSrFvMOV/ F4ow== X-Gm-Message-State: AOJu0Yx+xTCB9PqeJheN+cau0EQq9ZN6HnwF46kHqzwH6lb0kSxgOK/r GLkB/jzU2Y1MMhzVIUp1JxYotEg59oLnL/Rp2nyJJL78tKeMN3Nzg8z8V0pL43QpU4vBbV9INE9 6JFrd X-Gm-Gg: ATEYQzx/rSyRDr60tq+mySgMCFlxzzl57d/EtN1UrADs88VRvOIp6l+kHtJYJjv8K+8 K6ONXkxJTwO8sVg6yHrQbTjOHYm6cFZx1j+5Asi+sIw3UJ2Rok8iAaf8YpFj2UaejUZfAKIBTE7 xf44I3TODoxbQhlPGYZbPEwQ5mKlKyTz702llq2gqocvG9mojuRFhzrOx0evCFXEi9GG6TFD7Tv N/xBOQvLN4IMhQ6V7/urBE97I1b/4h1vEVa94zyDKChVsADRlQZkRKzl1w5Fo1rE61S614diKpP lbqdcWukk4dstjK3TOsv0POx4iY3tPxdBlrb4OFNmirP1/uauqrsxU3cFcCrXgFNteGSXHR71DS XYxrcqPqZp1p+sLbxebOI+rvbWUEkd4m2qykNFmQi1ps69rifWXFwGQ04HKx6X2svtuRfSn2yCf ZtFpbLvyyeoFS6KITOvxFTVDfiIL9duDv7jedwX2vrHXxLH1qa3jlXsnD0mSCCXO5Ijgv75A1IE Q1ejnICpFR33SApGgVlUBVA+st7 X-Received: by 2002:a05:600c:3e08:b0:483:7eea:b172 with SMTP id 5b1f17b1804b1-485269675a7mr15047675e9.23.1772781779452; Thu, 05 Mar 2026 23:22:59 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.22.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:22:59 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 01/16] python3-pip: Backport fix CVE-2026-1703 Date: Fri, 6 Mar 2026 08:22:01 +0100 Message-ID: <6fed4496c22058b0cce06e18eab67457a7873b10.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232540 From: Adarsh Jagadish Kamini Include the patch linked in the NVD report: https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735 Signed-off-by: Adarsh Jagadish Kamini Signed-off-by: Yoann Congal --- .../python/python3-pip/CVE-2026-1703.patch | 41 +++++++++++++++++++ .../python/python3-pip_25.2.bb | 4 +- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-1703.patch diff --git a/meta/recipes-devtools/python/python3-pip/CVE-2026-1703.patch b/meta/recipes-devtools/python/python3-pip/CVE-2026-1703.patch new file mode 100644 index 00000000000..826f483ea21 --- /dev/null +++ b/meta/recipes-devtools/python/python3-pip/CVE-2026-1703.patch @@ -0,0 +1,41 @@ +From abce61e230c47598ce836157d075608595216a4c Mon Sep 17 00:00:00 2001 +From: Damian Shaw +Date: Fri, 30 Jan 2026 16:27:57 -0500 +Subject: [PATCH v4] Merge pull request #13777 from sethmlarson/commonpath + +Use os.path.commonpath() instead of commonprefix() + +CVE: CVE-2026-1703 + +Upstream-Status: Backport [https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735] + +Signed-off-by: Adarsh Jagadish Kamini +--- + news/+1ee322a1.bugfix.rst | 1 + + src/pip/_internal/utils/unpacking.py | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + create mode 100644 news/+1ee322a1.bugfix.rst + +diff --git a/news/+1ee322a1.bugfix.rst b/news/+1ee322a1.bugfix.rst +new file mode 100644 +index 000000000..edb1b320c +--- /dev/null ++++ b/news/+1ee322a1.bugfix.rst +@@ -0,0 +1 @@ ++Use a path-segment prefix comparison, not char-by-char. +diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py +index 0ad3129ac..7cb3de3c4 100644 +--- a/src/pip/_internal/utils/unpacking.py ++++ b/src/pip/_internal/utils/unpacking.py +@@ -83,7 +83,7 @@ def is_within_directory(directory: str, target: str) -> bool: + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + +- prefix = os.path.commonprefix([abs_directory, abs_target]) ++ prefix = os.path.commonpath([abs_directory, abs_target]) + return prefix == abs_directory + + +-- +2.34.1 + diff --git a/meta/recipes-devtools/python/python3-pip_25.2.bb b/meta/recipes-devtools/python/python3-pip_25.2.bb index 350092d9ad0..496eff1f15d 100644 --- a/meta/recipes-devtools/python/python3-pip_25.2.bb +++ b/meta/recipes-devtools/python/python3-pip_25.2.bb @@ -24,7 +24,9 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=63ec52baf95163b597008bb46db68030 \ inherit pypi python_setuptools_build_meta -SRC_URI += "file://no_shebang_mangling.patch" +SRC_URI += "file://no_shebang_mangling.patch \ + file://CVE-2026-1703.patch \ + " SRC_URI[sha256sum] = "578283f006390f85bb6282dffb876454593d637f5d1be494b5202ce4877e71f2" From patchwork Fri Mar 6 07:22:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82665 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 215D9F01801 for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64464.1772781781849653840 for ; Thu, 05 Mar 2026 23:23:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=zmkGT2eR; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4836f363ad2so103973205e9.1 for ; Thu, 05 Mar 2026 23:23:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781780; x=1773386580; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=f44y10boasrVvjD7pLzjbdEOwWhty8Ztk3YLro0e3mY=; b=zmkGT2eR5vQwcKOdjOYezqhxZ45gBGM9zZWFRJihemrIu77S/kHunuWJsk7TsSRm6s Vv1GDibdJUoRkmhfV8M+eP+6ohmgu+7mL/L+pb3jiANgYQ7KkMO8ciymnt2OKWI4hhYa BRRKG2icxfAjYO713vDjCR2WlTtc0ArfB1IS0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781780; x=1773386580; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=f44y10boasrVvjD7pLzjbdEOwWhty8Ztk3YLro0e3mY=; b=FzuAb74yncndDMIh6bHz2LgDtmb0ULDQCF8tBi7301aXxyOBUqN/LsfaOb0uAdvIqr ydmSuzChAWB3ftAjP815OOBFE14j+RqmkRpEQmtxmLWpGP/yz6Jqn/nCyMte9ZDvHVzy PNJYj4HwXqJUSgoJxJ2dC+5MEUStpUkEHC8p0HHxqiwPFBsiTwPzZ+tJz0JBFJtFCruh 7fj1/Iws/BHHctVPnq4gnhqhkRV5waQF2JQNL5LEFaD0fgOr7Xm3yEuMqL5rBhrBx7gn 6mTVKGoiUNZgfiaib/lFKM5VxAB7bbkjHayOCpT+zXKalYOLLrfjQAU2CdcPMeQ8KAMC CXGQ== X-Gm-Message-State: AOJu0YyK5WCaz2CGnZbl4EUUIAnlP7T9fekr4iDU8kz1SSAU4R2mEYso eNq+f6mFjqc9DCBVSolLh28agiskZXxtmxeJCW+XiViNlDZ4FShM4wVjnslEvH9cVAp7ABy0ZWG jxETf X-Gm-Gg: ATEYQzxawX6wfD6TBQSMChVDW8fn1+NFWtf2jcRvqf6HYsG57uo6zQXitYYPK+7nPeg cvpUXOiwFeUC9N5ziToypRlKWdxRyUG6Ftk/j7u4b8RkHOjhzvdti09p9nocA2cf4g1/tWAjiWz DlNL7lkkatx3hBhZKcP0K7rZZJepyQvxJE0+gVwHOSJu74+O1vQjQFnqCeihXJiq70sdAY4nx1y 9H4wpP+7Mn0wSZfxtDw7okn0MCGCwf+gbO4QzaaNjmo8natNIpepFqXRdZSX5+Mpg04yobR7LK+ 32p5fmhP3m6HDTz+5OY8SiTbpFMSJSfgIuHf3NXiI/v/UFSun0q6ULtLTdQxV18sx1U9TqbUY5K MPErPWKUgxFN5A8FCgqi8tnUeoUpD0yjm6wRBvEUXq4uCG01BITDr7jrbICUlAPsd2kIE/LU141 kHSarknSmIjP2sTO3ZzNO8VVCKli6lkJ7H2pj28nOQZzCZg69hu7hcmW/f7l0IfQsf+xGcvgfKE DA8xfI2FkfyJl2fhhXSMIWV8EuU X-Received: by 2002:a05:600c:19d4:b0:477:93f7:bbc5 with SMTP id 5b1f17b1804b1-48526923ba3mr17147685e9.10.1772781779942; Thu, 05 Mar 2026 23:22:59 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.22.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:22:59 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 02/16] wireless-regdb: upgrade 2025.10.07 -> 2026.02.04 Date: Fri, 6 Mar 2026 08:22:02 +0100 Message-ID: <6560f78f56a50581cc769c12d29f1795c9dc39cc.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232541 From: Ankur Tyagi Signed-off-by: Ankur Tyagi Signed-off-by: Yoann Congal --- ...ireless-regdb_2025.10.07.bb => wireless-regdb_2026.02.04.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2025.10.07.bb => wireless-regdb_2026.02.04.bb} (94%) diff --git a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2025.10.07.bb b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2026.02.04.bb similarity index 94% rename from meta/recipes-kernel/wireless-regdb/wireless-regdb_2025.10.07.bb rename to meta/recipes-kernel/wireless-regdb/wireless-regdb_2026.02.04.bb index 68ae3b0464c..2f7c8160434 100644 --- a/meta/recipes-kernel/wireless-regdb/wireless-regdb_2025.10.07.bb +++ b/meta/recipes-kernel/wireless-regdb/wireless-regdb_2026.02.04.bb @@ -5,7 +5,7 @@ LICENSE = "ISC" LIC_FILES_CHKSUM = "file://LICENSE;md5=07c4f6dea3845b02a18dc00c8c87699c" SRC_URI = "https://www.kernel.org/pub/software/network/${BPN}/${BP}.tar.xz" -SRC_URI[sha256sum] = "d4c872a44154604c869f5851f7d21d818d492835d370af7f58de8847973801c3" +SRC_URI[sha256sum] = "0ff48a5cd9e9cfe8e815a24e023734919e9a3b7ad2f039243ad121cf5aabf6c6" inherit bin_package allarch From patchwork Fri Mar 6 07:22:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82667 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31BAAF01804 for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64465.1772781782464469865 for ; Thu, 05 Mar 2026 23:23:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=dfnCbV4M; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-48375f10628so58882265e9.1 for ; Thu, 05 Mar 2026 23:23:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781780; x=1773386580; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=ehiShr3c2C4v1lOrNUpIgEsACwgAJ96RiOm+Q3kxkoE=; b=dfnCbV4MoZtWDCez7GlZsXgKqQGnsPo/nanDv/mYi+iOTwKKj9mA0vctL5yclyCK3f xqGjaPXLjSixmKBo5IZtApRRVuzQMfMg8NLwAUXAJ+Irq3rDd1O8iS56SBTjgSrFk7mB D1Y1EIMAa8GcCW6ku8VSaKRXGVPjHh3Aun6xQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781780; x=1773386580; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=ehiShr3c2C4v1lOrNUpIgEsACwgAJ96RiOm+Q3kxkoE=; b=WRhjTFUBKdPK4G4jUDNwUO4VfVfIO85585gZg+W+HrqIiMDIhyYXjU/axSROCjJc75 2+WzV2jH6fBA4ovm+p+YwSV17bOMpDdQ/WC4sklqaGNmXKd98d/REwTRyOTkusg3ObVY WrwWJn+B8iDyx0AkUIP2KFGCggKVaWni0omSTMdWUTITdS2Fyko9UnQ6iUQvCPLL4+oX HM6SUudJ6oi3Jg00MNJiFLiwzpG5ywRH4xGMnMVy1UdH/ZJPT34SmVtPoiN+6M+37UI1 8dUhEhFdVH6qvUoDLMNPfhqeAzzJsjCTN1xKLx3vhinWCXlRvrUcOG9YIddWwQ9bJ5Z6 +CMw== X-Gm-Message-State: AOJu0YzAa/8jvIrXZmtJBtNczzfVgd7alAGnkkVuF62eFtmMYtx9sh+w JCDKZB8dUeNMJXaMPpdGjU8jFipp9i1ApPCeiq815fQn2HT5ME07g+Y6JErQAeeBs2wk66IanRr neGZU X-Gm-Gg: ATEYQzyg/jUdg1dUzgHWCaGVKUPeO9ZzXEOx0NGTQcdeYxU9IMRipXSMVnZ2P9Trmij wDfsjTRaM1mpuuL9zloSsq+r7QAd0Nyyx5EsJbqeJWZyO3uReFaC8Tw6IE1Q7aOsB9Fq9yQ2uuS mWd+weT2EINExthtnxBV3gtVT1aVKs3ccZ+BQnt03geYI1qmieksWh5tt6G5/6K/hwqPR2RbPZ5 P+mLtRmbC4wgXs7PMTRUnf5G3iKAJRbJUedz3qgC0/NZW863s3+hRywlcBJ9ZqzigkIwi2PEn/o 3qosgDOK1p3mKA9IPP1osxa9BQ1kwLt6OPmfy8uE5jQf4gBQxpeCSgpAVqT6yaCsl8NWE7xye1O Mo+Vsd6dSH3cK3hfPsPthW129Y1RCmW0iEc9KXSu6+mtKpoODuRf7q4kyLzxvji3afyAp+aUMqZ Lflf7OyQqUQgvRYbYKVZoHEK7dtMcTwMaxCuOM2Dj2lK7gZX3WNb5y0eM8PUToEVj55//0XI6h3 jo+2ZL4wvtYpoKke6kwJx35zHRn X-Received: by 2002:a05:600c:37c9:b0:483:612d:7a9a with SMTP id 5b1f17b1804b1-485268bf171mr16605285e9.0.1772781780468; Thu, 05 Mar 2026 23:23:00 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:00 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 03/16] gdk-pixbuf: Fix CVE-2025-6199 Date: Fri, 6 Mar 2026 08:22:03 +0100 Message-ID: <7dd07c908c00be28866690e32c2e6c37b3136c27.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232542 From: Shaik Moin Backport the fix for CVE-2025-6199 Add below patch to fix CVE-2025-6199.patch Reference: In Ubuntu and debian, fixed patch is given -> [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/c4986342b241cdc075259565f3fa7a7597d32a32] Signed-off-by: Shaik Moin [YC: Link to Debian security tracker: https://security-tracker.debian.org/tracker/CVE-2025-6199 ] Signed-off-by: Yoann Congal --- .../gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch | 36 +++++++++++++++++++ .../gdk-pixbuf/gdk-pixbuf_2.42.12.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch new file mode 100644 index 00000000000..1952e3ceaf5 --- /dev/null +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch @@ -0,0 +1,36 @@ +From 140200be0b4d5355aab76a6fd474e17d117045ca Mon Sep 17 00:00:00 2001 +From: lumi +Date: Sat, 7 Jun 2025 22:27:06 +0200 +Subject: [PATCH] lzw: Fix reporting of bytes written in decoder + +When the LZW decoder encounters an invalid code, it stops +processing the image and returns the whole buffer size. +It should return the amount of bytes written, instead. + +Fixes #257 + +CVE: CVE-2025-6199 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/c4986342b241cdc075259565f3fa7a7597d32a32] + +Signed-off-by: Shaik Moin +--- + gdk-pixbuf/lzw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gdk-pixbuf/lzw.c b/gdk-pixbuf/lzw.c +index 15293560b..4f3dd8beb 100644 +--- a/gdk-pixbuf/lzw.c ++++ b/gdk-pixbuf/lzw.c +@@ -208,7 +208,7 @@ lzw_decoder_feed (LZWDecoder *self, + /* Invalid code received - just stop here */ + if (self->code >= self->code_table_size) { + self->last_code = self->eoi_code; +- return output_length; ++ return n_written; + } + + /* Convert codeword into indexes */ +-- +2.34.1 + diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.12.bb b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.12.bb index 98993cc07d7..f22dc2cd915 100644 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.12.bb +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.12.bb @@ -22,6 +22,7 @@ SRC_URI += "\ file://run-ptest \ file://fatal-loader.patch \ file://0001-meson.build-allow-a-subset-of-tests-in-cross-compile.patch \ + file://CVE-2025-6199.patch \ " GIR_MESON_OPTION = 'introspection' From patchwork Fri Mar 6 07:22:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82666 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59A1FF01806 for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64467.1772781782965613637 for ; Thu, 05 Mar 2026 23:23:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=kq70++97; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4806ce0f97bso77949505e9.0 for ; Thu, 05 Mar 2026 23:23:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781781; x=1773386581; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=zdaMzEodhNxK4FzPXn5r1stqGhDppxkJrKueAaSt3rc=; b=kq70++972qXgofO49qEtVQ/yjYAXy6R3QkeQIGyltwcBoUcYhboIEvLXKpZZZXPIj6 Pw3gVf+vf2ydVPQFIwYPvXOE4TIzRDFlF0uSsnKmSSEDDPjP1SbQTKoBhblDOH/iyCzY pmm7WZ5etBNyBfuC9eL3zc2e8rdMcNBmLm8Y8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781781; x=1773386581; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=zdaMzEodhNxK4FzPXn5r1stqGhDppxkJrKueAaSt3rc=; b=pulbXq5vCxaX8o2sU0aB5UvCao1qSky5UOdZsaGz0s8YMEEmVbYisiDDxFVFURTFnO 2/wvzWNOGwZoXvidcq3sktNJTd5N0KsdMqUidBQ16Q0b4N1No0bec3591PlXLkweL0uI 3a4ur1un91TwyWOy2D851G+0xlPcCQb1ehdIHtVoCmlwMGudqVZRYhhHtO27FLZs/lQc n8ObrhkcSOGUp21y579HMJouWLChY7syjrANRVnSThIQ1b5QMhmb0kaIDk/QxtmogzoX uTz3/IRwhPHi4eKsttvsrApc74qyyPO3sHYch2L4nWXn3anWqAnkZSl5tLucc9GS4csg agTg== X-Gm-Message-State: AOJu0YyaDKmCj4bUCenBfwdebenCHqaKvqkaMUSZ/+ZJGNWADe7XYUdg mimoonz6lNbg/6zys4ePM3cKTGyRFPlxuQWYcKBVC/yRDxBMRUTbqqv0ItLWFw1+I7w0jZYyRHG Xe4N0 X-Gm-Gg: ATEYQzxKiL3SNnKfhaxxOFPk/rHd3Z1VjFxKKJJ6z1tQWHOHdQl2Cro/Px/5r2UnZPN +6Jt+s/xLpA83u9CqNa63ISDIQGjPjqIQfg3R/sfZDeZ/ZTgxjdweKuSUGBEQg7biCgx9aeBJel BLGwTBC5ApRsl0hHfI2Bj5ezlH3b5d9E4C5aCpIu2gzYFHzjQdxBImY+bReJgqCMJ443q+g2MNu 43yiK9iL2BRatOGYC7PafEHmhD2swLT1kmTRNpyT9aHaZK+2HBm5GwF0EqT5gsRvvUxSyOcqbqq bgLzndYN0Ohyqg5FQdb77+OtqiI+juDaER1lbFTWn+4csZyuXdHFKosKT5dnhe/GuUlLkFBCjkw J9kwRWLlwziaC69EDGz3m4g/PJvX66xR+rmMo6uiwtrhQXNHLRxtGqSHan7sXE/8YTAuPSRgFwq KuNHBrdG0ZuIchEDzTC0OyitB8rJlnyoclfxmoT0qWmvlhHr8o+am2YKZpAEmkXtZhPdHey/cop On6dnoouvYATjwV3/zts3muNCdfnD07B9rbxsY= X-Received: by 2002:a05:600c:4752:b0:483:b505:9db7 with SMTP id 5b1f17b1804b1-48526976a4cmr13060635e9.32.1772781781068; Thu, 05 Mar 2026 23:23:01 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:00 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 04/16] linux-yocto: apply cve-exclusions also to rt and tiny recipe variants Date: Fri, 6 Mar 2026 08:22:04 +0100 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232543 From: Peter Marko Version is the same as base kernel, only configuration differs. There is no reason to not apply the exclusions to all variants. This commit is equivalent of master commit 77fb0331ecc0cb9eff6a711c2a7889f2f6bdda92 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb | 1 + meta/recipes-kernel/linux/linux-yocto-rt_6.16.bb | 1 + meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb | 1 + meta/recipes-kernel/linux/linux-yocto-tiny_6.16.bb | 1 + 4 files changed, 4 insertions(+) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb index e720629b14d..5816902a7ff 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.12.bb @@ -3,6 +3,7 @@ KBRANCH ?= "v6.12/standard/preempt-rt/base" require recipes-kernel/linux/linux-yocto.inc # CVE exclusions +include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.12.inc # Skip processing of this recipe if it is not explicitly specified as the diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.16.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.16.bb index d1f7e76501d..2b54315670b 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.16.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.16.bb @@ -3,6 +3,7 @@ KBRANCH ?= "v6.16/standard/preempt-rt/base" require recipes-kernel/linux/linux-yocto.inc # CVE exclusions +include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.16.inc # Skip processing of this recipe if it is not explicitly specified as the diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb index 164557eaa0a..5828ff986bd 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.12.bb @@ -6,6 +6,7 @@ KCONFIG_MODE = "--allnoconfig" require recipes-kernel/linux/linux-yocto.inc # CVE exclusions +include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.12.inc LINUX_VERSION ?= "6.12.69" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.16.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.16.bb index ef904adad48..92c26d42e3d 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.16.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.16.bb @@ -6,6 +6,7 @@ KCONFIG_MODE = "--allnoconfig" require recipes-kernel/linux/linux-yocto.inc # CVE exclusions +include recipes-kernel/linux/cve-exclusion.inc include recipes-kernel/linux/cve-exclusion_6.16.inc LINUX_VERSION ?= "6.16.11" From patchwork Fri Mar 6 07:22:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82663 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BFD8F01800 for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64468.1772781783609485246 for ; Thu, 05 Mar 2026 23:23:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=1P1OHVfZ; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4806cc07ce7so101969515e9.1 for ; Thu, 05 Mar 2026 23:23:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781782; x=1773386582; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=pzRtz2kQKFk0agpovMJatOOGc0oV13I2FcQL+YGZZeg=; b=1P1OHVfZOUJ0QB9li9YsvwyU4D6diJn3cYWeuP4C56FJeDvKQut/avCTgqb5jjn3je p1TxA8/LaW6Y2IeH2GRVL3HovtM5vBXmVud5c17VsQLzn1/BPdGzrubF/aJ2lPlSRwBx RAyQJw93CEmCzJZYdPFLdui0rFQyZvFv2cevw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781782; x=1773386582; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=pzRtz2kQKFk0agpovMJatOOGc0oV13I2FcQL+YGZZeg=; b=WDBxUat30ztFw8YywDVdxxG4Aj0ZsDqeHX4GBocK5kZHvoO+hPgudNFkTZEiqFZS8E 7B3iovj8bbbj1gE6gbKdP11iCth3MXck1OpF+4Z+MWoKND6hO4CRlPTvLk7IpItZVxZ1 RmuXn+3O2vqzIXmg6f0xxU2zEF2DBsjlLEojdmwh7BpDolu+DVGAu+TI8JJONjBkzVz2 1BKY1wx/qID4QJ+czk0oDNIleVeFUvvmh1Y9ldINSQbCL5o2GtiOWRQMKaK0A7Kwq7J+ cDuWh69yoVNQ+J60rclt1tP/Oi7rRBi+XkJ/A2uHV5bDzfMve5Z+hP9xGyitW4acOdJM MW6g== X-Gm-Message-State: AOJu0YzMoRVgthzBbATye54FmpFXjm54l/z49kSlpH7S7iUBAcSm3djl ZDS0ZTs/bjwom511pVqlhR4Kfb9w4IT0d2ze/xtIIjlJpffkJpOXfgq8L+8O2CXJ1Fn9i8mrb7N dL3Qj X-Gm-Gg: ATEYQzxmZ6Q8bIhFiD8IPqZoL3bUBdfBGzDAAiWegcjNxGTC/qWeigoNHrbxA70Z6Dj WtnlS9DbdQht/mkkcP4/YsOoOvYCu1qZ/9L3kEAFFoiI/EwUX1PdU4ZA6PN7t2p2wmW9wVo+JDj 7OYYgyZJHvMUSC2jiXgc7zGJwonoipET98H3DfiqUrVl8se/tu7/U/q/+YkAQkcKh7xr6FHpIyO smCFg1hYODkedr6Ry3L5BSGejhu9daTF0VVagfe7Etr4ZGrD28ayW2oFV2khRkMvnvJ21E2t4Ig /sDXdPnmj+9IxdzQuSTq/9d8bteKA0btddb5sVfXfYl8XaJMAkDQyQQ5kZup//KY+JZCVeWBrRH vM93Bw5mC5zPAs9wryxZPZZiCZDX9fEOZHRz2vw9LN8Be3gX03VzQm8hOq+YAReieugUOD2FQGU vkuIFprc2absfGmDjML7mnszoNkzZqWQb5R9MrPeq2KWw7mpTzqV0IM0NxUYWwwV0hVPZotfN9e aIFinjQJ7fqmUlQIfD1dnZE5siU X-Received: by 2002:a05:600c:6299:b0:483:54cc:cd89 with SMTP id 5b1f17b1804b1-48526923b3cmr14482995e9.9.1772781781600; Thu, 05 Mar 2026 23:23:01 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:01 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 05/16] cve-exclusions: set status for 5 CVEs Date: Fri, 6 Mar 2026 08:22:05 +0100 Message-ID: <896237f72aa5c5b46023fcb39de64935da11dfda.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232544 From: Peter Marko Reuse work of Debian researchers and set status for fixed CVEs accordingly. These are not tracked by kernel itself, so generated exclusions won't help here. * https://security-tracker.debian.org/tracker/CVE-2022-38096 * https://security-tracker.debian.org/tracker/CVE-2023-39176 * https://security-tracker.debian.org/tracker/CVE-2023-39179 * https://security-tracker.debian.org/tracker/CVE-2023-39180 * https://security-tracker.debian.org/tracker/CVE-2023-6535 Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 699dbbdf3ab2693bae8a7e0425e2519250fdfec4) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-kernel/linux/cve-exclusion.inc | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 80c76433ef2..7d68a9bbaac 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -157,3 +157,19 @@ CVE_STATUS[CVE-2023-7042] = "fixed-version: Fixed from 6.9rc1" #Fix https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7315dc1e122c85ffdfc8defffbb8f8b616c2eb1a CVE_STATUS[CVE-2024-0193] = "fixed-version: Fixed from 6.7" + +# Fix https://git.kernel.org/linus/517621b7060096e48e42f545fa6646fc00252eac +CVE_STATUS[CVE-2022-38096] = "fixed-version: Fixed from 6.9" + +# Fix https://git.kernel.org/linus/5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c +# Fix https://git.kernel.org/linus/79ed288cef201f1f212dfb934bcaac75572fb8f6 +CVE_STATUS[CVE-2023-39176] = "fixed-version: Fixed from 6.5" + +# Fix https://git.kernel.org/linus/e202a1e8634b186da38cbbff85382ea2b9e297cf +CVE_STATUS[CVE-2023-39179] = "fixed-version: Fixed from 6.5" +CVE_STATUS[CVE-2023-39180] = "fixed-version: Fixed from 6.5" + +# Fix https://git.kernel.org/linus/efa56305908ba20de2104f1b8508c6a7401833be +# Fix https://git.kernel.org/linus/0849a5441358cef02586fb2d60f707c0db195628 +# Fix https://git.kernel.org/linus/9a1abc24850eb759e36a2f8869161c3b7254c904 +CVE_STATUS[CVE-2023-6535] = "fixed-version: Fixed from 6.8" From patchwork Fri Mar 6 07:22:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82658 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1AF4F5141C for ; Fri, 6 Mar 2026 07:23:08 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.64685.1772781785605800867 for ; Thu, 05 Mar 2026 23:23:05 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=ncZ2QbRh; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-48329eb96a7so58641605e9.3 for ; Thu, 05 Mar 2026 23:23:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781784; x=1773386584; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=njpY43cUsFTxwlAfg2Ji7SvYZpV79HUJrf8BEPfihjY=; b=ncZ2QbRhDnnaQdfIodNFCU3zGFINM1F5nF6/zzFJg7Y+k3PCdG54DobmhoHHRTDPHu 1d/UlsgGCHvNWn3lzxghLN27psg7TOJ36tjhnk3Dh+JeOmRaDZXTo7aqgj0SsjfwyZzV V5zfdzyg059BVFOHGiuMMmKuFRcyunvoXng9E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781784; x=1773386584; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=njpY43cUsFTxwlAfg2Ji7SvYZpV79HUJrf8BEPfihjY=; b=KifNlLgsIAGpxRYMt6/PGR2enRSl3Z5jt+yG+tB0APGKF1SsoaiQeB4Ets1RbA4leM 8ryMokcR8n+Xt6MAxVI1Ui8g8tD4/1aunrqgeFwh4IJ5ubrwcjxyvnuL3DQZimUVi81H ukPAvGtRs2GjYAtIklXyWuyRknPPTntme5d+d9H9LyIRvwyFAJJrAZQg6moq6Oap8OYk jzxYPRJ9RooYtp2BrWA8YvOh73/AucikOZDTW0pNd/ZVmJhaHHdrW1f6Vt4xWUPbOgYW mOTQxwABinjPiHekmpuhtd9gKXMBVyhvIbGpjjxk5IEQRhqUB3t5vv3D+XBsO8Hs+HyF p4bg== X-Gm-Message-State: AOJu0YygWKtlnYpOhjPYBkrxlin2H0XESdDgBYoPuw53tRtKT2aXGgd8 2N68SD4kAxitwO7ktzMkzecmhNvPKzC/OKnfHgXX17lCpXfdBE7jIoZ/jcjTgh2W7fBV1MHckDw MKxEE X-Gm-Gg: ATEYQzxQ6q+8btQAqubrD4XAiICXpCTL1sY7YFFVZ+f1Ew6Zet3izXFBRk5RcyKKF/K gnIUwUbFRyUIOSBGFRGwaXWCTnXiIWlR0KpBwXcWhA8zYy3VRQxUx5AZvkhMosGmKcd1++h5YWN anRhO3uFtomytFnLbT8hjM+AxHO68VLSn5l9eqYei7EABrFCq/DIfR1nWaILVyt52TSC3Vefx5T 9v8ivoa6yAXgUMQ8anmcXsa0yZ5Wu7gRo1rV4+7b36Opd+giyq3z2pKj1gW9HWC+3iimOPv6UDt UcxlW6OEaCpGIK/OC2ToCGlJu/fkFFjd7qSLoeNJwRzXqeRGB9/0Mw6r9HoMSIbeE04ZfKEgE+T 3Ew2pusQj/CPp+iNeMBzhRcl+IDcf6HHfy+Cs4B6ELa4vmFKuksoTt8S852atkmlDPNRS78pCeg g/opiH3CjeLQjZ889uOsmpOW5Kd5hr2Gzs320IYyzEE0Cm4abfuK0coPCCpG2emelqTv9dZwMBr Bf+iuR60m8vbwbHPwjP9nV++PMDhoHxUZMx5ow= X-Received: by 2002:a05:600c:3509:b0:477:7f4a:44b4 with SMTP id 5b1f17b1804b1-4852691c673mr16311475e9.1.1772781782208; Thu, 05 Mar 2026 23:23:02 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:01 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 06/16] ffmpeg: set status for CVE-2025-12343 Date: Fri, 6 Mar 2026 08:22:06 +0100 Message-ID: <66bfcd43078d5ac3dc46e1a6a544eb2095b2c8e1.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232547 From: Peter Marko Per [1] is patch for this CVE [2]. This is equivalent of [3] which is included in n8.0. [1] https://security-tracker.debian.org/tracker/CVE-2025-12343 [2] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/b8d5f65b9e89d893f27cf00799dbc15fc0ca2f8e [3] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/263e819aa45cd3c48bf6887be02b4ec504c02048 Signed-off-by: Peter Marko [YC: commit 8536c8b9e9093ac2d7d82c49e61e1c1cded5d1e0 upstream] Signed-off-by: Yoann Congal --- meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.bb index 1e59bfa33fe..0970575b3ca 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.bb @@ -177,3 +177,4 @@ CVE_STATUS_WRONG_CPE[status] = "fixed-version: these CVEs are fixed in used vers CVE_STATUS[CVE-2025-25468] = "fixed-version: these CVEs are fixed since v8.0" CVE_STATUS[CVE-2025-25469] = "fixed-version: these CVEs are fixed since v8.0" +CVE_STATUS[CVE-2025-12343] = "fixed-version: this CVE are fixed since v8.0" From patchwork Fri Mar 6 07:22:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82668 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90E9EF01808 for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64470.1772781784754330265 for ; Thu, 05 Mar 2026 23:23:05 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=jiia1mud; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4836f4cbe0bso76697585e9.3 for ; Thu, 05 Mar 2026 23:23:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781783; x=1773386583; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=JYoNDMjelospYlbKoZqhkBVyOEU0ikkLfF8ZJ9JjW+U=; b=jiia1mud4TcSfIuBZOVjsC1Ih7pmWwkoALjlx7Y2yH5x+coagjIWVgEygSlyV1kFz3 iGj78Sz5hDEpWm96PP6wH0+IeqfclnE/5nHNZjcCbXKDR/07Wha1/gmfev4Wdw9OtVH4 xVCdVUglMpt/++zYMO0sd1ifg3f8/p8sofASQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781783; x=1773386583; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=JYoNDMjelospYlbKoZqhkBVyOEU0ikkLfF8ZJ9JjW+U=; b=vtXij1hqd+faDxMS93v4zahJFVgMEo0zjEWONRNsKdo/Hk+BTVVb/8xm64Df/l0APV GQr+DK9/T9i9jMs60A9iQ4Vs0yojFYZZ8LJjBMRuvMEdbHEdPA+99IWR8t6D3Qohh3wC kkwfHAm7LqHuF5EiYWmdFC9gt2HeFSpH+v/U/cbbWeE9djHYpUzwW7Bp00SLbB/jwMdi e+4ynSbwFElq93ieoQIiIWI8mEFpKGD+gwkXhUOCl6BzuSAyok4VJvoQxhY7DVZL3YVc c02ic6Tfcg5neMWDf2JsekqGoxd1HTatp2Dm/eWuQUedzbhDNmjEnu2sfnm70AoNPz3y Ppkw== X-Gm-Message-State: AOJu0Yw3TUzwVVkD21qg1co72Ca7uSEqfhwnb8RjL17PvsLN6WzfXLNO w/ZrbWMj2aPSM19LuDpOkyV8+1v4XMb8js7wJKPpoh1foT+gGKUs0UZtELWKlPCeGhPCWrm98Ke hVZfU X-Gm-Gg: ATEYQzzxWab9LKuidC5zN0YY1qMZ4iH7zpbb9HdmchsP0EJGCdxU0KU37UiajSJrP4n YAik3C4QKkxITJFMcd9XilUqRMo0X/f3m0HMJr4z8kAlXSW+mddS1kKYyQzir63FUzNqPI4kfit 0bhYhzjPAQXrM3/LFqcae6pLfHAY4EGk4e+LpIrS+p7Z6DTVTZrtcCaiSGJCF+FZgA1hdcBw6Wg 8/W8i0/9QoKLBThgVp3TYbQtSWULMa872fACo0lflRK5VIFg3fu7OiTuO4XzCuyXoP48IHgC+AJ o30ZSkKTAjIiZRPMtYxqMs+RgN1RwN4Z+azJdkzmuGaKPOUGUn4AyITD/5GjCr8JETlZGICSxdf Ob9+2wQl1K+MqsWvT2Fo2737MHX8SKjgzhTtckV91bo15iXLfrHduKkTCWw+O7iPo8ZHB58UGM+ wXA9lb8ChZ7LQ4KG89sops0QPHChwHrz1Cp6SKy6RY/xRRif8W+DMuPrKKBcvwZj/9jz+iJa9II F0Q02ZUel9NQLWYvjUN+cpl/ABN X-Received: by 2002:a05:600c:1e2a:b0:471:700:f281 with SMTP id 5b1f17b1804b1-4852695d227mr14174485e9.25.1772781782720; Thu, 05 Mar 2026 23:23:02 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:02 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 07/16] zlib: Fix CVE-2026-27171 Date: Fri, 6 Mar 2026 08:22:07 +0100 Message-ID: <56fa706a39e837f5c4b9e782f215fa98ea23df12.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232545 From: Hugo SIMELIERE Pick patch from [1] also mentioned in [2] [1] https://github.com/madler/zlib/issues/904 [2] https://security-tracker.debian.org/tracker/CVE-2026-27171 Signed-off-by: Bruno VERNAY Signed-off-by: Hugo SIMELIERE Signed-off-by: Yoann Congal --- .../zlib/zlib/CVE-2026-27171.patch | 63 +++++++++++++++++++ meta/recipes-core/zlib/zlib_1.3.1.bb | 1 + 2 files changed, 64 insertions(+) create mode 100644 meta/recipes-core/zlib/zlib/CVE-2026-27171.patch diff --git a/meta/recipes-core/zlib/zlib/CVE-2026-27171.patch b/meta/recipes-core/zlib/zlib/CVE-2026-27171.patch new file mode 100644 index 00000000000..e6a8a3eac5f --- /dev/null +++ b/meta/recipes-core/zlib/zlib/CVE-2026-27171.patch @@ -0,0 +1,63 @@ +From f234bdf5c0f94b681312452fcd5e36968221fa04 Mon Sep 17 00:00:00 2001 +From: Mark Adler +Date: Sun, 21 Dec 2025 18:17:56 -0800 +Subject: [PATCH] Check for negative lengths in crc32_combine functions. + +Though zlib.h says that len2 must be non-negative, this avoids the +possibility of an accidental infinite loop. + +Upstream-Status: Backport [https://github.com/madler/zlib/commit/ba829a458576d1ff0f26fc7230c6de816d1f6a77] +CVE: CVE-2026-27171 + +Signed-off-by: Hugo SIMELIERE +--- + crc32.c | 4 ++++ + zlib.h | 4 ++-- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/crc32.c b/crc32.c +index 6c38f5c..33d8c79 100644 +--- a/crc32.c ++++ b/crc32.c +@@ -1019,6 +1019,8 @@ unsigned long ZEXPORT crc32(unsigned long crc, const unsigned char FAR *buf, + + /* ========================================================================= */ + uLong ZEXPORT crc32_combine64(uLong crc1, uLong crc2, z_off64_t len2) { ++ if (len2 < 0) ++ return 0; + #ifdef DYNAMIC_CRC_TABLE + once(&made, make_crc_table); + #endif /* DYNAMIC_CRC_TABLE */ +@@ -1032,6 +1034,8 @@ uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2) { + + /* ========================================================================= */ + uLong ZEXPORT crc32_combine_gen64(z_off64_t len2) { ++ if (len2 < 0) ++ return 0; + #ifdef DYNAMIC_CRC_TABLE + once(&made, make_crc_table); + #endif /* DYNAMIC_CRC_TABLE */ +diff --git a/zlib.h b/zlib.h +index 8d4b932..8c7f8ac 100644 +--- a/zlib.h ++++ b/zlib.h +@@ -1758,14 +1758,14 @@ ZEXTERN uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2); + seq1 and seq2 with lengths len1 and len2, CRC-32 check values were + calculated for each, crc1 and crc2. crc32_combine() returns the CRC-32 + check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and +- len2. len2 must be non-negative. ++ len2. len2 must be non-negative, otherwise zero is returned. + */ + + /* + ZEXTERN uLong ZEXPORT crc32_combine_gen(z_off_t len2); + + Return the operator corresponding to length len2, to be used with +- crc32_combine_op(). len2 must be non-negative. ++ crc32_combine_op(). len2 must be non-negative, otherwise zero is returned. + */ + + ZEXTERN uLong ZEXPORT crc32_combine_op(uLong crc1, uLong crc2, uLong op); +-- +2.43.0 + diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb index ef831421216..892467a1fbd 100644 --- a/meta/recipes-core/zlib/zlib_1.3.1.bb +++ b/meta/recipes-core/zlib/zlib_1.3.1.bb @@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://zlib.h;beginline=6;endline=23;md5=5377232268e952e9ef6 SRC_URI = "https://zlib.net/${BP}.tar.gz \ file://0001-configure-Pass-LDFLAGS-to-link-tests.patch \ file://run-ptest \ + file://CVE-2026-27171.patch \ " UPSTREAM_CHECK_URI = "http://zlib.net/" From patchwork Fri Mar 6 07:22:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82669 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD1A0F01807 for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.64684.1772781785418913769 for ; Thu, 05 Mar 2026 23:23:05 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=VoNLe78l; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4806f3fc50bso96705015e9.0 for ; Thu, 05 Mar 2026 23:23:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781783; x=1773386583; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=+TB31dVuFu9Y6y5KipvqBu2vvDXlxF4PNaaTwtjySzM=; b=VoNLe78lO7eqg4UcOfZUY1c4PwIHJoL5PJy+2mKd3WeyNSjDVaqA2Hwceu4SJtLysL ZdD7HwzAIxFHUnozaWYtaCHYbwPZqdOO3Y736E0R1i4PicFZj0GVlLEihtjHJ7fNhtxe vNpzyFxZQccI4GuvhET4+JBvWcYl9NINYbm/k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781783; x=1773386583; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=+TB31dVuFu9Y6y5KipvqBu2vvDXlxF4PNaaTwtjySzM=; b=LFnND2jOU6D8F99xwtLYxXFkJKsVBNEQ505hbH+lWjpoNP8KHSsKHtYTEI71VMZrwi RwQsWUZF4zE1YhWn8C9E5mddjFhLsJe6rY6TKl+GcZAa5dZuialN9YMRp6bL26Zo67TO p7mejUFcwLS7abEK449GFvIgZMSCZV0lh8ivClIB8mOxRTTxpoL6ow0YKXP2xITyTB8z 7EsGK7hYNLhjHeDtd8b0OAQP7S0R8APM1RPKtIV6OrVSu8o3JyyAxue3ytL+9hMgo44N 8xoVAhT8tQGeGbjlEn2+ksN0tLoHELgVi6SCwZlfbSeIRJ3fbvExiHfEJm1PUF8/5X8Y 7KOw== X-Gm-Message-State: AOJu0Yy3c5qX4UnE8A/7n86tB1w9S3fXH5VzurI4Fwn2JkTfZs1GDmXy rPVRApSIFkrJEJlHkmT1QMj1Ikix1rQxQBM66nEOFhDa8dG9ZnaesM1/U9RyT10pfzl0ueVGI9S rnsUD X-Gm-Gg: ATEYQzziXFCec9Lux0BfoabVt2LFvGLGDACDNDxAWtJadBQAmind/znvqPG+bmPmlh+ T0jeLzzRGj5yhznuSlceoaWSTszrXuFwros1pL0RPIc+bpEyjsnovopaCvdcczG8JQ+3sE9bTcx 8Lz+O4I4FPufk0DcrOBpcAN4JaeGft/ECnm+nTNUsRMgn8ss9ol82HLAT4PdT51IMiew6Zr+VaB y1WrTcqOyIdoWaIEVfX6dzfHssw73HAVyUXMMbnNKn7J7h4ulmelGCjZhVAUlmsQj0qfthZpFyI AgvJf5FL2zQyYTjHJyNou8eQF5sIKfXbxcLNgc5WkRYDbO2Zo6LSH26LAG4jGai3w1Rlf/dM1n5 3WQurutTD/I3UHTB7/997nyBBlEEspH+P7h5MfyVKpNjZ5ImKZJhG98cI5tM9qoocbErXc5H6M8 P+OI6iymI7fajqEVqZYSfMp1XibKiWZ9LMljMcNUtXBf0/QRSy/sR++gIkxopQIO9N+kGMzRaQR bYV+ztQUAatnSl9fi8mDpv2VTCc X-Received: by 2002:a05:600c:500d:b0:47e:e48b:506d with SMTP id 5b1f17b1804b1-4852695b9f7mr16092365e9.16.1772781783318; Thu, 05 Mar 2026 23:23:03 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:02 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 08/16] harfbuzz: Fix CVE-2026-22693 Date: Fri, 6 Mar 2026 08:22:08 +0100 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232546 From: Hugo SIMELIERE Pick patch mentioned in NVD report [1] [1] https://nvd.nist.gov/vuln/detail/CVE-2026-22693 Signed-off-by: Bruno VERNAY Signed-off-by: Hugo SIMELIERE Signed-off-by: Yoann Congal --- .../harfbuzz/files/CVE-2026-22693.patch | 33 +++++++++++++++++++ .../harfbuzz/harfbuzz_11.4.5.bb | 4 ++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch diff --git a/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch b/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch new file mode 100644 index 00000000000..bf821bb63ae --- /dev/null +++ b/meta/recipes-graphics/harfbuzz/files/CVE-2026-22693.patch @@ -0,0 +1,33 @@ +From 21c880d1154a5bcef2ef68c1687d286820a274ee Mon Sep 17 00:00:00 2001 +From: Behdad Esfahbod +Date: Fri, 9 Jan 2026 04:54:42 -0700 +Subject: [PATCH] [cmap] malloc fail test (#5710) + +Fixes https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww + +Upstream-Status: Backport [https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae] +CVE: CVE-2026-22693 + +Signed-off-by: Hugo SIMELIERE +--- + src/hb-ot-cmap-table.hh | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh +index 294b2b60d..95a436b54 100644 +--- a/src/hb-ot-cmap-table.hh ++++ b/src/hb-ot-cmap-table.hh +@@ -1679,6 +1679,10 @@ struct SubtableUnicodesCache { + { + SubtableUnicodesCache* cache = + (SubtableUnicodesCache*) hb_malloc (sizeof(SubtableUnicodesCache)); ++ ++ if (unlikely (!cache)) ++ return nullptr; ++ + new (cache) SubtableUnicodesCache (source_table); + return cache; + } +-- +2.43.0 + diff --git a/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb b/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb index 9e0e42b7174..2364dd7efdc 100644 --- a/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb +++ b/meta/recipes-graphics/harfbuzz/harfbuzz_11.4.5.bb @@ -8,7 +8,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b98429b8e8e3c2a67cfef01e99e4893d \ file://src/hb-ucd.cc;beginline=1;endline=15;md5=29d4dcb6410429195df67efe3382d8bc \ " -SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz" +SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/${BPN}-${PV}.tar.xz \ + file://CVE-2026-22693.patch \ + " SRC_URI[sha256sum] = "0f052eb4ab01d8bae98ba971c954becb32be57d7250f18af343b1d27892e03fa" DEPENDS += "glib-2.0-native" From patchwork Fri Mar 6 07:22:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82673 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65738EFCE5B for ; Fri, 6 Mar 2026 07:23:09 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.64687.1772781786864947349 for ; Thu, 05 Mar 2026 23:23:07 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=NKgNJYZv; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4837f27cf2dso82307455e9.2 for ; Thu, 05 Mar 2026 23:23:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781785; x=1773386585; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=2QRGruo+PfcsOW5RigGNofW/qBNcrKkudy2e2IX8TWw=; b=NKgNJYZv6xMc+YPu3D+uuNFBNYtZLpKW+c/1poeUUcdDQO9uk6zDf1so1bt4wEXZQS HZ4j3DlOdNz2C1mzHZijSKD55Dke8eKs8zM1mFJCjb5auOsIrpgqcFYtcmc/+Jl5wDNz pBBxOQLLOI0AC+N0/eKCI4eTcLookovcaSXnM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781785; x=1773386585; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=2QRGruo+PfcsOW5RigGNofW/qBNcrKkudy2e2IX8TWw=; b=bCmbBz3pjEc851eJvsDNBeWdYQt5TOFEPOPySoF8QM9sXjbxtucf93ZLk70ZoCVGS7 yIcEs/AzjYNT5KKp8lO4mYzgWAKwHllvQRdF8jo8cr0lGtjfTthOI4tC6xbWUCRXOr88 dXARvIjP7PocD9lntUWWgzHl3ry73IOxni/dETE4Bh5SOQXEj9KsJuQsAyxBtWBeZsTL XJSySPSi10jT0jK2nhRf62Mdt1V33AX71RpFi+uIwUQ+h5s3+XW6NsV2OKT8QyKMtGbG aVxxs5GYWYw2jA6ZD9carHoM/FicqOoyzjDykapAqqZgfBx96Ym6h7QGo37fxIS6SlAK RVFQ== X-Gm-Message-State: AOJu0YymTvwHYL8BjoNzxKMeO8BUlDTfB8mIZ5pg/k9DUdKivuqhqFWs LZ+bf0Xnjv6dOlxfOOrXOFcGfTHjvIfKAfax9PEfe8jjPHVcEt94dYsIjimlmkDoXGn1KGdo8FF jpx4G X-Gm-Gg: ATEYQzxkcK8dOysBHauf5643GgG8dr4HJbXTVn3NGCW4GVnxqxdhmqwZnKBkAkc3wvY b/NzfdUZ1plYVmtPCj/8U8qU6wr5YNGYpe1+KE2x91Q4m0Obji3MzhaWjoYvEanwg6QnaLonQfp 8VkG4Gr4qPUeGwB255apcajnhgWCyH5ViJNHTHfkobF7e6FdjZoM1L+PTzwaFMVkcnYa2dylU2m BVDQFiKvHcKhzPWidBnCLb/s0bb6/ATO68LHGxMQX1/12oKO+cy/y3GBsxAkbqKJqT4OhbGMA7c KaCSBwPeYmOfsG1Qkcl2hU3znAB+B6rB556uLzWXbasBXym9trXLq4VGSvUWkCvG9+3TunOwBDa pAZSDUug/YasQ+Op88y8ut40VB8boVYgEmNqnq7LnGSBg+bcdEt9tfvD0Jq54/C1PIsJsB1iugB jYRTW0u55ko0PK8RBKdFmZq+fGtI/PflJF7rkTsd6MK7t/p+Aom9X/GZW17NbqL73HygIOZPdHe DVUqQuiPdRM4nqpayTUmXMG5z282FnnIXb7drM= X-Received: by 2002:a05:600c:1991:b0:482:eec4:772 with SMTP id 5b1f17b1804b1-48526977239mr14749075e9.32.1772781784022; Thu, 05 Mar 2026 23:23:04 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.03 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:03 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 09/16] gnutls: Fix CVE-2025-14831 Date: Fri, 6 Mar 2026 08:22:09 +0100 Message-ID: <12ed5b743db6658fb2b6784c82d8ddc9e46fdaec.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232550 From: Vijay Anusuri Picked commits which mentions this CVE per [1]. [1] https://ubuntu.com/security/CVE-2025-14831 [2] https://security-tracker.debian.org/tracker/CVE-2025-14831 [3] https://gitlab.com/gnutls/gnutls/-/issues/1773 Backported https://gitlab.com/gnutls/gnutls/-/commit/6e118a4dfe820ce62fc77130b89188bcd8fbcaad to apply patches cleanly. Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal --- .../gnutls/gnutls/CVE-2025-14831-1.patch | 119 +++++ .../gnutls/gnutls/CVE-2025-14831-10.patch | 424 +++++++++++++++ .../gnutls/gnutls/CVE-2025-14831-2.patch | 66 +++ .../gnutls/gnutls/CVE-2025-14831-3.patch | 30 ++ .../gnutls/gnutls/CVE-2025-14831-4.patch | 45 ++ .../gnutls/gnutls/CVE-2025-14831-5.patch | 205 +++++++ .../gnutls/gnutls/CVE-2025-14831-6.patch | 505 ++++++++++++++++++ .../gnutls/gnutls/CVE-2025-14831-7.patch | 124 +++++ .../gnutls/gnutls/CVE-2025-14831-8.patch | 155 ++++++ .../gnutls/gnutls/CVE-2025-14831-9.patch | 110 ++++ meta/recipes-support/gnutls/gnutls_3.8.10.bb | 10 + 11 files changed, 1793 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-10.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-2.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-3.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-4.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-5.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-6.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-7.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-8.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-14831-9.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-1.patch new file mode 100644 index 00000000000..1bfa771043c --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-1.patch @@ -0,0 +1,119 @@ +From 6e118a4dfe820ce62fc77130b89188bcd8fbcaad Mon Sep 17 00:00:00 2001 +From: chenjianhu +Date: Fri, 1 Aug 2025 17:18:23 +0800 +Subject: [PATCH] x509: fix incorrect handling in name constraints merging + +As mentioned in commit ca573d65 ("x509: Fix asymmetry in name +constraints intersection", 2016-07-29), the +_gnutls_name_constraints_intersect function exhibited an +asymmetry in name constraints intersection behavior, specifically +manifested as: +1. Nodes of unique types in PERMITTED (absent in PERMITTED2) were + preserved +2. Nodes of unique types in PERMITTED2 (absent in PERMITTED) were + discarded + +A 'used' flag was introduced, where if a node from PERMITTED2 was + not used for the intersection, it would be copied to PERMITTED. + +However,an unresolved edge case persisted: +- When 'removed.size > 0', the 'used' flag was unconditionally set +to 1 +- This prevented copying of PERMITTED2 nodes with unique types + +Signed-off-by: chenjianhu +Modified-by: Daiki Ueno + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/6e118a4dfe820ce62fc77130b89188bcd8fbcaad] +CVE: CVE-2025-14831 #Backport to apply CVE patches cleanly +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 5 +++- + tests/name-constraints-merge.c | 55 ++++++++++++++++++++++++++++++++++ + 2 files changed, 59 insertions(+), 1 deletion(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 3c6e306303..2be6a2aaa6 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -414,7 +414,10 @@ static int name_constraints_node_list_intersect( + gnutls_assert(); + goto cleanup; + } +- used = 1; ++ ++ if (t->type == t2->type) ++ used = 1; ++ + // if intersection is not empty + if (tmp != + NULL) { // intersection for this type is not empty +diff --git a/tests/name-constraints-merge.c b/tests/name-constraints-merge.c +index 03b3243cc7..70376aaa74 100644 +--- a/tests/name-constraints-merge.c ++++ b/tests/name-constraints-merge.c +@@ -418,6 +418,61 @@ void doit(void) + gnutls_x509_name_constraints_deinit(nc1); + gnutls_x509_name_constraints_deinit(nc2); + ++ /* 5: variant of suite 0: after moving rfc822Name (ccc.com) ++ * from NC1 to NC2, dNSName (xxx.ccc.com) should still be ++ * rejected. ++ * ++ * NC1: permitted DNS org ++ * permitted DNS ccc.com ++ * NC2: permitted DNS org ++ * permitted email ccc.com ++ * permitted DNS aaa.bbb.ccc.com ++ */ ++ suite = 5; ++ ++ ret = gnutls_x509_name_constraints_init(&nc1); ++ check_for_error(ret); ++ ++ ret = gnutls_x509_name_constraints_init(&nc2); ++ check_for_error(ret); ++ ++ set_name("org", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc1, GNUTLS_SAN_DNSNAME, &name); ++ check_for_error(ret); ++ ++ set_name("ccc.com", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc1, GNUTLS_SAN_DNSNAME, &name); ++ check_for_error(ret); ++ ++ set_name("org", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc2, GNUTLS_SAN_DNSNAME, &name); ++ check_for_error(ret); ++ ++ set_name("ccc.com", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc2, GNUTLS_SAN_RFC822NAME, &name); ++ check_for_error(ret); ++ ++ set_name("aaa.bbb.ccc.com", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc2, GNUTLS_SAN_DNSNAME, &name); ++ check_for_error(ret); ++ ++ ret = _gnutls_x509_name_constraints_merge(nc1, nc2); ++ check_for_error(ret); ++ ++ /* check intersection of permitted */ ++ set_name("xxx.ccc.com", &name); ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); ++ ++ gnutls_x509_name_constraints_deinit(nc1); ++ gnutls_x509_name_constraints_deinit(nc2); ++ + /* Test footer */ + + if (debug) +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-10.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-10.patch new file mode 100644 index 00000000000..5507719ac01 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-10.patch @@ -0,0 +1,424 @@ +From d6054f0016db05fb5c82177ddbd0a4e8331059a1 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 4 Feb 2026 20:03:49 +0100 +Subject: [PATCH] x509/name_constraints: name_constraints_node_list_intersect + over sorted + +Fixes: #1773 +Fixes: GNUTLS-SA-2026-02-09-2 +Fixes: CVE-2025-14831 + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/d6054f0016db05fb5c82177ddbd0a4e8331059a1] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 350 ++++++++++++++---------------------- + 1 file changed, 135 insertions(+), 215 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 1d78d1b..04722bd 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -446,13 +446,6 @@ name_constraints_node_add_copy(gnutls_x509_name_constraints_t nc, + src->name.data, src->name.size); + } + +-// for documentation see the implementation +-static int name_constraints_intersect_nodes( +- gnutls_x509_name_constraints_t nc, +- const struct name_constraints_node_st *node1, +- const struct name_constraints_node_st *node2, +- struct name_constraints_node_st **intersection); +- + /*- + * _gnutls_x509_name_constraints_is_empty: + * @nc: name constraints structure +@@ -716,132 +709,143 @@ typedef char assert_ipaddr[(GNUTLS_SAN_IPADDRESS <= GNUTLS_SAN_MAX) ? 1 : -1]; + static int name_constraints_node_list_intersect( + gnutls_x509_name_constraints_t nc, + struct name_constraints_node_list_st *permitted, +- const struct name_constraints_node_list_st *permitted2, ++ struct name_constraints_node_list_st *permitted2, + struct name_constraints_node_list_st *excluded) + { +- struct name_constraints_node_st *tmp; +- int ret, type, used; +- struct name_constraints_node_list_st removed = { .data = NULL, +- .size = 0, +- .capacity = 0 }; ++ struct name_constraints_node_st *nc1, *nc2; ++ struct name_constraints_node_list_st result = { 0 }; ++ struct name_constraints_node_list_st unsupp2 = { 0 }; ++ enum name_constraint_relation rel; ++ unsigned type; ++ int ret = GNUTLS_E_SUCCESS; ++ size_t i, j, p1_unsupp = 0, p2_unsupp = 0; ++ type_bitmask_t universal_exclude_needed = 0; ++ type_bitmask_t types_in_p1 = 0, types_in_p2 = 0; + static const unsigned char universal_ip[32] = { 0 }; + +- /* bitmask to see if we need to add universal excluded constraints +- * (see phase 3 for details) */ +- type_bitmask_t types_with_empty_intersection = 0; +- + if (permitted->size == 0 || permitted2->size == 0) +- return 0; ++ return GNUTLS_E_SUCCESS; + +- /* Phase 1 +- * For each name in PERMITTED, if a PERMITTED2 does not contain a name +- * with the same type, move the original name to REMOVED. +- * Do this also for node of unknown type (not DNS, email, IP) */ +- for (size_t i = 0; i < permitted->size;) { +- struct name_constraints_node_st *t = permitted->data[i]; +- const struct name_constraints_node_st *found = NULL; +- +- for (size_t j = 0; j < permitted2->size; j++) { +- const struct name_constraints_node_st *t2 = +- permitted2->data[j]; +- if (t->type == t2->type) { +- // check bounds (we will use 't->type' as index) +- if (t->type > GNUTLS_SAN_MAX || t->type == 0) { +- gnutls_assert(); +- ret = GNUTLS_E_INTERNAL_ERROR; +- goto cleanup; +- } +- // note the possibility of empty intersection for this type +- // if we add something to the intersection in phase 2, +- // we will reset this flag back to 0 then +- type_bitmask_set(types_with_empty_intersection, +- t->type); +- found = t2; +- break; +- } +- } ++ /* make sorted views of the arrays */ ++ ret = ensure_sorted(permitted); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ret = ensure_sorted(permitted2); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } + +- if (found != NULL && is_supported_type(t->type)) { +- /* move node from PERMITTED to REMOVED */ +- ret = name_constraints_node_list_add(&removed, t); +- if (ret < 0) { +- gnutls_assert(); +- goto cleanup; +- } +- /* remove node by swapping */ +- if (i < permitted->size - 1) +- permitted->data[i] = +- permitted->data[permitted->size - 1]; +- permitted->size--; +- permitted->dirty = true; +- continue; ++ /* deal with the leading unsupported types first: count, then union */ ++ while (p1_unsupp < permitted->size && ++ !is_supported_type(permitted->sorted_view[p1_unsupp]->type)) ++ p1_unsupp++; ++ while (p2_unsupp < permitted2->size && ++ !is_supported_type(permitted2->sorted_view[p2_unsupp]->type)) ++ p2_unsupp++; ++ if (p1_unsupp) { /* copy p1 unsupported type pointers into result */ ++ result.data = gnutls_calloc( ++ p1_unsupp, sizeof(struct name_constraints_node_st *)); ++ if (!result.data) { ++ ret = GNUTLS_E_MEMORY_ERROR; ++ gnutls_assert(); ++ goto cleanup; ++ } ++ memcpy(result.data, permitted->sorted_view, ++ p1_unsupp * sizeof(struct name_constraints_node_st *)); ++ result.size = result.capacity = p1_unsupp; ++ result.dirty = true; ++ } ++ if (p2_unsupp) { /* union will make deep copies from p2 */ ++ unsupp2.data = permitted2->sorted_view; /* so, just alias */ ++ unsupp2.size = unsupp2.capacity = p2_unsupp; ++ unsupp2.dirty = false; /* we know it's sorted */ ++ unsupp2.sorted_view = permitted2->sorted_view; ++ ret = name_constraints_node_list_union(nc, &result, &unsupp2); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; + } +- i++; + } + +- /* Phase 2 +- * iterate through all combinations from PERMITTED2 and PERMITTED +- * and create intersections of nodes with same type */ +- for (size_t i = 0; i < permitted2->size; i++) { +- const struct name_constraints_node_st *t2 = permitted2->data[i]; +- +- // current PERMITTED2 node has not yet been used for any intersection +- // (and is not in REMOVED either) +- used = 0; +- for (size_t j = 0; j < removed.size; j++) { +- const struct name_constraints_node_st *t = +- removed.data[j]; +- // save intersection of name constraints into tmp +- ret = name_constraints_intersect_nodes(nc, t, t2, &tmp); +- if (ret < 0) { +- gnutls_assert(); +- goto cleanup; +- } ++ /* with that out of the way, pre-compute the supported types we have */ ++ for (i = p1_unsupp; i < permitted->size; i++) { ++ type = permitted->sorted_view[i]->type; ++ if (type < 1 || type > GNUTLS_SAN_MAX) { ++ ret = gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); ++ goto cleanup; ++ } ++ type_bitmask_set(types_in_p1, type); ++ } ++ for (j = p2_unsupp; j < permitted2->size; j++) { ++ type = permitted2->sorted_view[j]->type; ++ if (type < 1 || type > GNUTLS_SAN_MAX) { ++ ret = gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); ++ goto cleanup; ++ } ++ type_bitmask_set(types_in_p2, type); ++ } ++ /* universal excludes might be needed for types intersecting to empty */ ++ universal_exclude_needed = types_in_p1 & types_in_p2; ++ ++ /* go through supported type NCs and intersect in a single pass */ ++ i = p1_unsupp; ++ j = p2_unsupp; ++ while (i < permitted->size || j < permitted2->size) { ++ nc1 = (i < permitted->size) ? permitted->sorted_view[i] : NULL; ++ nc2 = (j < permitted2->size) ? permitted2->sorted_view[j] : ++ NULL; ++ rel = compare_name_constraint_nodes(nc1, nc2); + +- if (t->type == t2->type) +- used = 1; +- +- // if intersection is not empty +- if (tmp != +- NULL) { // intersection for this type is not empty +- // check bounds +- if (tmp->type > GNUTLS_SAN_MAX || +- tmp->type == 0) { +- gnutls_free(tmp); +- return gnutls_assert_val( +- GNUTLS_E_INTERNAL_ERROR); +- } +- // we will not add universal excluded constraint for this type +- type_bitmask_clr(types_with_empty_intersection, +- tmp->type); +- // add intersection node to PERMITTED +- ret = name_constraints_node_list_add(permitted, +- tmp); +- if (ret < 0) { +- gnutls_assert(); +- goto cleanup; +- } +- } ++ switch (rel) { ++ case NC_SORTS_BEFORE: ++ assert(nc1 != NULL); /* comparator-guaranteed */ ++ /* if nothing to intersect with, shallow-copy nc1 */ ++ if (!type_bitmask_in(types_in_p2, nc1->type)) ++ ret = name_constraints_node_list_add(&result, ++ nc1); ++ i++; /* otherwise skip nc1 */ ++ break; ++ case NC_SORTS_AFTER: ++ assert(nc2 != NULL); /* comparator-guaranteed */ ++ /* if nothing to intersect with, deep-copy nc2 */ ++ if (!type_bitmask_in(types_in_p1, nc2->type)) ++ ret = name_constraints_node_add_copy( ++ nc, &result, nc2); ++ j++; /* otherwise skip nc2 */ ++ break; ++ case NC_INCLUDED_BY: /* add nc1, shallow-copy */ ++ assert(nc1 != NULL && nc2 != NULL); /* comparator */ ++ type_bitmask_clr(universal_exclude_needed, nc1->type); ++ ret = name_constraints_node_list_add(&result, nc1); ++ i++; ++ break; ++ case NC_INCLUDES: /* pick nc2, deep-copy */ ++ assert(nc1 != NULL && nc2 != NULL); /* comparator */ ++ type_bitmask_clr(universal_exclude_needed, nc2->type); ++ ret = name_constraints_node_add_copy(nc, &result, nc2); ++ j++; ++ break; ++ case NC_EQUAL: /* pick whichever: nc1, shallow-copy */ ++ assert(nc1 != NULL && nc2 != NULL); /* loop condition */ ++ type_bitmask_clr(universal_exclude_needed, nc1->type); ++ ret = name_constraints_node_list_add(&result, nc1); ++ i++; ++ j++; ++ break; + } +- // if the node from PERMITTED2 was not used for intersection, copy it to DEST +- // Beware: also copies nodes other than DNS, email, IP, +- // since their counterpart may have been moved in phase 1. +- if (!used) { +- ret = name_constraints_node_add_copy(nc, permitted, t2); +- if (ret < 0) { +- gnutls_assert(); +- goto cleanup; +- } ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; + } + } + +- /* Phase 3 +- * For each type: If we have empty permitted name constraints now +- * and we didn't have at the beginning, we have to add a new +- * excluded constraint with universal wildcard +- * (since the intersection of permitted is now empty). */ ++ /* finishing touch: add universal excluded constraints for types where ++ * both lists had constraints, but all intersections ended up empty */ + for (type = 1; type <= GNUTLS_SAN_MAX; type++) { +- if (!type_bitmask_in(types_with_empty_intersection, type)) ++ if (!type_bitmask_in(universal_exclude_needed, type)) + continue; + _gnutls_hard_log( + "Adding universal excluded name constraint for type %d.\n", +@@ -874,14 +878,24 @@ static int name_constraints_node_list_intersect( + goto cleanup; + } + break; +- default: // do nothing, at least one node was already moved in phase 1 +- break; ++ default: /* unsupported type; should be unreacheable */ ++ ret = gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); ++ goto cleanup; + } + } +- ret = GNUTLS_E_SUCCESS; + ++ gnutls_free(permitted->data); ++ gnutls_free(permitted->sorted_view); ++ permitted->data = result.data; ++ permitted->sorted_view = NULL; ++ permitted->size = result.size; ++ permitted->capacity = result.capacity; ++ permitted->dirty = true; ++ ++ result.data = NULL; ++ ret = GNUTLS_E_SUCCESS; + cleanup: +- gnutls_free(removed.data); ++ name_constraints_node_list_clear(&result); + return ret; + } + +@@ -1257,100 +1271,6 @@ static unsigned email_matches(const gnutls_datum_t *name, + return rel == NC_EQUAL || rel == NC_INCLUDED_BY; + } + +-/*- +- * name_constraints_intersect_nodes: +- * @nc1: name constraints node 1 +- * @nc2: name constraints node 2 +- * @_intersection: newly allocated node with intersected constraints, +- * NULL if the intersection is empty +- * +- * Inspect 2 name constraints nodes (of possibly different types) and allocate +- * a new node with intersection of given constraints. +- * +- * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value. +- -*/ +-static int name_constraints_intersect_nodes( +- gnutls_x509_name_constraints_t nc, +- const struct name_constraints_node_st *node1, +- const struct name_constraints_node_st *node2, +- struct name_constraints_node_st **_intersection) +-{ +- // presume empty intersection +- struct name_constraints_node_st *intersection = NULL; +- const struct name_constraints_node_st *to_copy = NULL; +- enum name_constraint_relation rel; +- +- *_intersection = NULL; +- +- if (node1->type != node2->type) { +- return GNUTLS_E_SUCCESS; +- } +- switch (node1->type) { +- case GNUTLS_SAN_DNSNAME: +- rel = compare_dns_names(&node1->name, &node2->name); +- switch (rel) { +- case NC_EQUAL: // equal means doesn't matter which one +- case NC_INCLUDES: // node2 is more specific +- to_copy = node2; +- break; +- case NC_INCLUDED_BY: // node1 is more specific +- to_copy = node1; +- break; +- case NC_SORTS_BEFORE: // no intersection +- case NC_SORTS_AFTER: // no intersection +- return GNUTLS_E_SUCCESS; +- } +- break; +- case GNUTLS_SAN_RFC822NAME: +- rel = compare_emails(&node1->name, &node2->name); +- switch (rel) { +- case NC_EQUAL: // equal means doesn't matter which one +- case NC_INCLUDES: // node2 is more specific +- to_copy = node2; +- break; +- case NC_INCLUDED_BY: // node1 is more specific +- to_copy = node1; +- break; +- case NC_SORTS_BEFORE: // no intersection +- case NC_SORTS_AFTER: // no intersection +- return GNUTLS_E_SUCCESS; +- } +- break; +- case GNUTLS_SAN_IPADDRESS: +- rel = compare_ip_ncs(&node1->name, &node2->name); +- switch (rel) { +- case NC_EQUAL: // equal means doesn't matter which one +- case NC_INCLUDES: // node2 is more specific +- to_copy = node2; +- break; +- case NC_INCLUDED_BY: // node1 is more specific +- to_copy = node1; +- break; +- case NC_SORTS_BEFORE: // no intersection +- case NC_SORTS_AFTER: // no intersection +- return GNUTLS_E_SUCCESS; +- } +- break; +- default: +- // for other types, we don't know how to do the intersection, assume empty +- return GNUTLS_E_SUCCESS; +- } +- +- // copy existing node if applicable +- if (to_copy != NULL) { +- *_intersection = name_constraints_node_new(nc, to_copy->type, +- to_copy->name.data, +- to_copy->name.size); +- if (*_intersection == NULL) +- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); +- intersection = *_intersection; +- +- assert(intersection->name.data != NULL); +- } +- +- return GNUTLS_E_SUCCESS; +-} +- + /* + * Returns: true if the certification is acceptable, and false otherwise. + */ +-- +2.43.0 + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-2.patch new file mode 100644 index 00000000000..9066098a01f --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-2.patch @@ -0,0 +1,66 @@ +From 0b2377dfccd99be641bf3f1a0de9f0dc8dc0d4b1 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 26 Jan 2026 19:02:27 +0100 +Subject: [PATCH] x509/name_constraints: use actual zeroes in universal exclude + IP NC + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/0b2377dfccd99be641bf3f1a0de9f0dc8dc0d4b1] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 2be6a2aaa6..d07482e3c9 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -61,7 +61,7 @@ struct gnutls_name_constraints_st { + + static struct name_constraints_node_st * + name_constraints_node_new(gnutls_x509_name_constraints_t nc, unsigned type, +- unsigned char *data, unsigned int size); ++ const unsigned char *data, unsigned int size); + + static int + name_constraints_node_list_add(struct name_constraints_node_list_st *list, +@@ -285,7 +285,7 @@ static void name_constraints_node_free(struct name_constraints_node_st *node) + -*/ + static struct name_constraints_node_st * + name_constraints_node_new(gnutls_x509_name_constraints_t nc, unsigned type, +- unsigned char *data, unsigned int size) ++ const unsigned char *data, unsigned int size) + { + struct name_constraints_node_st *tmp; + int ret; +@@ -339,6 +339,7 @@ static int name_constraints_node_list_intersect( + struct name_constraints_node_list_st removed = { .data = NULL, + .size = 0, + .capacity = 0 }; ++ static const unsigned char universal_ip[32] = { 0 }; + + /* temporary array to see, if we need to add universal excluded constraints + * (see phase 3 for details) +@@ -474,7 +475,7 @@ static int name_constraints_node_list_intersect( + case GNUTLS_SAN_IPADDRESS: + // add universal restricted range for IPv4 + tmp = name_constraints_node_new( +- nc, GNUTLS_SAN_IPADDRESS, NULL, 8); ++ nc, GNUTLS_SAN_IPADDRESS, universal_ip, 8); + if (tmp == NULL) { + gnutls_assert(); + ret = GNUTLS_E_MEMORY_ERROR; +@@ -487,7 +488,7 @@ static int name_constraints_node_list_intersect( + } + // add universal restricted range for IPv6 + tmp = name_constraints_node_new( +- nc, GNUTLS_SAN_IPADDRESS, NULL, 32); ++ nc, GNUTLS_SAN_IPADDRESS, universal_ip, 32); + if (tmp == NULL) { + gnutls_assert(); + ret = GNUTLS_E_MEMORY_ERROR; +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-3.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-3.patch new file mode 100644 index 00000000000..0d340325541 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-3.patch @@ -0,0 +1,30 @@ +From 85d6348a30c74d4ee3710e0f4652f634eaad6914 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 26 Jan 2026 19:10:58 +0100 +Subject: [PATCH] tests/name-constraints-ip: stop swallowing errors... + +... now when it started to pass + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/85d6348a30c74d4ee3710e0f4652f634eaad6914] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + tests/name-constraints-ip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tests/name-constraints-ip.c b/tests/name-constraints-ip.c +index 7a196088dc..a0cf172b7f 100644 +--- a/tests/name-constraints-ip.c ++++ b/tests/name-constraints-ip.c +@@ -772,5 +772,5 @@ int main(int argc, char **argv) + cmocka_unit_test_setup_teardown( + check_ipv4v6_single_constraint_each, setup, teardown) + }; +- cmocka_run_group_tests(tests, NULL, NULL); ++ return cmocka_run_group_tests(tests, NULL, NULL); + } +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-4.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-4.patch new file mode 100644 index 00000000000..ed4a7da3c7a --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-4.patch @@ -0,0 +1,45 @@ +From c28475413f82e1f34295d5c039f0c0a4ca2ee526 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 26 Jan 2026 20:14:33 +0100 +Subject: [PATCH] x509/name_constraints: reject some malformed domain names + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/c28475413f82e1f34295d5c039f0c0a4ca2ee526] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index d07482e3c9..9783d92851 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -159,6 +159,23 @@ static int validate_name_constraints_node(gnutls_x509_subject_alt_name_t type, + return gnutls_assert_val(GNUTLS_E_MALFORMED_CIDR); + } + ++ /* Validate DNS names and email addresses for malformed input */ ++ if (type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_RFC822NAME) { ++ unsigned int i; ++ if (name->size == 0) ++ return GNUTLS_E_SUCCESS; ++ ++ /* reject names with consecutive dots... */ ++ for (i = 0; i + 1 < name->size; i++) { ++ if (name->data[i] == '.' && name->data[i + 1] == '.') ++ return gnutls_assert_val( ++ GNUTLS_E_ILLEGAL_PARAMETER); ++ } ++ /* ... or names consisting exclusively of dots */ ++ if (name->size == 1 && name->data[0] == '.') ++ return gnutls_assert_val(GNUTLS_E_ILLEGAL_PARAMETER); ++ } ++ + return GNUTLS_E_SUCCESS; + } + +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-5.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-5.patch new file mode 100644 index 00000000000..514ee3c70fc --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-5.patch @@ -0,0 +1,205 @@ +From 6db7da7fcfe230f445b1edbb56e2a8346120c891 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Thu, 5 Feb 2026 13:22:10 +0100 +Subject: [PATCH] x509/name_constraints: name_constraints_node_add_{new,copy} + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/6db7da7fcfe230f445b1edbb56e2a8346120c891] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 112 ++++++++++++++++-------------------- + 1 file changed, 51 insertions(+), 61 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 9783d92851..81035eef8f 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -86,6 +86,38 @@ name_constraints_node_list_add(struct name_constraints_node_list_st *list, + return 0; + } + ++static int ++name_constraints_node_add_new(gnutls_x509_name_constraints_t nc, ++ struct name_constraints_node_list_st *list, ++ unsigned type, const unsigned char *data, ++ unsigned int size) ++{ ++ struct name_constraints_node_st *node; ++ int ret; ++ node = name_constraints_node_new(nc, type, data, size); ++ if (node == NULL) { ++ gnutls_assert(); ++ return GNUTLS_E_MEMORY_ERROR; ++ } ++ ret = name_constraints_node_list_add(list, node); ++ if (ret < 0) { ++ gnutls_assert(); ++ return ret; ++ } ++ return GNUTLS_E_SUCCESS; ++} ++ ++static int ++name_constraints_node_add_copy(gnutls_x509_name_constraints_t nc, ++ struct name_constraints_node_list_st *dest, ++ const struct name_constraints_node_st *src) ++{ ++ if (!src) ++ return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); ++ return name_constraints_node_add_new(nc, dest, src->type, ++ src->name.data, src->name.size); ++} ++ + // for documentation see the implementation + static int name_constraints_intersect_nodes( + gnutls_x509_name_constraints_t nc, +@@ -188,7 +220,6 @@ static int extract_name_constraints(gnutls_x509_name_constraints_t nc, + unsigned indx; + gnutls_datum_t tmp = { NULL, 0 }; + unsigned int type; +- struct name_constraints_node_st *node; + + for (indx = 1;; indx++) { + snprintf(tmpstr, sizeof(tmpstr), "%s.?%u.base", vstr, indx); +@@ -231,15 +262,9 @@ static int extract_name_constraints(gnutls_x509_name_constraints_t nc, + goto cleanup; + } + +- node = name_constraints_node_new(nc, type, tmp.data, tmp.size); ++ ret = name_constraints_node_add_new(nc, nodes, type, tmp.data, ++ tmp.size); + _gnutls_free_datum(&tmp); +- if (node == NULL) { +- gnutls_assert(); +- ret = GNUTLS_E_MEMORY_ERROR; +- goto cleanup; +- } +- +- ret = name_constraints_node_list_add(nodes, node); + if (ret < 0) { + gnutls_assert(); + goto cleanup; +@@ -462,14 +487,7 @@ static int name_constraints_node_list_intersect( + // Beware: also copies nodes other than DNS, email, IP, + // since their counterpart may have been moved in phase 1. + if (!used) { +- tmp = name_constraints_node_new( +- nc, t2->type, t2->name.data, t2->name.size); +- if (tmp == NULL) { +- gnutls_assert(); +- ret = GNUTLS_E_MEMORY_ERROR; +- goto cleanup; +- } +- ret = name_constraints_node_list_add(permitted, tmp); ++ ret = name_constraints_node_add_copy(nc, permitted, t2); + if (ret < 0) { + gnutls_assert(); + goto cleanup; +@@ -491,27 +509,17 @@ static int name_constraints_node_list_intersect( + switch (type) { + case GNUTLS_SAN_IPADDRESS: + // add universal restricted range for IPv4 +- tmp = name_constraints_node_new( +- nc, GNUTLS_SAN_IPADDRESS, universal_ip, 8); +- if (tmp == NULL) { +- gnutls_assert(); +- ret = GNUTLS_E_MEMORY_ERROR; +- goto cleanup; +- } +- ret = name_constraints_node_list_add(excluded, tmp); ++ ret = name_constraints_node_add_new( ++ nc, excluded, GNUTLS_SAN_IPADDRESS, ++ universal_ip, 8); + if (ret < 0) { + gnutls_assert(); + goto cleanup; + } + // add universal restricted range for IPv6 +- tmp = name_constraints_node_new( +- nc, GNUTLS_SAN_IPADDRESS, universal_ip, 32); +- if (tmp == NULL) { +- gnutls_assert(); +- ret = GNUTLS_E_MEMORY_ERROR; +- goto cleanup; +- } +- ret = name_constraints_node_list_add(excluded, tmp); ++ ret = name_constraints_node_add_new( ++ nc, excluded, GNUTLS_SAN_IPADDRESS, ++ universal_ip, 32); + if (ret < 0) { + gnutls_assert(); + goto cleanup; +@@ -519,13 +527,8 @@ static int name_constraints_node_list_intersect( + break; + case GNUTLS_SAN_DNSNAME: + case GNUTLS_SAN_RFC822NAME: +- tmp = name_constraints_node_new(nc, type, NULL, 0); +- if (tmp == NULL) { +- gnutls_assert(); +- ret = GNUTLS_E_MEMORY_ERROR; +- goto cleanup; +- } +- ret = name_constraints_node_list_add(excluded, tmp); ++ ret = name_constraints_node_add_new(nc, excluded, type, ++ NULL, 0); + if (ret < 0) { + gnutls_assert(); + goto cleanup; +@@ -547,20 +550,13 @@ static int name_constraints_node_list_concat( + struct name_constraints_node_list_st *nodes, + const struct name_constraints_node_list_st *nodes2) + { +- for (size_t i = 0; i < nodes2->size; i++) { +- const struct name_constraints_node_st *node = nodes2->data[i]; +- struct name_constraints_node_st *tmp; +- int ret; ++ int ret; + +- tmp = name_constraints_node_new(nc, node->type, node->name.data, +- node->name.size); +- if (tmp == NULL) { +- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); +- } +- ret = name_constraints_node_list_add(nodes, tmp); ++ for (size_t i = 0; i < nodes2->size; i++) { ++ ret = name_constraints_node_add_copy(nc, nodes, ++ nodes2->data[i]); + if (ret < 0) { +- name_constraints_node_free(tmp); +- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); ++ return gnutls_assert_val(ret); + } + } + +@@ -690,7 +686,6 @@ static int name_constraints_add(gnutls_x509_name_constraints_t nc, + gnutls_x509_subject_alt_name_t type, + const gnutls_datum_t *name, unsigned permitted) + { +- struct name_constraints_node_st *tmp; + struct name_constraints_node_list_st *nodes; + int ret; + +@@ -700,15 +695,10 @@ static int name_constraints_add(gnutls_x509_name_constraints_t nc, + + nodes = permitted ? &nc->permitted : &nc->excluded; + +- tmp = name_constraints_node_new(nc, type, name->data, name->size); +- if (tmp == NULL) +- return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); +- +- ret = name_constraints_node_list_add(nodes, tmp); +- if (ret < 0) { +- name_constraints_node_free(tmp); ++ ret = name_constraints_node_add_new(nc, nodes, type, name->data, ++ name->size); ++ if (ret < 0) + return gnutls_assert_val(ret); +- } + + return 0; + } +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-6.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-6.patch new file mode 100644 index 00000000000..6970c6ccfe4 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-6.patch @@ -0,0 +1,505 @@ +From 094accd3ebec17ead6c391757eaa18763b72d83f Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 26 Jan 2026 20:16:36 +0100 +Subject: [PATCH] x509/name_constraints: introduce a rich comparator + +These are preparatory changes before implementing N * log N intersection +over sorted lists of constraints. + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/094accd3ebec17ead6c391757eaa18763b72d83f] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 411 ++++++++++++++++++++++++++++-------- + 1 file changed, 320 insertions(+), 91 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 81035eef8f..b5d732d0c5 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -39,6 +39,9 @@ + #include "ip.h" + #include "ip-in-cidr.h" + #include "intprops.h" ++#include "minmax.h" ++ ++#include + + #define MAX_NC_CHECKS (1 << 20) + +@@ -63,6 +66,282 @@ static struct name_constraints_node_st * + name_constraints_node_new(gnutls_x509_name_constraints_t nc, unsigned type, + const unsigned char *data, unsigned int size); + ++/* An enum for "rich" comparisons that not only let us sort name constraints, ++ * children-before-parent, but also subsume them during intersection. */ ++enum name_constraint_relation { ++ NC_SORTS_BEFORE = -2, /* unrelated constraints */ ++ NC_INCLUDED_BY = -1, /* nc1 is included by nc2 / children sort first */ ++ NC_EQUAL = 0, /* exact match */ ++ NC_INCLUDES = 1, /* nc1 includes nc2 / parents sort last */ ++ NC_SORTS_AFTER = 2 /* unrelated constraints */ ++}; ++ ++/* A helper to compare just a pair of strings with this rich comparison */ ++static enum name_constraint_relation ++compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len) ++{ ++ int r = memcmp(n1, n2, MIN(n1_len, n2_len)); ++ if (r < 0) ++ return NC_SORTS_BEFORE; ++ if (r > 0) ++ return NC_SORTS_AFTER; ++ if (n1_len < n2_len) ++ return NC_SORTS_BEFORE; ++ if (n1_len > n2_len) ++ return NC_SORTS_AFTER; ++ return NC_EQUAL; ++} ++ ++/* Rich-compare DNS names. Example order/relationships: ++ * z.x.a INCLUDED_BY x.a BEFORE y.a INCLUDED_BY a BEFORE x.b BEFORE y.b */ ++static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1, ++ const gnutls_datum_t *n2) ++{ ++ enum name_constraint_relation rel; ++ unsigned int i, j, i_end, j_end; ++ ++ /* start from the end of each name */ ++ i = i_end = n1->size; ++ j = j_end = n2->size; ++ ++ /* skip the trailing dots for the comparison */ ++ while (i && n1->data[i - 1] == '.') ++ i_end = i = i - 1; ++ while (j && n2->data[j - 1] == '.') ++ j_end = j = j - 1; ++ ++ while (1) { ++ // rewind back to beginning or an after-dot position ++ while (i && n1->data[i - 1] != '.') ++ i--; ++ while (j && n2->data[j - 1] != '.') ++ j--; ++ ++ rel = compare_strings(&n1->data[i], i_end - i, &n2->data[j], ++ j_end - j); ++ if (rel == NC_SORTS_BEFORE) /* x.a BEFORE y.a */ ++ return NC_SORTS_BEFORE; ++ if (rel == NC_SORTS_AFTER) /* y.a AFTER x.a */ ++ return NC_SORTS_AFTER; ++ if (!i && j) /* x.a INCLUDES z.x.a */ ++ return NC_INCLUDES; ++ if (i && !j) /* z.x.a INCLUDED_BY x.a */ ++ return NC_INCLUDED_BY; ++ ++ if (!i && !j) /* r == 0, we ran out of components to compare */ ++ return NC_EQUAL; ++ /* r == 0, i && j: step back past a dot and keep comparing */ ++ i_end = i = i - 1; ++ j_end = j = j - 1; ++ ++ /* support for non-standard ".gr INCLUDES example.gr" [1] */ ++ if (!i && j) /* .a INCLUDES x.a */ ++ return NC_INCLUDES; ++ if (i && !j) /* x.a INCLUDED_BY .a */ ++ return NC_INCLUDED_BY; ++ } ++} ++/* [1] https://mailarchive.ietf.org/arch/msg/saag/Bw6PtreW0G7aEG7SikfzKHES4VA */ ++ ++/* Rich-compare email name constraints. Example order/relationships: ++ * z@x.a INCLUDED_BY x.a BEFORE y.a INCLUDED_BY a BEFORE x@b BEFORE y@b */ ++static enum name_constraint_relation compare_emails(const gnutls_datum_t *n1, ++ const gnutls_datum_t *n2) ++{ ++ enum name_constraint_relation domains_rel; ++ unsigned int i, j, i_end, j_end; ++ gnutls_datum_t d1, d2; /* borrow from n1 and n2 */ ++ ++ /* start from the end of each name */ ++ i = i_end = n1->size; ++ j = j_end = n2->size; ++ ++ /* rewind to @s to look for domains */ ++ while (i && n1->data[i - 1] != '@') ++ i--; ++ d1.size = i_end - i; ++ d1.data = &n1->data[i]; ++ while (j && n2->data[j - 1] != '@') ++ j--; ++ d2.size = j_end - j; ++ d2.data = &n2->data[j]; ++ ++ domains_rel = compare_dns_names(&d1, &d2); ++ ++ /* email constraint semantics differ from DNS ++ * DNS: x.a INCLUDED_BY a ++ * Email: x.a INCLUDED_BY .a BEFORE a */ ++ if (domains_rel == NC_INCLUDED_BY || domains_rel == NC_INCLUDES) { ++ bool d1_has_dot = (d1.size > 0 && d1.data[0] == '.'); ++ bool d2_has_dot = (d2.size > 0 && d2.data[0] == '.'); ++ /* a constraint without a dot is exact, excluding subdomains */ ++ if (!d2_has_dot && domains_rel == NC_INCLUDED_BY) ++ domains_rel = NC_SORTS_BEFORE; /* x.a BEFORE a */ ++ if (!d1_has_dot && domains_rel == NC_INCLUDES) ++ domains_rel = NC_SORTS_AFTER; /* a AFTER x.a */ ++ } ++ ++ if (!i && !j) { /* both are domains-only */ ++ return domains_rel; ++ } else if (i && !j) { /* n1 is email, n2 is domain */ ++ switch (domains_rel) { ++ case NC_SORTS_AFTER: ++ return NC_SORTS_AFTER; ++ case NC_SORTS_BEFORE: ++ return NC_SORTS_BEFORE; ++ case NC_INCLUDES: /* n2 is more specific, a@x.a AFTER z.x.a */ ++ return NC_SORTS_AFTER; ++ case NC_EQUAL: /* subdomains match, z@x.a INCLUDED_BY x.a */ ++ case NC_INCLUDED_BY: /* n1 is more specific */ ++ return NC_INCLUDED_BY; ++ } ++ } else if (!i && j) { /* n1 is domain, n2 is email */ ++ switch (domains_rel) { ++ case NC_SORTS_AFTER: ++ return NC_SORTS_AFTER; ++ case NC_SORTS_BEFORE: ++ return NC_SORTS_BEFORE; ++ case NC_INCLUDES: /* n2 is more specific, a AFTER z@x.a */ ++ return NC_SORTS_AFTER; ++ case NC_EQUAL: /* subdomains match, x.a INCLUDES z@x.a */ ++ return NC_INCLUDES; ++ case NC_INCLUDED_BY: /* n1 is more specific, x.a BEFORE z@a */ ++ return NC_SORTS_BEFORE; ++ } ++ } else if (i && j) { /* both are emails */ ++ switch (domains_rel) { ++ case NC_SORTS_AFTER: ++ return NC_SORTS_AFTER; ++ case NC_SORTS_BEFORE: ++ return NC_SORTS_BEFORE; ++ case NC_INCLUDES: // n2 is more specific ++ return NC_SORTS_AFTER; ++ case NC_INCLUDED_BY: // n1 is more specific ++ return NC_SORTS_BEFORE; ++ case NC_EQUAL: // only case when we need to look before the @ ++ break; // see below for readability ++ } ++ } ++ ++ /* i && j, both are emails, domain names match, compare up to @ */ ++ return compare_strings(n1->data, i - 1, n2->data, j - 1); ++} ++ ++/* Rich-compare IP address constraints. Example order/relationships: ++ * 10.0.0.0/24 INCLUDED_BY 10.0.0.0/16 BEFORE 1::1/128 INCLUDED_BY 1::1/127 */ ++static enum name_constraint_relation compare_ip_ncs(const gnutls_datum_t *n1, ++ const gnutls_datum_t *n2) ++{ ++ unsigned int len, i; ++ int r; ++ const unsigned char *ip1, *ip2, *mask1, *mask2; ++ unsigned char masked11[16], masked22[16], masked12[16], masked21[16]; ++ ++ if (n1->size < n2->size) ++ return NC_SORTS_BEFORE; ++ if (n1->size > n2->size) ++ return NC_SORTS_AFTER; ++ len = n1->size / 2; /* 4 for IPv4, 16 for IPv6 */ ++ ++ /* data is a concatenation of prefix and mask */ ++ ip1 = n1->data; ++ ip2 = n2->data; ++ mask1 = n1->data + len; ++ mask2 = n2->data + len; ++ for (i = 0; i < len; i++) { ++ masked11[i] = ip1[i] & mask1[i]; ++ masked22[i] = ip2[i] & mask2[i]; ++ masked12[i] = ip1[i] & mask2[i]; ++ masked21[i] = ip2[i] & mask1[i]; ++ } ++ ++ r = memcmp(mask1, mask2, len); ++ if (r < 0 && !memcmp(masked11, masked21, len)) /* prefix1 < prefix2 */ ++ return NC_INCLUDES; /* ip1 & mask1 == ip2 & mask1 */ ++ if (r > 0 && !memcmp(masked12, masked22, len)) /* prefix1 > prefix2 */ ++ return NC_INCLUDED_BY; /* ip1 & mask2 == ip2 & mask2 */ ++ ++ r = memcmp(masked11, masked22, len); ++ if (r < 0) ++ return NC_SORTS_BEFORE; ++ else if (r > 0) ++ return NC_SORTS_AFTER; ++ return NC_EQUAL; ++} ++ ++static inline bool is_supported_type(unsigned type) ++{ ++ return type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_RFC822NAME || ++ type == GNUTLS_SAN_IPADDRESS; ++} ++ ++/* Universal comparison for name constraint nodes. ++ * Unsupported types sort before supported types to allow early handling. ++ * NULL represents end-of-list and sorts after everything else. */ ++static enum name_constraint_relation ++compare_name_constraint_nodes(const struct name_constraints_node_st *n1, ++ const struct name_constraints_node_st *n2) ++{ ++ bool n1_supported, n2_supported; ++ ++ if (!n1 && !n2) ++ return NC_EQUAL; ++ if (!n1) ++ return NC_SORTS_AFTER; ++ if (!n2) ++ return NC_SORTS_BEFORE; ++ ++ n1_supported = is_supported_type(n1->type); ++ n2_supported = is_supported_type(n2->type); ++ ++ /* unsupported types bubble up (sort first). intersect relies on this */ ++ if (!n1_supported && n2_supported) ++ return NC_SORTS_BEFORE; ++ if (n1_supported && !n2_supported) ++ return NC_SORTS_AFTER; ++ ++ /* next, sort by type */ ++ if (n1->type < n2->type) ++ return NC_SORTS_BEFORE; ++ if (n1->type > n2->type) ++ return NC_SORTS_AFTER; ++ ++ /* now look deeper */ ++ switch (n1->type) { ++ case GNUTLS_SAN_DNSNAME: ++ return compare_dns_names(&n1->name, &n2->name); ++ case GNUTLS_SAN_RFC822NAME: ++ return compare_emails(&n1->name, &n2->name); ++ case GNUTLS_SAN_IPADDRESS: ++ return compare_ip_ncs(&n1->name, &n2->name); ++ default: ++ /* unsupported types: stable lexicographic order */ ++ return compare_strings(n1->name.data, n1->name.size, ++ n2->name.data, n2->name.size); ++ } ++} ++ ++/* qsort-compatible wrapper */ ++static int compare_name_constraint_nodes_qsort(const void *a, const void *b) ++{ ++ const struct name_constraints_node_st *const *n1 = a; ++ const struct name_constraints_node_st *const *n2 = b; ++ enum name_constraint_relation rel; ++ ++ rel = compare_name_constraint_nodes(*n1, *n2); ++ switch (rel) { ++ case NC_SORTS_BEFORE: ++ case NC_INCLUDED_BY: ++ return -1; ++ case NC_SORTS_AFTER: ++ case NC_INCLUDES: ++ return 1; ++ case NC_EQUAL: ++ default: ++ return 0; ++ } ++} ++ + static int + name_constraints_node_list_add(struct name_constraints_node_list_st *list, + struct name_constraints_node_st *node) +@@ -420,9 +699,7 @@ static int name_constraints_node_list_intersect( + } + } + +- if (found != NULL && (t->type == GNUTLS_SAN_DNSNAME || +- t->type == GNUTLS_SAN_RFC822NAME || +- t->type == GNUTLS_SAN_IPADDRESS)) { ++ if (found != NULL && is_supported_type(t->type)) { + /* move node from PERMITTED to REMOVED */ + ret = name_constraints_node_list_add(&removed, t); + if (ret < 0) { +@@ -827,61 +1104,14 @@ cleanup: + return ret; + } + +-static unsigned ends_with(const gnutls_datum_t *str, +- const gnutls_datum_t *suffix) +-{ +- unsigned char *tree; +- unsigned int treelen; +- +- if (suffix->size >= str->size) +- return 0; +- +- tree = suffix->data; +- treelen = suffix->size; +- if ((treelen > 0) && (tree[0] == '.')) { +- tree++; +- treelen--; +- } +- +- if (memcmp(str->data + str->size - treelen, tree, treelen) == 0 && +- str->data[str->size - treelen - 1] == '.') +- return 1; /* match */ +- +- return 0; +-} +- +-static unsigned email_ends_with(const gnutls_datum_t *str, +- const gnutls_datum_t *suffix) +-{ +- if (suffix->size >= str->size) { +- return 0; +- } +- +- if (suffix->size > 0 && memcmp(str->data + str->size - suffix->size, +- suffix->data, suffix->size) != 0) { +- return 0; +- } +- +- if (suffix->size > 1 && suffix->data[0] == '.') { /* .domain.com */ +- return 1; /* match */ +- } else if (str->data[str->size - suffix->size - 1] == '@') { +- return 1; /* match */ +- } +- +- return 0; +-} +- + static unsigned dnsname_matches(const gnutls_datum_t *name, + const gnutls_datum_t *suffix) + { + _gnutls_hard_log("matching %.*s with DNS constraint %.*s\n", name->size, + name->data, suffix->size, suffix->data); + +- if (suffix->size == name->size && +- memcmp(suffix->data, name->data, suffix->size) == 0) +- return 1; /* match */ +- +- return ends_with(name, suffix); ++ enum name_constraint_relation rel = compare_dns_names(name, suffix); ++ return rel == NC_EQUAL || rel == NC_INCLUDED_BY; + } + + static unsigned email_matches(const gnutls_datum_t *name, +@@ -890,11 +1120,8 @@ static unsigned email_matches(const gnutls_datum_t *name, + _gnutls_hard_log("matching %.*s with e-mail constraint %.*s\n", + name->size, name->data, suffix->size, suffix->data); + +- if (suffix->size == name->size && +- memcmp(suffix->data, name->data, suffix->size) == 0) +- return 1; /* match */ +- +- return email_ends_with(name, suffix); ++ enum name_constraint_relation rel = compare_emails(name, suffix); ++ return rel == NC_EQUAL || rel == NC_INCLUDED_BY; + } + + /*- +@@ -918,8 +1145,7 @@ static int name_constraints_intersect_nodes( + // presume empty intersection + struct name_constraints_node_st *intersection = NULL; + const struct name_constraints_node_st *to_copy = NULL; +- unsigned iplength = 0; +- unsigned byte; ++ enum name_constraint_relation rel; + + *_intersection = NULL; + +@@ -928,32 +1154,49 @@ static int name_constraints_intersect_nodes( + } + switch (node1->type) { + case GNUTLS_SAN_DNSNAME: +- if (!dnsname_matches(&node2->name, &node1->name)) ++ rel = compare_dns_names(&node1->name, &node2->name); ++ switch (rel) { ++ case NC_EQUAL: // equal means doesn't matter which one ++ case NC_INCLUDES: // node2 is more specific ++ to_copy = node2; ++ break; ++ case NC_INCLUDED_BY: // node1 is more specific ++ to_copy = node1; ++ break; ++ case NC_SORTS_BEFORE: // no intersection ++ case NC_SORTS_AFTER: // no intersection + return GNUTLS_E_SUCCESS; +- to_copy = node2; ++ } + break; + case GNUTLS_SAN_RFC822NAME: +- if (!email_matches(&node2->name, &node1->name)) ++ rel = compare_emails(&node1->name, &node2->name); ++ switch (rel) { ++ case NC_EQUAL: // equal means doesn't matter which one ++ case NC_INCLUDES: // node2 is more specific ++ to_copy = node2; ++ break; ++ case NC_INCLUDED_BY: // node1 is more specific ++ to_copy = node1; ++ break; ++ case NC_SORTS_BEFORE: // no intersection ++ case NC_SORTS_AFTER: // no intersection + return GNUTLS_E_SUCCESS; +- to_copy = node2; ++ } + break; + case GNUTLS_SAN_IPADDRESS: +- if (node1->name.size != node2->name.size) ++ rel = compare_ip_ncs(&node1->name, &node2->name); ++ switch (rel) { ++ case NC_EQUAL: // equal means doesn't matter which one ++ case NC_INCLUDES: // node2 is more specific ++ to_copy = node2; ++ break; ++ case NC_INCLUDED_BY: // node1 is more specific ++ to_copy = node1; ++ break; ++ case NC_SORTS_BEFORE: // no intersection ++ case NC_SORTS_AFTER: // no intersection + return GNUTLS_E_SUCCESS; +- iplength = node1->name.size / 2; +- for (byte = 0; byte < iplength; byte++) { +- if (((node1->name.data[byte] ^ +- node2->name.data[byte]) // XOR of addresses +- & node1->name.data[byte + +- iplength] // AND mask from nc1 +- & node2->name.data[byte + +- iplength]) // AND mask from nc2 +- != 0) { +- // CIDRS do not intersect +- return GNUTLS_E_SUCCESS; +- } + } +- to_copy = node2; + break; + default: + // for other types, we don't know how to do the intersection, assume empty +@@ -970,20 +1213,6 @@ static int name_constraints_intersect_nodes( + intersection = *_intersection; + + assert(intersection->name.data != NULL); +- +- if (intersection->type == GNUTLS_SAN_IPADDRESS) { +- // make sure both IP addresses are correctly masked +- _gnutls_mask_ip(intersection->name.data, +- intersection->name.data + iplength, +- iplength); +- _gnutls_mask_ip(node1->name.data, +- node1->name.data + iplength, iplength); +- // update intersection, if necessary (we already know one is subset of other) +- for (byte = 0; byte < 2 * iplength; byte++) { +- intersection->name.data[byte] |= +- node1->name.data[byte]; +- } +- } + } + + return GNUTLS_E_SUCCESS; +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-7.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-7.patch new file mode 100644 index 00000000000..8dfda528619 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-7.patch @@ -0,0 +1,124 @@ +From bc62fbb946085527b4b1c02f337dd10c68c54690 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 4 Feb 2026 09:09:46 +0100 +Subject: [PATCH] x509/name_constraints: add sorted_view in preparation... + +... for actually using it later for performance gains. + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/bc62fbb946085527b4b1c02f337dd10c68c54690] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 62 ++++++++++++++++++++++++++++++------- + 1 file changed, 51 insertions(+), 11 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index b5d732d0c5..41f30d13b9 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -54,6 +54,9 @@ struct name_constraints_node_list_st { + struct name_constraints_node_st **data; + size_t size; + size_t capacity; ++ /* sorted-on-demand view, valid only when dirty == false */ ++ bool dirty; ++ struct name_constraints_node_st **sorted_view; + }; + + struct gnutls_name_constraints_st { +@@ -342,6 +345,37 @@ static int compare_name_constraint_nodes_qsort(const void *a, const void *b) + } + } + ++/* Bring the sorted view up to date with the list data; clear the dirty flag. */ ++static int ensure_sorted(struct name_constraints_node_list_st *list) ++{ ++ struct name_constraints_node_st **new_data; ++ ++ if (!list->dirty) ++ return GNUTLS_E_SUCCESS; ++ if (!list->size) { ++ list->dirty = false; ++ return GNUTLS_E_SUCCESS; ++ } ++ ++ /* reallocate sorted view to match current size */ ++ new_data = ++ _gnutls_reallocarray(list->sorted_view, list->size, ++ sizeof(struct name_constraints_node_st *)); ++ if (!new_data) ++ return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); ++ list->sorted_view = new_data; ++ ++ /* copy pointers and sort in-place */ ++ memcpy(list->sorted_view, list->data, ++ list->size * sizeof(struct name_constraints_node_st *)); ++ qsort(list->sorted_view, list->size, ++ sizeof(struct name_constraints_node_st *), ++ compare_name_constraint_nodes_qsort); ++ ++ list->dirty = false; ++ return GNUTLS_E_SUCCESS; ++} ++ + static int + name_constraints_node_list_add(struct name_constraints_node_list_st *list, + struct name_constraints_node_st *node) +@@ -361,10 +395,23 @@ name_constraints_node_list_add(struct name_constraints_node_list_st *list, + list->capacity = new_capacity; + list->data = new_data; + } ++ list->dirty = true; + list->data[list->size++] = node; + return 0; + } + ++static void ++name_constraints_node_list_clear(struct name_constraints_node_list_st *list) ++{ ++ gnutls_free(list->data); ++ gnutls_free(list->sorted_view); ++ list->data = NULL; ++ list->sorted_view = NULL; ++ list->capacity = 0; ++ list->size = 0; ++ list->dirty = false; ++} ++ + static int + name_constraints_node_add_new(gnutls_x509_name_constraints_t nc, + struct name_constraints_node_list_st *list, +@@ -711,6 +758,7 @@ static int name_constraints_node_list_intersect( + permitted->data[i] = + permitted->data[permitted->size - 1]; + permitted->size--; ++ permitted->dirty = true; + continue; + } + i++; +@@ -908,17 +956,9 @@ void _gnutls_x509_name_constraints_clear(gnutls_x509_name_constraints_t nc) + struct name_constraints_node_st *node = nc->nodes.data[i]; + name_constraints_node_free(node); + } +- gnutls_free(nc->nodes.data); +- nc->nodes.capacity = 0; +- nc->nodes.size = 0; +- +- gnutls_free(nc->permitted.data); +- nc->permitted.capacity = 0; +- nc->permitted.size = 0; +- +- gnutls_free(nc->excluded.data); +- nc->excluded.capacity = 0; +- nc->excluded.size = 0; ++ name_constraints_node_list_clear(&nc->nodes); ++ name_constraints_node_list_clear(&nc->permitted); ++ name_constraints_node_list_clear(&nc->excluded); + } + + /** +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-8.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-8.patch new file mode 100644 index 00000000000..28d86ec6273 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-8.patch @@ -0,0 +1,155 @@ +From 80db5e90fa18d3e34bb91dd027bdf76d31e93dcd Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 4 Feb 2026 13:30:08 +0100 +Subject: [PATCH] x509/name_constraints: implement + name_constraints_node_list_union + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/80db5e90fa18d3e34bb91dd027bdf76d31e93dcd] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 98 ++++++++++++++++++++++++++++++++----- + 1 file changed, 86 insertions(+), 12 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 41f30d13b9..de20dd8ef4 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -41,6 +41,7 @@ + #include "intprops.h" + #include "minmax.h" + ++#include + #include + + #define MAX_NC_CHECKS (1 << 20) +@@ -870,22 +871,95 @@ cleanup: + return ret; + } + +-static int name_constraints_node_list_concat( +- gnutls_x509_name_constraints_t nc, +- struct name_constraints_node_list_st *nodes, +- const struct name_constraints_node_list_st *nodes2) ++static int ++name_constraints_node_list_union(gnutls_x509_name_constraints_t nc, ++ struct name_constraints_node_list_st *nodes, ++ struct name_constraints_node_list_st *nodes2) + { + int ret; ++ size_t i = 0, j = 0; ++ struct name_constraints_node_st *nc1; ++ const struct name_constraints_node_st *nc2; ++ enum name_constraint_relation rel; ++ struct name_constraints_node_list_st result = { 0 }; ++ ++ if (nodes2->size == 0) /* nothing to do */ ++ return GNUTLS_E_SUCCESS; ++ ++ ret = ensure_sorted(nodes); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ret = ensure_sorted(nodes2); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ++ /* traverse both lists in a single pass and merge them w/o duplicates */ ++ while (i < nodes->size || j < nodes2->size) { ++ nc1 = (i < nodes->size) ? nodes->sorted_view[i] : NULL; ++ nc2 = (j < nodes2->size) ? nodes2->sorted_view[j] : NULL; + +- for (size_t i = 0; i < nodes2->size; i++) { +- ret = name_constraints_node_add_copy(nc, nodes, +- nodes2->data[i]); ++ rel = compare_name_constraint_nodes(nc1, nc2); ++ switch (rel) { ++ case NC_SORTS_BEFORE: ++ assert(nc1 != NULL); /* comparator-guaranteed */ ++ ret = name_constraints_node_list_add(&result, nc1); ++ i++; ++ break; ++ case NC_SORTS_AFTER: ++ assert(nc2 != NULL); /* comparator-guaranteed */ ++ ret = name_constraints_node_add_copy(nc, &result, nc2); ++ j++; ++ break; ++ case NC_INCLUDES: /* nc1 is broader, shallow-copy it */ ++ assert(nc1 != NULL && nc2 != NULL); /* comparator */ ++ ret = name_constraints_node_list_add(&result, nc1); ++ i++; ++ j++; ++ break; ++ case NC_INCLUDED_BY: /* nc2 is broader, deep-copy it */ ++ assert(nc1 != NULL && nc2 != NULL); /* comparator */ ++ ret = name_constraints_node_add_copy(nc, &result, nc2); ++ i++; ++ j++; ++ break; ++ case NC_EQUAL: ++ assert(nc1 != NULL && nc2 != NULL); /* loop condition */ ++ ret = name_constraints_node_list_add(&result, nc1); ++ i++; ++ j++; ++ break; ++ } + if (ret < 0) { +- return gnutls_assert_val(ret); ++ gnutls_assert(); ++ goto cleanup; + } + } + +- return 0; ++ gnutls_free(nodes->data); ++ gnutls_free(nodes->sorted_view); ++ nodes->data = result.data; ++ nodes->sorted_view = NULL; ++ nodes->size = result.size; ++ nodes->capacity = result.capacity; ++ nodes->dirty = true; ++ /* since we know it's sorted, populate sorted_view almost for free */ ++ nodes->sorted_view = gnutls_calloc( ++ nodes->size, sizeof(struct name_constraints_node_st *)); ++ if (!nodes->sorted_view) ++ return GNUTLS_E_SUCCESS; /* we tried, no harm done */ ++ memcpy(nodes->sorted_view, nodes->data, ++ nodes->size * sizeof(struct name_constraints_node_st *)); ++ nodes->dirty = false; ++ ++ result.data = NULL; ++ return GNUTLS_E_SUCCESS; ++cleanup: ++ name_constraints_node_list_clear(&result); ++ return gnutls_assert_val(ret); + } + + /** +@@ -1026,7 +1100,7 @@ static int name_constraints_add(gnutls_x509_name_constraints_t nc, + * @nc2: The name constraints to be merged with + * + * This function will merge the provided name constraints structures +- * as per RFC5280 p6.1.4. That is, the excluded constraints will be appended, ++ * as per RFC5280 p6.1.4. That is, the excluded constraints will be unioned, + * and permitted will be intersected. The intersection assumes that @nc + * is the root CA constraints. + * +@@ -1048,8 +1122,8 @@ int _gnutls_x509_name_constraints_merge(gnutls_x509_name_constraints_t nc, + return ret; + } + +- ret = name_constraints_node_list_concat(nc, &nc->excluded, +- &nc2->excluded); ++ ret = name_constraints_node_list_union(nc, &nc->excluded, ++ &nc2->excluded); + if (ret < 0) { + gnutls_assert(); + return ret; +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-9.patch b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-9.patch new file mode 100644 index 00000000000..ed6be93c54b --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2025-14831-9.patch @@ -0,0 +1,110 @@ +From d0ac999620c8c0aeb6939e1e92d884ca8e40b759 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 4 Feb 2026 18:31:37 +0100 +Subject: [PATCH] x509/name_constraints: make types_with_empty_intersection a + bitmask + +Signed-off-by: Alexander Sosedkin + +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/d0ac999620c8c0aeb6939e1e92d884ca8e40b759] +CVE: CVE-2025-14831 +Signed-off-by: Vijay Anusuri +--- + lib/x509/name_constraints.c | 39 +++++++++++++++++++++++++++---------- + 1 file changed, 29 insertions(+), 10 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index de20dd8ef4..1d78d1bc50 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -275,6 +275,7 @@ static enum name_constraint_relation compare_ip_ncs(const gnutls_datum_t *n1, + + static inline bool is_supported_type(unsigned type) + { ++ /* all of these should be under GNUTLS_SAN_MAX (intersect bitmasks) */ + return type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_RFC822NAME || + type == GNUTLS_SAN_IPADDRESS; + } +@@ -683,6 +684,21 @@ name_constraints_node_new(gnutls_x509_name_constraints_t nc, unsigned type, + return tmp; + } + ++static int ++name_constraints_node_list_union(gnutls_x509_name_constraints_t nc, ++ struct name_constraints_node_list_st *nodes, ++ struct name_constraints_node_list_st *nodes2); ++ ++#define type_bitmask_t uint8_t /* increase if GNUTLS_SAN_MAX grows */ ++#define type_bitmask_set(mask, t) ((mask) |= (1u << (t))) ++#define type_bitmask_clr(mask, t) ((mask) &= ~(1u << (t))) ++#define type_bitmask_in(mask, t) ((mask) & (1u << (t))) ++/* C99-compatible compile-time assertions; gnutls_int.h undefines verify */ ++typedef char assert_san_max[(GNUTLS_SAN_MAX < 8) ? 1 : -1]; ++typedef char assert_dnsname[(GNUTLS_SAN_DNSNAME <= GNUTLS_SAN_MAX) ? 1 : -1]; ++typedef char assert_rfc822[(GNUTLS_SAN_RFC822NAME <= GNUTLS_SAN_MAX) ? 1 : -1]; ++typedef char assert_ipaddr[(GNUTLS_SAN_IPADDRESS <= GNUTLS_SAN_MAX) ? 1 : -1]; ++ + /*- + * @brief name_constraints_node_list_intersect: + * @nc: %gnutls_x509_name_constraints_t +@@ -710,12 +726,9 @@ static int name_constraints_node_list_intersect( + .capacity = 0 }; + static const unsigned char universal_ip[32] = { 0 }; + +- /* temporary array to see, if we need to add universal excluded constraints +- * (see phase 3 for details) +- * indexed directly by (gnutls_x509_subject_alt_name_t enum - 1) */ +- unsigned char types_with_empty_intersection[GNUTLS_SAN_MAX]; +- memset(types_with_empty_intersection, 0, +- sizeof(types_with_empty_intersection)); ++ /* bitmask to see if we need to add universal excluded constraints ++ * (see phase 3 for details) */ ++ type_bitmask_t types_with_empty_intersection = 0; + + if (permitted->size == 0 || permitted2->size == 0) + return 0; +@@ -741,7 +754,8 @@ static int name_constraints_node_list_intersect( + // note the possibility of empty intersection for this type + // if we add something to the intersection in phase 2, + // we will reset this flag back to 0 then +- types_with_empty_intersection[t->type - 1] = 1; ++ type_bitmask_set(types_with_empty_intersection, ++ t->type); + found = t2; + break; + } +@@ -798,8 +812,8 @@ static int name_constraints_node_list_intersect( + GNUTLS_E_INTERNAL_ERROR); + } + // we will not add universal excluded constraint for this type +- types_with_empty_intersection[tmp->type - 1] = +- 0; ++ type_bitmask_clr(types_with_empty_intersection, ++ tmp->type); + // add intersection node to PERMITTED + ret = name_constraints_node_list_add(permitted, + tmp); +@@ -827,7 +841,7 @@ static int name_constraints_node_list_intersect( + * excluded constraint with universal wildcard + * (since the intersection of permitted is now empty). */ + for (type = 1; type <= GNUTLS_SAN_MAX; type++) { +- if (types_with_empty_intersection[type - 1] == 0) ++ if (!type_bitmask_in(types_with_empty_intersection, type)) + continue; + _gnutls_hard_log( + "Adding universal excluded name constraint for type %d.\n", +@@ -871,6 +885,11 @@ cleanup: + return ret; + } + ++#undef type_bitmask_t ++#undef type_bitmask_set ++#undef type_bitmask_clr ++#undef type_bitmask_in ++ + static int + name_constraints_node_list_union(gnutls_x509_name_constraints_t nc, + struct name_constraints_node_list_st *nodes, +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.10.bb b/meta/recipes-support/gnutls/gnutls_3.8.10.bb index 5430ee20856..ce9fdce3f46 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.10.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.10.bb @@ -24,6 +24,16 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://run-ptest \ file://Add-ptest-support.patch \ file://CVE-2025-9820.patch \ + file://CVE-2025-14831-1.patch \ + file://CVE-2025-14831-2.patch \ + file://CVE-2025-14831-3.patch \ + file://CVE-2025-14831-4.patch \ + file://CVE-2025-14831-5.patch \ + file://CVE-2025-14831-6.patch \ + file://CVE-2025-14831-7.patch \ + file://CVE-2025-14831-8.patch \ + file://CVE-2025-14831-9.patch \ + file://CVE-2025-14831-10.patch \ " SRC_URI[sha256sum] = "db7fab7cce791e7727ebbef2334301c821d79a550ec55c9ef096b610b03eb6b7" From patchwork Fri Mar 6 07:22:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82662 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0824EF5141F for ; Fri, 6 Mar 2026 07:23:09 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.64686.1772781786671266165 for ; Thu, 05 Mar 2026 23:23:06 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=qA4Sbpwl; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4837584120eso67896225e9.1 for ; Thu, 05 Mar 2026 23:23:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781785; x=1773386585; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=DJRXiyYSHn9FUIfTtJzSZkEuZayUmgkWl7qLQjZfQMM=; b=qA4SbpwlD+0IgIp3R6jGzrGhCzDhzHR7HczHBoBga3jc6xVpRqlQrwjMgY70zs0Xrf IWGgdL62+0QY09q902+m2ZAzPDNF5SfjizbhBoFqHTx0j3ugtJ+7GkkXx9LN/wqNfuZo egKvUL7zHOp1raR6PX1Wmaymou9mDSrA9q6zo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781785; x=1773386585; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=DJRXiyYSHn9FUIfTtJzSZkEuZayUmgkWl7qLQjZfQMM=; b=EVR4p8G8i4BFvmCyU5UmEZUOGFisl8rhdUKkcRqLmpz5m57zqYSRdIjzje8T8W/RMl QhbAJnjbqk8ng9DrWozB5Xqiwi0WqPRX1QBinaBgRJLo2oziGqCV728LE1oohIMP34wM srjOa8HSZaTn4bVs6rRRxnpHWKOj6tL+kfbWB5Om4rLOD6+hEQYK2ZLn2+mD0kOFiKmA 62ZGhTzQMUFAYg+LAXgC6/Q1aHVTmh0nles006ud2lbxFeIpGStwt5kH8wIPDC6+Y5+P tnyUyTwhZ3AIMBbzUwQ8qQWRxWNzJjIIPZUNYcOxOk7GCU9D0piqIb4BJ3XXfSBAtRCp 6B6g== X-Gm-Message-State: AOJu0Yzd86Lertecj9AwvgZOtMdGNgc7pkn5uWra+7eiOsQMcuNn3E7p c/wit4hK9d1XY5EUL61ggRTwH2KfO7WXphs7AoK7f94E1SQ8hvFpyo1YnJVlSpYUHytVDGDXtd+ ZBhlT X-Gm-Gg: ATEYQzzIHVb/+MHlUVBGYEYg7NlnWV6OiUEKn4Aolv1Fq+8pLoLxhzqwhSRGPMSGVxI G1y/bVq3z7jVrpVn5dfgxHmhycyCERZOLQI/4hzgZ9d9zSljmcjvQO2TWr9WZaT+gyfs6I7+/yU NcRJtVvNMnGH392AyAGCysvLJMSfJmcezRzwwcpa3OVLNZOv+w2MSt/ZXc7ECqztlbVr97gGJwU koBlI8yKxANJj2YE7DnnBObNIJ/ZpE7kmO8ROH73+lAhYpWx3UZkGd9SwNnw2VeOJs3A8v8MpY4 bgfuPReANlRxU3p8fxi1pl7ee5s7n2T3d1sPXqDKpbk0zj5WQ0gr7+J3Oh+U/JbbqpwkXH+WyZR HZ9oi1Ppu8qLhjn1V4Roaznjt/4PbwAhIJAwGeTSclsgc/B8VSbqR7UwKsbzPQoLGvmvSQbZSDO j66gnT+8w6Pjcn/MU4fFI2xK4xlUHvdJgruYfuLreee/X8nUL+SQnnCMWXGsDAnw9ENABslMijj /MbfKlN+9dbJ5tdS6seMYohnX46 X-Received: by 2002:a05:600c:1d01:b0:483:c269:c4d3 with SMTP id 5b1f17b1804b1-48526958baamr15838925e9.18.1772781784699; Thu, 05 Mar 2026 23:23:04 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:04 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 10/16] README: Add whinlatter subject-prefix to git-send-email suggestion Date: Fri, 6 Mar 2026 08:22:10 +0100 Message-ID: <46724cf2319e1a1fba8215165c11fe3d7c9ac039.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232548 From: Yoann Congal That might help new users send correct first stable patches. Signed-off-by: Yoann Congal --- README.OE-Core.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.OE-Core.md b/README.OE-Core.md index 7187fb94be3..35a9866db7b 100644 --- a/README.OE-Core.md +++ b/README.OE-Core.md @@ -22,7 +22,7 @@ As a quick guide, patches should be sent to openembedded-core@lists.openembedded The git command to do that would be: ``` -git send-email -M -1 --to openembedded-core@lists.openembedded.org +git send-email -M -1 --to openembedded-core@lists.openembedded.org --subject-prefix='whinlatter][PATCH' ``` Mailing list: From patchwork Fri Mar 6 07:22:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82660 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BC8CEFCE5C for ; Fri, 6 Mar 2026 07:23:09 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.64688.1772781787104265842 for ; Thu, 05 Mar 2026 23:23:07 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=pB9+DamY; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4837f27cf2dso82307645e9.2 for ; Thu, 05 Mar 2026 23:23:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781785; x=1773386585; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=14AH6njZ0vCHKj1dZFvohjICUeB/L3Z5lrlm5Lec7FI=; b=pB9+DamY75tHAGxeosViCa7xGyg8MSdP6LgdAek2Pi+9FCagPGfuSDtCn/xRfObJcl lolLX0LFpxBEoyqPL1hnEq95ESzgF4zhMwuIKf0pxg6bleCM1rn2OCm2pff/WQgO3Vs7 kllfAr8mwM6Rn+RGyLkqou9vonyUWWEnD0XqA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781785; x=1773386585; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=14AH6njZ0vCHKj1dZFvohjICUeB/L3Z5lrlm5Lec7FI=; b=P4j/bv2xZdaYatMAdjLGdbJ3S68hjKJz4fcxGMcz6RoTHU/zIrpuvhl51ASwMVAtpI IiyUXWgTksg1CGTwgKGooEty4HkmGDEuCF/pBJFRpKUJ3G2DvlCZhUap3FQkZmr9l4cH I6gPL/TdIozsReAiZn5RAz6kFCEMAD9V+TlXvRhJLW5qDwBJhpHFwf+Rjh0LEm7udIWD EywDQ4TfRi5bVVoLGooAI7t3elOyQ+401pznVZZYsJTvseA2Z7QJ2Mwl0x6QF6h2AnoO dVdfMzFZV6CD7g61LyFBPP3UrB4J8hHkRjPTzNRUWZ6GA3+Sa6GtYAveYaztBHlRZYH6 nO3A== X-Gm-Message-State: AOJu0YyI7d0nXBzgW0dnxqrXFyJ/iulz8IY9jDfoPchYk33URBV8WcOW FUYJKRkcKsvjyDUzsqMyhNn0I18spSo9giMc93f4+nUx94wmmV8Y+y07L7YOUX12dJuq7pqGmA0 GPU3m X-Gm-Gg: ATEYQzy5LIqNx13LxN/SZfrH9dkTauOJOAU7JPZxpRtVyKSbqL1tBga2xidpS5FF+oN CmHJPKLvix1hOuGMjUOyrvwNM8eFFtXv7Qj8JVYvuErwsgimRlz7H94Ex71nEWE7oh1QqBih41z QdWgkwMlLWwtU0crMwfStiu6QcXuQdYA09G8XaqUcskm6CxSGu/j9Bt8aH1RrI1XxxS5wBWHsAa pBVILfRhaArp2NJGD0sfjdK7awGGf2gVyBMyTrh2Hdyk/SCNq8Hs2EvASvZjv4ZiA8bG1daZftF ouWw3JGhUw693QHsucb677OmR424REDTilYdSHDoFNpgtCa/E5e1qX6y2dcM2+B6sldGrdnMp8I YtzonSasbJFjyudTAv+iwjVsAb6kh3/zjqpqaYYz0Df4eE6F/+UGg8kLTx8mxoW6otzgZRcpe2T FeECWBPqSQVXixyhC+q0YLXRLwVBI4mbFr851mYUad+GUcODMAM65OLnXjZ53psPyU0oGSsSJ5j OiL29ogQL6DHsWzTS3YfmlCkI2/ X-Received: by 2002:a05:600c:1991:b0:479:35e7:a0e3 with SMTP id 5b1f17b1804b1-48526977699mr15330995e9.30.1772781785256; Thu, 05 Mar 2026 23:23:05 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:04 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 11/16] b4-config: add send-prefixes for whinlatter Date: Fri, 6 Mar 2026 08:22:11 +0100 Message-ID: <000dbd26e2454e510e6df68fa39f7a02528a6777.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232549 From: Yoann Congal That might help new users send correct first stable patches. Reviewed-by: Quentin Schulz Signed-off-by: Yoann Congal --- .b4-config | 1 + 1 file changed, 1 insertion(+) diff --git a/.b4-config b/.b4-config index 41094218531..82d6c756e5e 100644 --- a/.b4-config +++ b/.b4-config @@ -1,3 +1,4 @@ [b4] send-series-to = openembedded-core@lists.openembedded.org prep-pre-flight-checks = disable-needs-auto-to-cc, disable-needs-checking + send-prefixes = whinlatter From patchwork Fri Mar 6 07:22:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82664 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F6EDF3D33E for ; Fri, 6 Mar 2026 07:23:09 +0000 (UTC) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64471.1772781788094105545 for ; Thu, 05 Mar 2026 23:23:08 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=YvI3Ysd1; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-483a233819aso87452125e9.3 for ; Thu, 05 Mar 2026 23:23:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781786; x=1773386586; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=YrS3aVqQ4eOCKDHjwft9zzOB09AzueoltfUMxxOZT4Y=; b=YvI3Ysd1UBSgRIOHVDFPDhBzmNASQUMcIzGXJ/qkKz2jOCbcnKBCbyD36/3qHKVzLE NK1/bcBypYb+HQYxBgv9BXn8dc2RiXsZKE3jNyG1w4BowyuxsKTxByjA8E7238YXObCM PUyIbsYNCPr+E745ECJ1huwQ4CS4hodDxVhIk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781786; x=1773386586; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=YrS3aVqQ4eOCKDHjwft9zzOB09AzueoltfUMxxOZT4Y=; b=Xr1egNlcZeyCMCfETYBS71YnPP3710ge5GG+yqNC+zRYya/YwHYCzjdjdSvMqZICPR Of51HyQ/DxpgfeKKdY25j2DwprZSATmoVrBPhOydxeMomCg5RqXFtkfO0bx9it1+T5lA zvkRmt/D4Y4lwpp2KI4Dy53E63DKLSP5pVHN9ssvkZ/8fy2p942qMyIDEzVxsBtctB3V OkV6eS80YFWILeyZVM4rf9vE3oWi2XYwNwj369F5Evh6pRjzhike/qufSb0DP1Jg4h2m AAtpocXM1uAvv1lFMX+KfbnILbvFtkionP8kQYnJ9pd+8BqQu6EkxXEoLjNCTtN6j6iH ZK0g== X-Gm-Message-State: AOJu0YyPL+Rd4Vwqi+FSsLCRIA04ZG9oXBGitH+PcHviCzfhhuvwsr7T qHoBrJvpNk/bm78HiC8o9r1jJXMB2F1P3UDZDXAoDppoI6c+NZ3tcaLB2A5MaLTThOcnZYMzAW4 ShhnO X-Gm-Gg: ATEYQzzQO+aO9Ej3b/uxNxDD4adJk3bZf3P4j+sM4ALD/GFxFixj72oYSyGovBJU4k9 Zux4ysCpxoNywuSkggCz5rXjb1WOJEBVMM9pi5AuxZKh65w/ro9bvVI1HkSfIMfEhyIXW1NeX0m yxhGwpI5wBiGrGTTzSRWwjfT2/6+3DvaMvX5E65JxNfQ/DDibyc13YbB8cSv27h78+cQnuzGMEp cSNXxx/f/nxqeb7pj53jGE+d1302FibZUZt2OA9Wd14X6W25U/MnFxtchv4njqNyAI2ps+vo25p Rx0pIkrhwJSd4WzAE5ddIjLw71rfrOJ8B9XezTBb+Xa1efD5ayiGYSmKJVowU1TPfXtiJXOixAH 4e2Wpo4NT0FkJFPAsqlg8ALDbNe6hAK1q7rBG9ccKVI++B290RCCa4Z4h83XPvAhor2l7+EnyBx mU0BHLW1Ime15o9UCt6DSbjrqbCW4PBMgMZHAybZzVhaP2EYDDqSQXvcF0LXXkIrgMUNTug3NFL yrsBdGBS/AfOHPmZUYFMnp4zPe7 X-Received: by 2002:a05:600c:a41:b0:483:c35d:367f with SMTP id 5b1f17b1804b1-48526957c15mr15941955e9.21.1772781786184; Thu, 05 Mar 2026 23:23:06 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:05 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 12/16] python3: skip flaky test_default_timeout test Date: Fri, 6 Mar 2026 08:22:12 +0100 Message-ID: <37e47ac47f24b4c1392e7c9465be65a6712b42d7.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232551 From: Antonin Godard We have been observing intermittent issues with this test on the Autobuilder: https://bugzilla.yoctoproject.org/show_bug.cgi?id=15885 This is probably due to the Autobuilder being heavily loaded at the time of the test. The logs on the ticket above do not allow us to know which of the two "test_default_timeout" tests is failing, so disable both with self.skipTest(). Excerpt from `ptest-runner python3`: test_default_timeout (test.test_multiprocessing_fork.test_manager.WithManagerTestBarrier.test_default_timeout) SKIP: Test the barrier's default timeout 'skip flaky timeout test' [YOCTO #15885] Signed-off-by: Antonin Godard Signed-off-by: Richard Purdie (cherry picked from commit 9382dee2a59a359f38e03179d01fce47c2d86372) Signed-off-by: Yoann Congal --- ...kip-flaky-test_default_timeout-tests.patch | 49 +++++++++++++++++++ .../python/python3_3.13.11.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta/recipes-devtools/python/python3/0001-Skip-flaky-test_default_timeout-tests.patch diff --git a/meta/recipes-devtools/python/python3/0001-Skip-flaky-test_default_timeout-tests.patch b/meta/recipes-devtools/python/python3/0001-Skip-flaky-test_default_timeout-tests.patch new file mode 100644 index 00000000000..4e1bd833b46 --- /dev/null +++ b/meta/recipes-devtools/python/python3/0001-Skip-flaky-test_default_timeout-tests.patch @@ -0,0 +1,49 @@ +From baf2dda48e51fcb17a716e52cc5c4e162a6bb7d3 Mon Sep 17 00:00:00 2001 +From: Antonin Godard +Date: Mon, 19 Jan 2026 11:38:36 +0100 +Subject: [PATCH] Skip flaky test_default_timeout tests + +We have been observing issues with this test on the Autobuilder: +https://bugzilla.yoctoproject.org/show_bug.cgi?id=15885 + +The logs on the ticket above do not allow us to know which of the two +"test_default_timeout" tests is failing, so disable both with +self.skipTest(). + +Excerpt from `ptest-runner python3`: + + test_default_timeout (test.test_multiprocessing_fork.test_manager.WithManagerTestBarrier.test_default_timeout) + SKIP: Test the barrier's default timeout 'skip flaky timeout test' + +Upstream-Status: Inappropriate [OE specific, but might be related to https://github.com/python/cpython/issues/129266#issuecomment-2613058866] + +Signed-off-by: Antonin Godard +--- + Lib/test/_test_multiprocessing.py | 1 + + Lib/test/lock_tests.py | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/Lib/test/_test_multiprocessing.py b/Lib/test/_test_multiprocessing.py +index e8064e7..9ab1f9e 100644 +--- a/Lib/test/_test_multiprocessing.py ++++ b/Lib/test/_test_multiprocessing.py +@@ -2259,6 +2259,7 @@ class _TestBarrier(BaseTestCase): + """ + Test the barrier's default timeout + """ ++ self.skipTest('skip flaky timeout test') + barrier = self.Barrier(self.N, timeout=0.5) + results = self.DummyList() + self.run_threads(self._test_default_timeout_f, (barrier, results)) +diff --git a/Lib/test/lock_tests.py b/Lib/test/lock_tests.py +index 8c8f890..43e9b90 100644 +--- a/Lib/test/lock_tests.py ++++ b/Lib/test/lock_tests.py +@@ -1165,6 +1165,7 @@ class BarrierTests(BaseTestCase): + """ + Test the barrier's default timeout + """ ++ self.skipTest('skip flaky timeout test') + timeout = 0.100 + barrier = self.barriertype(2, timeout=timeout) + def f(): diff --git a/meta/recipes-devtools/python/python3_3.13.11.bb b/meta/recipes-devtools/python/python3_3.13.11.bb index 2fcfd4aba19..2bc2389b7e4 100644 --- a/meta/recipes-devtools/python/python3_3.13.11.bb +++ b/meta/recipes-devtools/python/python3_3.13.11.bb @@ -30,6 +30,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://0001-test_active_children-skip-problematic-test.patch \ file://0001-test_readline-skip-limited-history-test.patch \ file://0001-Generate-data-for-OpenSSL-3.4-and-add-it-to-multissl.patch \ + file://0001-Skip-flaky-test_default_timeout-tests.patch \ " SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ From patchwork Fri Mar 6 07:22:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82670 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0A7EF0180C for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64472.1772781789032616716 for ; Thu, 05 Mar 2026 23:23:09 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=w5fyqByr; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4836f363ad2so103974805e9.1 for ; Thu, 05 Mar 2026 23:23:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781787; x=1773386587; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=lrXin+/BxoEdBjBVSUTfE+iM5flf4TUK2XcBa2YBdIg=; b=w5fyqByrKqBotQuwrUJ9lKLf5q8JnDWvu03kum5B2rQ3YJVLDLOhXh2xE3QBuP7ZbM +IK/QuAnGiVMhF2A6X7jC9x5ul8X8PhoLrFCBFw2SFaIcahYn4UZv2MXkNoIDzqrF0ux /vK8ZtbRVVybuSS2aOKWI3/g6FE7A6zjpxafM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781787; x=1773386587; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=lrXin+/BxoEdBjBVSUTfE+iM5flf4TUK2XcBa2YBdIg=; b=a6Dbu3cP8Bd21lY5UPC9u7x9hNV3qM5OuGjAZRgjP1gxSJZtzcdzjZ2cBZ8Lomp8EB aIU891KH234TT6ENC2F5YijURTqYjGyCHc615v0G5WSR3iYGkFjHIQe4S4cpVTb96DvM viKvhMksqjVyyRz/fywQ/xYR+D2Z0edGptpNZtOYdfCsyRX4s28LQBTY5CU13yvwHCzI nRnH+TtGh0RTDC1Eg5uuKTICx1qCjPyCnYTXlaBAGgXdR1sQj0WKKQJG/kmLTgq2m7RO Pm/GwTvHWmKFI1aJa/vpoi3lJKuNnEWk1sa63VkhcId3K1sriEiP7tPxgx2M2/OlpBpg tEpw== X-Gm-Message-State: AOJu0YyAKVr/yQNsCqcUgbbeV+spkI1TZD/p56TVQh3bO9Sel22CgQkH o3d4MynDJThQCOsLzEcI7YRv1PjwCX2KK3cPVN1gh0NLponUufNYnd6AemgQyBazwhfMI6ckE0K RZuMd X-Gm-Gg: ATEYQzyjIyk6T6hgcYCBq0RHDxq75E6/ZEWbRWKBxHY0Y5k8slhTXK1Iu9ro8BsX9nB 2Yno94RDMOXenM27WaJB/jhHWWTuZnIJM/0RN6k7FeNSImB7Ng+E6ghuBJpypa9no4E36yxgJGw PL3XLtxbcxYkNzoHpeAjx0YyaXzaY4MRM0GseZL2OfMIFJlCoWOLTUJpoyxczo0aMcwrTaEOKFr 9Za2WvbIWoPyWd95ZkFGlZ87BEy3gZWCAa8TqloWEzBiobop+NnR9B2dNupwVjrOtGMn000MbmJ iH2NjYCQXysoNzkZZbByN1XFN7ANWC0aNa/d9l8wYvJkUr+U6GlWIkwKzCJUqK3qtqEleaUVrVp 9gfzWIQ3Wj3vrbX4YqH/5lRsQWLzLyrp2z3/VCH+XduGrTWXQlRmn9ChzIWnKb8vahGxa8vfT37 qjtHXomRUc31d9n3kjdfnl4in+kKixgVulJxO3i1IgiwJPbKCntHJHXpvcABZyqEp29JInAfoJG sjjHk3lrFUaAI5Z0H75seqJsYzK X-Received: by 2002:a05:600c:3b0c:b0:477:7b16:5fb1 with SMTP id 5b1f17b1804b1-48526918939mr15913085e9.7.1772781787120; Thu, 05 Mar 2026 23:23:07 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:06 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 13/16] create-pull-request: Keep commit hash to be pulled in cover email Date: Fri, 6 Mar 2026 08:22:13 +0100 Message-ID: <8b40a2daa8f41e95ed421ef58f8eed3f034d67fd.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232552 From: Paul Barker The cover email mangling in create-pull-request was cutting off the actual commit hash to be pulled, making it difficult to verify that the changes a maintainer merges exactly match those intended by the pull request author. The extra lines we want to include are, for example from a recent whinlatter stable branch PR: for you to fetch changes up to 6c4c6d39ea3202d756acc13f8ce81b114a468541: cups: upgrade from 2.4.14 to 2.4.15 (2025-12-29 09:49:31 -0800) Signed-off-by: Paul Barker Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit c78f5ae4a5ba3675b78cc226feb7b9fbbfd8da19) Signed-off-by: Yoann Congal --- scripts/create-pull-request | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/create-pull-request b/scripts/create-pull-request index 885105fab3d..5c4414ecd5f 100755 --- a/scripts/create-pull-request +++ b/scripts/create-pull-request @@ -219,7 +219,7 @@ fi # The cover letter already has a diffstat, remove it from the pull-msg # before inserting it. -sed -n "0,\#$REMOTE_URL# p" "$PM" | sed -i "/BLURB HERE/ r /dev/stdin" "$CL" +sed -n "0,\#^----------------------------------------------------------------# p" "$PM" | sed -i "/BLURB HERE/ r /dev/stdin" "$CL" rm "$PM" # If this is an RFC, make that clear in the cover letter From patchwork Fri Mar 6 07:22:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82672 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0397F0180A for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64473.1772781789549359251 for ; Thu, 05 Mar 2026 23:23:09 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=V95XmeOB; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4806bf39419so72647195e9.1 for ; Thu, 05 Mar 2026 23:23:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781787; x=1773386587; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=QiyjrcXhgh986I/BEIJmBuMsk/oPDapDS9ZjJMRTxl8=; b=V95XmeOBIX5IzQgQ1RRc0L+tjMtPa3JmCk8Nzm8T4qMZFbWT7XQhld9gQFohPMXrEy sm50Z+Kg1pFTXmN0DVR87eIpR5d6KfyRO06TUOtuogqh7uQ2CFY2B9BFjZfES0RTgHSt bMDvBW4HCOW/IGGdtg/MShTD05jVaekA0rTC8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781787; x=1773386587; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=QiyjrcXhgh986I/BEIJmBuMsk/oPDapDS9ZjJMRTxl8=; b=YmRq/Mu056jbM6PUxgwDxCFVbNP2/I7K1hnRUf2Fh270Fj979cHbh4RAEu2K3yrx85 xAcDXgWwkAPPGoUm/aNuJKUao+LRnuRBHG7+An+g9djQ4KlFtubHgld1c+qDkkRAj79I tgfyjkncziKKviBQeMdXPspbyo0XMWNMApMnfW4gugnmAAF9ni2Y+VSxXuGEqG03CLwj qjETSKuUIfqScGsyQoYErkkMDqXafS3lTSQSA/XO3d+zX2txLVyMhQ9Fut4FxF81mRqz 7JpP0VOByoCnqjKLy0yMi3BRZepxMvACBrf1uL67et4YQ0YTm73Tm3sZhuzFf8OEg0Ks DSlA== X-Gm-Message-State: AOJu0YxL8k+3fvtm30DmatPG1FT68llOhPd6gEHGuJ7n4lXpEua9OZQ5 HWL+zX1HOG0HbN5m3razMXnUju8hQsJI7On4Bk22bZTolQbhqrfDxsCyC6NJ8v+8Md0a9j+rbB1 kUY+O X-Gm-Gg: ATEYQzwXn5ac8k18972DUU/WTPogG3hNi/ioeDKy41UhLQsCsgVl3ul4P2MBk9AKVEL KOIhmV6JAOhnNp9rs9szb6MrTU3ZkukgiKh2nTYMly143mNrEVonB8e7yiFSBdlkM18RvQ+JA70 5ig8VBntWBTWME+lRnLJiGrcwf2FttGy9Uld4HQ5XOJvNtCBPcLJkSKzIlSfJtcLx5ff8An52+O mmOJliFUbK9d2x6+B/WFi1NQyA0VbtXZX5pZINsLMxqv0Ua9QC00VttajgpBSqIC7sx3XFH1ale 1t15vRJrIlOPJp0z/ky+5zcASNYqWtn4b+sdCdUEmWiC4xiXNj6jcTqhqXvFXdKlyKel7y2TSBf xwaPwrrrrCpiL7U6YUK8kgk6Ch0Gvu9ZnjG2qkvWnvS2sp/u5tecFIYLNoYpiqJ9yJKrotp0x1L BAkTnsbgtvzmrzew7nx/7vwFCNNEoEzs04VaL7j3PUSNZAH6qCBEOeFGnK1aEOAbigs7MuN7xdK pOjPjtpr+kcTmZLkYN1oGHSK4asXsaJWwHpnyY= X-Received: by 2002:a05:600c:45d1:b0:483:7b99:131d with SMTP id 5b1f17b1804b1-4852675e55cmr16850155e9.16.1772781787636; Thu, 05 Mar 2026 23:23:07 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:07 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 14/16] avahi: Remove a reference to the rejected CVE-2021-36217 Date: Fri, 6 Mar 2026 08:22:14 +0100 Message-ID: <12683ab466b090a842765f643b00c013eff5f709.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232553 From: Benjamin Robin (Schneider Electric) CVE-2021-36217 is rejected, and should no longer be referenced. CVE-2021-36217 is a duplicate of CVE-2021-3502 which is already referenced in the local-ping.patch. The CVE database indicates the following reason: ConsultIDs: CVE-2021-3502. Reason: This candidate is a duplicate of CVE-2021-3502. Notes: All CVE users should reference CVE-2021-3502 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit bf41240132e2efa6b46aab46290eed9c53e312e9) Signed-off-by: Yoann Congal --- meta/recipes-connectivity/avahi/files/local-ping.patch | 1 - 1 file changed, 1 deletion(-) diff --git a/meta/recipes-connectivity/avahi/files/local-ping.patch b/meta/recipes-connectivity/avahi/files/local-ping.patch index 29c192d296e..8f102815df0 100644 --- a/meta/recipes-connectivity/avahi/files/local-ping.patch +++ b/meta/recipes-connectivity/avahi/files/local-ping.patch @@ -1,4 +1,3 @@ -CVE: CVE-2021-36217 CVE: CVE-2021-3502 Upstream-Status: Backport Signed-off-by: Ross Burton From patchwork Fri Mar 6 07:22:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82671 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7819F01810 for ; Fri, 6 Mar 2026 07:23:10 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.64691.1772781790211904019 for ; Thu, 05 Mar 2026 23:23:10 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=TE+khRcd; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4806ce0f97bso77951005e9.0 for ; Thu, 05 Mar 2026 23:23:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781788; x=1773386588; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=b2VJvrdz5xeANJHnx1vxIlPoImSYTd+5/ifwSVg7OhE=; b=TE+khRcd0ER0esiluftVREHU05QjDtvXA4KFGeSCjdn8z+7gGaejjLdWgVDFQhq8FK /99N4RbfeX2eIF2H8Tnuejq/u68Ewaebg76mtbI/6Q8KLi3XXjjYP8pRX38roovkJBYX 7pnK4QGU1PULKohaxePzzIV5HBNGs7XV28/yU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781788; x=1773386588; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=b2VJvrdz5xeANJHnx1vxIlPoImSYTd+5/ifwSVg7OhE=; b=bEj54+Tvo4WJk84OHQFZFyLbMkOWvbpu1Q1MzsgVfJiqjT2t7OV4nipPNmmsb4kHzS P4gatUi1uNScwG1cl8j1xKmFd0h0w/ekHiEOzE8/S9FcJG0R9+D+bgenQMv0gi4vGtWv e4zLQ32h4SVLunYvUfLzsV6gpXeE0rXeOlQ1cE0/sI95ZfIrPENdYJT5SLt5DeaC3Ulm /nOGcWZvkHoHnZ7DbIRw8TPzaObg0JdiEdS6Wz/n8cvvGsovW1nye5xm8iLUL31mHySK aWH5ela3aaPVlfrE1gPfhBvXxdtfl8uG75h1NT56bex5YrncQMb5xQaHfFkDbX2FwuEo StfA== X-Gm-Message-State: AOJu0YxW0/aWPIgOCJTyV4R5zoRkbw+lbPK61Q9+yFBZqU2PAs2ApjvJ wj9fgpYPvMu5LRfdXDWZ9/cmiJRUsnCiCQn4A/WF6eeQJMToEwqaR1hQ+bQgUJkK39i+C1yOHfJ p/Mjv X-Gm-Gg: ATEYQzzEqmCXHGmdCbm0aDxWSTXmXa9n+SGVJx/y8ELtRC4tl9YDFhO+Tw1Vds5yC6v ar8ty1OqONRZHPrU/WCaCUntZ0acwMpScYLKA2jlj/sYKYD5077YbSrS9UlLq0GtISICY6h54wg KIvkfIT2hJGz4GpmmWCDgNBNIa/zpuW56iJt2wI5PIVCNI8dYAhbCx/2J+5zOM9UIqCTz+5e0v1 Ha7v2g6Y6h2BIr8bzEpohzMyNaNm5GlEs5V0A/8Cuk2pKVPhSe2tlodfCCarXCNwt/hj3MF0zpn wAFjB/5MJ3lpfenjhKwDox+wLWMPktL1XihFXpNqFkHfqJlyJMtLA1UISK5Ew1bVKQfhfC4IH4C 79RoOzRXn1f5sTIzR/F0DZ1cLk59mvdw303AYdEVP6exAlSwDCl90SldYJZZ9W1Cjb8M+Qnprya g6dF0VC+Im6NxoQlvP/XjBzylJufGlxibzzrf9N8bduBKVWvT6PiI6Qy/M095D/2GnSknIW4CpK em1JiBnGxSxEHgYxyakkr0mrZTk X-Received: by 2002:a05:600c:620b:b0:483:6a8d:b2fc with SMTP id 5b1f17b1804b1-4852691c73dmr14843665e9.8.1772781788188; Thu, 05 Mar 2026 23:23:08 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:07 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 15/16] lz4: Remove a reference to the rejected CVE-2025-62813 Date: Fri, 6 Mar 2026 08:22:15 +0100 Message-ID: <0e59e9fdfda1907738ce8d9d90c34c55e6f27a24.1772780989.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232554 From: Benjamin Robin (Schneider Electric) The CVE-2025-62813 is rejected so do not reference it anymore. So keep the patch but without referencing the CVE identifier. The CVE database indicates the following reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Signed-off-by: Benjamin Robin (Schneider Electric) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 9c840a69b62a5fdffb3679a44d68dd5630b2916c) Signed-off-by: Yoann Congal --- .../lz4/{CVE-2025-62813.patch => fix-null-error-handling.patch} | 1 - meta/recipes-support/lz4/lz4_1.10.0.bb | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) rename meta/recipes-support/lz4/lz4/{CVE-2025-62813.patch => fix-null-error-handling.patch} (99%) diff --git a/meta/recipes-support/lz4/lz4/CVE-2025-62813.patch b/meta/recipes-support/lz4/lz4/fix-null-error-handling.patch similarity index 99% rename from meta/recipes-support/lz4/lz4/CVE-2025-62813.patch rename to meta/recipes-support/lz4/lz4/fix-null-error-handling.patch index 4fa0373ff77..1527cc75912 100644 --- a/meta/recipes-support/lz4/lz4/CVE-2025-62813.patch +++ b/meta/recipes-support/lz4/lz4/fix-null-error-handling.patch @@ -4,7 +4,6 @@ Date: Mon, 31 Mar 2025 20:48:52 +0200 Subject: [PATCH] fix(null) : improve error handlings when passing a null pointer to some functions from lz4frame -CVE: CVE-2025-62813 Upstream-Status: Backport [https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82] Signed-off-by: Peter Marko --- diff --git a/meta/recipes-support/lz4/lz4_1.10.0.bb b/meta/recipes-support/lz4/lz4_1.10.0.bb index f2a86036b56..fae5796c2b9 100644 --- a/meta/recipes-support/lz4/lz4_1.10.0.bb +++ b/meta/recipes-support/lz4/lz4_1.10.0.bb @@ -15,7 +15,7 @@ SRCREV = "ebb370ca83af193212df4dcbadcc5d87bc0de2f0" SRC_URI = "git://github.com/lz4/lz4.git;branch=release;protocol=https \ file://reproducibility.patch \ file://run-ptest \ - file://CVE-2025-62813.patch \ + file://fix-null-error-handling.patch \ " UPSTREAM_CHECK_GITTAGREGEX = "v(?P.*)" From patchwork Fri Mar 6 07:22:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 82674 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA6A6F01804 for ; Fri, 6 Mar 2026 07:23:20 +0000 (UTC) Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.64475.1772781791816969134 for ; Thu, 05 Mar 2026 23:23:12 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=nVnxkQcc; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4806ce0f97bso77951365e9.0 for ; Thu, 05 Mar 2026 23:23:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1772781790; x=1773386590; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=nTVtSYGqmLVxPe/PGuErPp5xyCa3M0DxUzKEvmXhVzc=; b=nVnxkQccb/P5Kg4P++dqB06tY8aqzpRjiI13ISnYX4i8jOS/HgisAOhgVEWNDgFLsf xHP2J8woa04W+mBuZT4vwrwp9Z696Iiiotozj+pWdIGuK9+a0MvLOdkr7if3i5AtGEAo norX/YF1FarmSegl6QtzWzg6ubF2SD/vHNJmQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772781790; x=1773386590; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=nTVtSYGqmLVxPe/PGuErPp5xyCa3M0DxUzKEvmXhVzc=; b=urnO31JSnVvsccEnWjYqMM97qYdrkHhIguZoMSU/CIfMxa1jGq65ciBVMxg03cnrEJ 7add5rKwKivviApMI38tae3O8SoITjAuBjzWZX/l0YMWL79BcQu212kbOekMjs2dmbGS VW9DoopqT477k4OcFEDcXUy2hOmZ0P6s4qhuGbZ8T0ZHClcR6vR4L0WMhdp6PfvSzL4l cRj3f/BbedfrBehHKhOXM+W5+heIHrS44kRINwsIwm6A3JKDKsi7xp7OsYFAqmmjxCWs hNzRUSLaC6dDpRmBbciNwqVyoAu6B9SI9fzJ7LJVAPhYvHC/fcJXaN9TMm4Sh8hb7Ho7 TudA== X-Gm-Message-State: AOJu0YxjI1ARaH7aYytmoAZSwQ7LzPCeYa5VRZcWn2JiamRSxvWq/F95 v+PDp/YUwH9MdW7q3N9qxDEr3S7fqnaDFTu9A9Wk7LHDERIfsCbqiLDDx6P6uVcf0VJcqO7Uvms di1nG X-Gm-Gg: ATEYQzzD6abqL0P2/qgrBSWQULY6ztEVrnmyWQRhPe7osnQA41Qc2hQg1rdjYG6xDW9 dk6seSlqvIhOod1OvMlAojc3YTKYXPYgu0YSjSqD2snfTYQQ2ITzLqY0tVKJigvxIZ0jxSEz7eV 2ozZy0kIacO20/Pl5ac6cfMy+LTFy8Y/6hWyHZcrnnih4b1HmARssNmyoaxq25H1ioaaf3ABpTr zBjFj2F+XZZCJWE/3Ch9UJdKnukt2TCjvjRPPQ3IvUIuT00k7ph6ntfsr3pzvnW0Wj+Z+gfrUUH jceJjj/YkKBTAInAcGGQEqKsZF5LRtIjKSZJz9odELYX3ToYYaLvpg6hLEIn4RaEjxN/6vn024l RMvOxpPNsPAXIkATgTu39vh9nLXsiw2AN/zh5R+H8UBONGxUjj5vhrebO71OgetuZnhtJQtPo0e a3/a3JhXF4B3JLaDhWw/B5tdXmOdR0jTSfCsXS/uhXZNqeA0Xc3Nmvr2DtuVO9bbbtXOaHyXXux JokPxGuIxmXH41YtjMZaheFi9p7 X-Received: by 2002:a05:600c:8b5b:b0:46e:4e6d:79f4 with SMTP id 5b1f17b1804b1-48526927a4dmr15858685e9.15.1772781788836; Thu, 05 Mar 2026 23:23:08 -0800 (PST) Received: from FRSMI25-LASER.home (2a01cb001331aa00bdeac353f6fa5aa8.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:bdea:c353:f6fa:5aa8]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-485276b09casm23106445e9.11.2026.03.05.23.23.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 23:23:08 -0800 (PST) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 16/16] python3-urllib3: patch CVE-2025-66471 Date: Fri, 6 Mar 2026 08:22:16 +0100 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 06 Mar 2026 07:23:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/232555 From: Peter Marko Pick patch per [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-66471 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../python3-urllib3/CVE-2025-66471.patch | 926 ++++++++++++++++++ .../python/python3-urllib3_2.5.0.bb | 1 + 2 files changed, 927 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2025-66471.patch diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2025-66471.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2025-66471.patch new file mode 100644 index 00000000000..15f601843b8 --- /dev/null +++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2025-66471.patch @@ -0,0 +1,926 @@ +From c19571de34c47de3a766541b041637ba5f716ed7 Mon Sep 17 00:00:00 2001 +From: Illia Volochii +Date: Fri, 5 Dec 2025 16:40:41 +0200 +Subject: [PATCH] Merge commit from fork + +* Prevent decompression bomb for zstd in Python 3.14 + +* Add experimental `decompress_iter` for Brotli + +* Update changes for Brotli + +* Add `GzipDecoder.decompress_iter` + +* Test https://github.com/python-hyper/brotlicffi/pull/207 + +* Pin Brotli + +* Add `decompress_iter` to all decoders and make tests pass + +* Pin brotlicffi to an official release + +* Revert changes to response.py + +* Add `max_length` parameter to all `decompress` methods + +* Fix the `test_brotlipy` session + +* Unset `_data` on gzip error + +* Add a test for memory usage + +* Test more methods + +* Fix the test for `stream` + +* Cover more lines with tests + +* Add more coverage + +* Make `read1` a bit more efficient + +* Fix PyPy tests for Brotli + +* Revert an unnecessarily moved check + +* Add some comments + +* Leave just one `self._obj.decompress` call in `GzipDecoder` + +* Refactor test params + +* Test reads with all data already in the decompressor + +* Prevent needless copying of data decoded with `max_length` + +* Rename the changed test + +* Note that responses of unknown length should be streamed too + +* Add a changelog entry + +* Avoid returning a memory view from `BytesQueueBuffer` + +* Add one more note to the changelog entry + +CVE: CVE-2025-66471 +Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7] +Signed-off-by: Peter Marko +--- + CHANGES.rst | 15 +++ + docs/advanced-usage.rst | 3 +- + docs/user-guide.rst | 4 +- + pyproject.toml | 5 +- + src/urllib3/response.py | 278 ++++++++++++++++++++++++++++++++++------ + test/test_response.py | 269 +++++++++++++++++++++++++++++++++++++- + 6 files changed, 525 insertions(+), 49 deletions(-) + +diff --git a/CHANGES.rst b/CHANGES.rst +index add194eb..345476f3 100644 +--- a/CHANGES.rst ++++ b/CHANGES.rst +@@ -10,6 +10,21 @@ Bugfixes + + TODO: add other entries. + ++- Fixed a security issue where streaming API could improperly handle highly ++ compressed HTTP content ("decompression bombs") leading to excessive resource ++ consumption even when a small amount of data was requested. Reading small ++ chunks of compressed data is safer and much more efficient now. ++ ++.. caution:: ++ - If urllib3 is not installed with the optional `urllib3[brotli]` extra, but ++ your environment contains a Brotli/brotlicffi/brotlipy package anyway, make ++ sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to ++ benefit from the security fixes and avoid warnings. Prefer using ++ `urllib3[brotli]` to install a compatible Brotli package automatically. ++ ++ - If you use custom decompressors, please make sure to update them to ++ respect the changed API of ``urllib3.response.ContentDecoder``. ++ + + 2.5.0 (2025-06-18) + ================== +diff --git a/docs/advanced-usage.rst b/docs/advanced-usage.rst +index ff773662..3ab4fcf3 100644 +--- a/docs/advanced-usage.rst ++++ b/docs/advanced-usage.rst +@@ -66,7 +66,8 @@ When using ``preload_content=True`` (the default setting) the + response body will be read immediately into memory and the HTTP connection + will be released back into the pool without manual intervention. + +-However, when dealing with large responses it's often better to stream the response ++However, when dealing with responses of large or unknown length, ++it's often better to stream the response + content using ``preload_content=False``. Setting ``preload_content`` to ``False`` means + that urllib3 will only read from the socket when data is requested. + +diff --git a/docs/user-guide.rst b/docs/user-guide.rst +index 5c78c8af..1d9d0bbd 100644 +--- a/docs/user-guide.rst ++++ b/docs/user-guide.rst +@@ -145,8 +145,8 @@ to a byte string representing the response content: + print(resp.data) + # b"\xaa\xa5H?\x95\xe9\x9b\x11" + +-.. note:: For larger responses, it's sometimes better to :ref:`stream ` +- the response. ++.. note:: For responses of large or unknown length, it's sometimes better to ++ :ref:`stream ` the response. + + Using io Wrappers with Response Content + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +diff --git a/pyproject.toml b/pyproject.toml +index c9aa6d13..45538a6e 100644 +--- a/pyproject.toml ++++ b/pyproject.toml +@@ -41,8 +41,8 @@ dynamic = ["version"] + + [project.optional-dependencies] + brotli = [ +- "brotli>=1.0.9; platform_python_implementation == 'CPython'", +- "brotlicffi>=0.8.0; platform_python_implementation != 'CPython'" ++ "brotli>=1.2.0; platform_python_implementation == 'CPython'", ++ "brotlicffi>=1.2.0.0; platform_python_implementation != 'CPython'" + ] + # Once we drop support for Python 3.13 this extra can be removed. + # We'll need a deprecation period for the 'zstandard' module support +@@ -160,6 +160,7 @@ filterwarnings = [ + '''default:ssl\.PROTOCOL_TLSv1_1 is deprecated:DeprecationWarning''', + '''default:ssl\.PROTOCOL_TLSv1_2 is deprecated:DeprecationWarning''', + '''default:ssl NPN is deprecated, use ALPN instead:DeprecationWarning''', ++ '''default:Brotli >= 1.2.0 is required to prevent decompression bombs\.:urllib3.exceptions.DependencyWarning''', + # https://github.com/SeleniumHQ/selenium/issues/13328 + '''default:unclosed file <_io\.BufferedWriter name='/dev/null'>:ResourceWarning''', + # https://github.com/SeleniumHQ/selenium/issues/14686 +diff --git a/src/urllib3/response.py b/src/urllib3/response.py +index 3df98184..4ba42136 100644 +--- a/src/urllib3/response.py ++++ b/src/urllib3/response.py +@@ -33,6 +33,7 @@ from .connection import BaseSSLError, HTTPConnection, HTTPException + from .exceptions import ( + BodyNotHttplibCompatible, + DecodeError, ++ DependencyWarning, + HTTPError, + IncompleteRead, + InvalidChunkLength, +@@ -52,7 +53,11 @@ log = logging.getLogger(__name__) + + + class ContentDecoder: +- def decompress(self, data: bytes) -> bytes: ++ def decompress(self, data: bytes, max_length: int = -1) -> bytes: ++ raise NotImplementedError() ++ ++ @property ++ def has_unconsumed_tail(self) -> bool: + raise NotImplementedError() + + def flush(self) -> bytes: +@@ -62,30 +67,57 @@ class ContentDecoder: + class DeflateDecoder(ContentDecoder): + def __init__(self) -> None: + self._first_try = True +- self._data = b"" ++ self._first_try_data = b"" ++ self._unfed_data = b"" + self._obj = zlib.decompressobj() + +- def decompress(self, data: bytes) -> bytes: +- if not data: ++ def decompress(self, data: bytes, max_length: int = -1) -> bytes: ++ data = self._unfed_data + data ++ self._unfed_data = b"" ++ if not data and not self._obj.unconsumed_tail: + return data ++ original_max_length = max_length ++ if original_max_length < 0: ++ max_length = 0 ++ elif original_max_length == 0: ++ # We should not pass 0 to the zlib decompressor because 0 is ++ # the default value that will make zlib decompress without a ++ # length limit. ++ # Data should be stored for subsequent calls. ++ self._unfed_data = data ++ return b"" + ++ # Subsequent calls always reuse `self._obj`. zlib requires ++ # passing the unconsumed tail if decompression is to continue. + if not self._first_try: +- return self._obj.decompress(data) ++ return self._obj.decompress( ++ self._obj.unconsumed_tail + data, max_length=max_length ++ ) + +- self._data += data ++ # First call tries with RFC 1950 ZLIB format. ++ self._first_try_data += data + try: +- decompressed = self._obj.decompress(data) ++ decompressed = self._obj.decompress(data, max_length=max_length) + if decompressed: + self._first_try = False +- self._data = None # type: ignore[assignment] ++ self._first_try_data = b"" + return decompressed ++ # On failure, it falls back to RFC 1951 DEFLATE format. + except zlib.error: + self._first_try = False + self._obj = zlib.decompressobj(-zlib.MAX_WBITS) + try: +- return self.decompress(self._data) ++ return self.decompress( ++ self._first_try_data, max_length=original_max_length ++ ) + finally: +- self._data = None # type: ignore[assignment] ++ self._first_try_data = b"" ++ ++ @property ++ def has_unconsumed_tail(self) -> bool: ++ return bool(self._unfed_data) or ( ++ bool(self._obj.unconsumed_tail) and not self._first_try ++ ) + + def flush(self) -> bytes: + return self._obj.flush() +@@ -101,27 +133,61 @@ class GzipDecoder(ContentDecoder): + def __init__(self) -> None: + self._obj = zlib.decompressobj(16 + zlib.MAX_WBITS) + self._state = GzipDecoderState.FIRST_MEMBER ++ self._unconsumed_tail = b"" + +- def decompress(self, data: bytes) -> bytes: ++ def decompress(self, data: bytes, max_length: int = -1) -> bytes: + ret = bytearray() +- if self._state == GzipDecoderState.SWALLOW_DATA or not data: ++ if self._state == GzipDecoderState.SWALLOW_DATA: + return bytes(ret) ++ ++ if max_length == 0: ++ # We should not pass 0 to the zlib decompressor because 0 is ++ # the default value that will make zlib decompress without a ++ # length limit. ++ # Data should be stored for subsequent calls. ++ self._unconsumed_tail += data ++ return b"" ++ ++ # zlib requires passing the unconsumed tail to the subsequent ++ # call if decompression is to continue. ++ data = self._unconsumed_tail + data ++ if not data and self._obj.eof: ++ return bytes(ret) ++ + while True: + try: +- ret += self._obj.decompress(data) ++ ret += self._obj.decompress( ++ data, max_length=max(max_length - len(ret), 0) ++ ) + except zlib.error: + previous_state = self._state + # Ignore data after the first error + self._state = GzipDecoderState.SWALLOW_DATA ++ self._unconsumed_tail = b"" + if previous_state == GzipDecoderState.OTHER_MEMBERS: + # Allow trailing garbage acceptable in other gzip clients + return bytes(ret) + raise +- data = self._obj.unused_data ++ ++ self._unconsumed_tail = data = ( ++ self._obj.unconsumed_tail or self._obj.unused_data ++ ) ++ if max_length > 0 and len(ret) >= max_length: ++ break ++ + if not data: + return bytes(ret) +- self._state = GzipDecoderState.OTHER_MEMBERS +- self._obj = zlib.decompressobj(16 + zlib.MAX_WBITS) ++ # When the end of a gzip member is reached, a new decompressor ++ # must be created for unused (possibly future) data. ++ if self._obj.eof: ++ self._state = GzipDecoderState.OTHER_MEMBERS ++ self._obj = zlib.decompressobj(16 + zlib.MAX_WBITS) ++ ++ return bytes(ret) ++ ++ @property ++ def has_unconsumed_tail(self) -> bool: ++ return bool(self._unconsumed_tail) + + def flush(self) -> bytes: + return self._obj.flush() +@@ -136,9 +202,35 @@ if brotli is not None: + def __init__(self) -> None: + self._obj = brotli.Decompressor() + if hasattr(self._obj, "decompress"): +- setattr(self, "decompress", self._obj.decompress) ++ setattr(self, "_decompress", self._obj.decompress) + else: +- setattr(self, "decompress", self._obj.process) ++ setattr(self, "_decompress", self._obj.process) ++ ++ # Requires Brotli >= 1.2.0 for `output_buffer_limit`. ++ def _decompress(self, data: bytes, output_buffer_limit: int = -1) -> bytes: ++ raise NotImplementedError() ++ ++ def decompress(self, data: bytes, max_length: int = -1) -> bytes: ++ try: ++ if max_length > 0: ++ return self._decompress(data, output_buffer_limit=max_length) ++ else: ++ return self._decompress(data) ++ except TypeError: ++ # Fallback for Brotli/brotlicffi/brotlipy versions without ++ # the `output_buffer_limit` parameter. ++ warnings.warn( ++ "Brotli >= 1.2.0 is required to prevent decompression bombs.", ++ DependencyWarning, ++ ) ++ return self._decompress(data) ++ ++ @property ++ def has_unconsumed_tail(self) -> bool: ++ try: ++ return not self._obj.can_accept_more_data() ++ except AttributeError: ++ return False + + def flush(self) -> bytes: + if hasattr(self._obj, "flush"): +@@ -156,16 +248,46 @@ try: + def __init__(self) -> None: + self._obj = zstd.ZstdDecompressor() + +- def decompress(self, data: bytes) -> bytes: +- if not data: ++ def decompress(self, data: bytes, max_length: int = -1) -> bytes: ++ if not data and not self.has_unconsumed_tail: + return b"" +- data_parts = [self._obj.decompress(data)] +- while self._obj.eof and self._obj.unused_data: +- unused_data = self._obj.unused_data ++ if self._obj.eof: ++ data = self._obj.unused_data + data + self._obj = zstd.ZstdDecompressor() +- data_parts.append(self._obj.decompress(unused_data)) ++ part = self._obj.decompress(data, max_length=max_length) ++ length = len(part) ++ data_parts = [part] ++ # Every loop iteration is supposed to read data from a separate frame. ++ # The loop breaks when: ++ # - enough data is read; ++ # - no more unused data is available; ++ # - end of the last read frame has not been reached (i.e., ++ # more data has to be fed). ++ while ( ++ self._obj.eof ++ and self._obj.unused_data ++ and (max_length < 0 or length < max_length) ++ ): ++ unused_data = self._obj.unused_data ++ if not self._obj.needs_input: ++ self._obj = zstd.ZstdDecompressor() ++ part = self._obj.decompress( ++ unused_data, ++ max_length=(max_length - length) if max_length > 0 else -1, ++ ) ++ if part_length := len(part): ++ data_parts.append(part) ++ length += part_length ++ elif self._obj.needs_input: ++ break + return b"".join(data_parts) + ++ @property ++ def has_unconsumed_tail(self) -> bool: ++ return not (self._obj.needs_input or self._obj.eof) or bool( ++ self._obj.unused_data ++ ) ++ + def flush(self) -> bytes: + if not self._obj.eof: + raise DecodeError("Zstandard data is incomplete") +@@ -236,10 +358,35 @@ class MultiDecoder(ContentDecoder): + def flush(self) -> bytes: + return self._decoders[0].flush() + +- def decompress(self, data: bytes) -> bytes: +- for d in reversed(self._decoders): +- data = d.decompress(data) +- return data ++ def decompress(self, data: bytes, max_length: int = -1) -> bytes: ++ if max_length <= 0: ++ for d in reversed(self._decoders): ++ data = d.decompress(data) ++ return data ++ ++ ret = bytearray() ++ # Every while loop iteration goes through all decoders once. ++ # It exits when enough data is read or no more data can be read. ++ # It is possible that the while loop iteration does not produce ++ # any data because we retrieve up to `max_length` from every ++ # decoder, and the amount of bytes may be insufficient for the ++ # next decoder to produce enough/any output. ++ while True: ++ any_data = False ++ for d in reversed(self._decoders): ++ data = d.decompress(data, max_length=max_length - len(ret)) ++ if data: ++ any_data = True ++ # We should not break when no data is returned because ++ # next decoders may produce data even with empty input. ++ ret += data ++ if not any_data or len(ret) >= max_length: ++ return bytes(ret) ++ data = b"" ++ ++ @property ++ def has_unconsumed_tail(self) -> bool: ++ return any(d.has_unconsumed_tail for d in self._decoders) + + + def _get_decoder(mode: str) -> ContentDecoder: +@@ -272,9 +419,6 @@ class BytesQueueBuffer: + + * self.buffer, which contains the full data + * the largest chunk that we will copy in get() +- +- The worst case scenario is a single chunk, in which case we'll make a full copy of +- the data inside get(). + """ + + def __init__(self) -> None: +@@ -296,6 +440,10 @@ class BytesQueueBuffer: + elif n < 0: + raise ValueError("n should be > 0") + ++ if len(self.buffer[0]) == n and isinstance(self.buffer[0], bytes): ++ self._size -= n ++ return self.buffer.popleft() ++ + fetched = 0 + ret = io.BytesIO() + while fetched < n: +@@ -502,7 +650,11 @@ class BaseHTTPResponse(io.IOBase): + self._decoder = _get_decoder(content_encoding) + + def _decode( +- self, data: bytes, decode_content: bool | None, flush_decoder: bool ++ self, ++ data: bytes, ++ decode_content: bool | None, ++ flush_decoder: bool, ++ max_length: int | None = None, + ) -> bytes: + """ + Decode the data passed in and potentially flush the decoder. +@@ -515,9 +667,12 @@ class BaseHTTPResponse(io.IOBase): + ) + return data + ++ if max_length is None or flush_decoder: ++ max_length = -1 ++ + try: + if self._decoder: +- data = self._decoder.decompress(data) ++ data = self._decoder.decompress(data, max_length=max_length) + self._has_decoded_content = True + except self.DECODER_ERROR_CLASSES as e: + content_encoding = self.headers.get("content-encoding", "").lower() +@@ -988,6 +1143,14 @@ class HTTPResponse(BaseHTTPResponse): + elif amt is not None: + cache_content = False + ++ if self._decoder and self._decoder.has_unconsumed_tail: ++ decoded_data = self._decode( ++ b"", ++ decode_content, ++ flush_decoder=False, ++ max_length=amt - len(self._decoded_buffer), ++ ) ++ self._decoded_buffer.put(decoded_data) + if len(self._decoded_buffer) >= amt: + return self._decoded_buffer.get(amt) + +@@ -995,7 +1158,11 @@ class HTTPResponse(BaseHTTPResponse): + + flush_decoder = amt is None or (amt != 0 and not data) + +- if not data and len(self._decoded_buffer) == 0: ++ if ( ++ not data ++ and len(self._decoded_buffer) == 0 ++ and not (self._decoder and self._decoder.has_unconsumed_tail) ++ ): + return data + + if amt is None: +@@ -1012,7 +1179,12 @@ class HTTPResponse(BaseHTTPResponse): + ) + return data + +- decoded_data = self._decode(data, decode_content, flush_decoder) ++ decoded_data = self._decode( ++ data, ++ decode_content, ++ flush_decoder, ++ max_length=amt - len(self._decoded_buffer), ++ ) + self._decoded_buffer.put(decoded_data) + + while len(self._decoded_buffer) < amt and data: +@@ -1020,7 +1192,12 @@ class HTTPResponse(BaseHTTPResponse): + # For example, the GZ file header takes 10 bytes, we don't want to read + # it one byte at a time + data = self._raw_read(amt) +- decoded_data = self._decode(data, decode_content, flush_decoder) ++ decoded_data = self._decode( ++ data, ++ decode_content, ++ flush_decoder, ++ max_length=amt - len(self._decoded_buffer), ++ ) + self._decoded_buffer.put(decoded_data) + data = self._decoded_buffer.get(amt) + +@@ -1055,6 +1232,20 @@ class HTTPResponse(BaseHTTPResponse): + "Calling read1(decode_content=False) is not supported after " + "read1(decode_content=True) was called." + ) ++ if ( ++ self._decoder ++ and self._decoder.has_unconsumed_tail ++ and (amt is None or len(self._decoded_buffer) < amt) ++ ): ++ decoded_data = self._decode( ++ b"", ++ decode_content, ++ flush_decoder=False, ++ max_length=( ++ amt - len(self._decoded_buffer) if amt is not None else None ++ ), ++ ) ++ self._decoded_buffer.put(decoded_data) + if len(self._decoded_buffer) > 0: + if amt is None: + return self._decoded_buffer.get_all() +@@ -1070,7 +1261,9 @@ class HTTPResponse(BaseHTTPResponse): + self._init_decoder() + while True: + flush_decoder = not data +- decoded_data = self._decode(data, decode_content, flush_decoder) ++ decoded_data = self._decode( ++ data, decode_content, flush_decoder, max_length=amt ++ ) + self._decoded_buffer.put(decoded_data) + if decoded_data or flush_decoder: + break +@@ -1101,7 +1294,11 @@ class HTTPResponse(BaseHTTPResponse): + if self.chunked and self.supports_chunked_reads(): + yield from self.read_chunked(amt, decode_content=decode_content) + else: +- while not is_fp_closed(self._fp) or len(self._decoded_buffer) > 0: ++ while ( ++ not is_fp_closed(self._fp) ++ or len(self._decoded_buffer) > 0 ++ or (self._decoder and self._decoder.has_unconsumed_tail) ++ ): + data = self.read(amt=amt, decode_content=decode_content) + + if data: +@@ -1264,7 +1461,10 @@ class HTTPResponse(BaseHTTPResponse): + break + chunk = self._handle_chunk(amt) + decoded = self._decode( +- chunk, decode_content=decode_content, flush_decoder=False ++ chunk, ++ decode_content=decode_content, ++ flush_decoder=False, ++ max_length=amt, + ) + if decoded: + yield decoded +diff --git a/test/test_response.py b/test/test_response.py +index c97fdff0..9592fdd9 100644 +--- a/test/test_response.py ++++ b/test/test_response.py +@@ -1,6 +1,7 @@ + from __future__ import annotations + + import contextlib ++import gzip + import http.client as httplib + import socket + import ssl +@@ -43,6 +44,26 @@ def zstd_compress(data: bytes) -> bytes: + return zstd.compress(data) # type: ignore[no-any-return] + + ++def deflate2_compress(data: bytes) -> bytes: ++ compressor = zlib.compressobj(6, zlib.DEFLATED, -zlib.MAX_WBITS) ++ return compressor.compress(data) + compressor.flush() ++ ++ ++if brotli: ++ try: ++ brotli.Decompressor().process(b"", output_buffer_limit=1024) ++ _brotli_gte_1_2_0_available = True ++ except (AttributeError, TypeError): ++ _brotli_gte_1_2_0_available = False ++else: ++ _brotli_gte_1_2_0_available = False ++try: ++ zstd_compress(b"") ++ _zstd_available = True ++except ModuleNotFoundError: ++ _zstd_available = False ++ ++ + class TestBytesQueueBuffer: + def test_single_chunk(self) -> None: + buffer = BytesQueueBuffer() +@@ -118,12 +139,19 @@ class TestBytesQueueBuffer: + + assert len(get_func(buffer)) == 10 * 2**20 + ++ @pytest.mark.parametrize( ++ "get_func", ++ (lambda b: b.get(len(b)), lambda b: b.get_all()), ++ ids=("get", "get_all"), ++ ) + @pytest.mark.limit_memory("10.01 MB", current_thread_only=True) +- def test_get_all_memory_usage_single_chunk(self) -> None: ++ def test_memory_usage_single_chunk( ++ self, get_func: typing.Callable[[BytesQueueBuffer], bytes] ++ ) -> None: + buffer = BytesQueueBuffer() + chunk = bytes(10 * 2**20) # 10 MiB + buffer.put(chunk) +- assert buffer.get_all() is chunk ++ assert get_func(buffer) is chunk + + + # A known random (i.e, not-too-compressible) payload generated with: +@@ -426,7 +454,26 @@ class TestResponse: + assert r.data == b"foo" + + @onlyZstd() +- def test_decode_multiframe_zstd(self) -> None: ++ @pytest.mark.parametrize( ++ "read_amt", ++ ( ++ # Read all data at once. ++ None, ++ # Read one byte at a time, data of frames will be returned ++ # separately. ++ 1, ++ # Read two bytes at a time, the second read should return ++ # data from both frames. ++ 2, ++ # Read three bytes at a time, the whole frames will be ++ # returned separately in two calls. ++ 3, ++ # Read four bytes at a time, the first read should return ++ # data from the first frame and a part of the second frame. ++ 4, ++ ), ++ ) ++ def test_decode_multiframe_zstd(self, read_amt: int | None) -> None: + data = ( + # Zstandard frame + zstd_compress(b"foo") +@@ -441,8 +488,57 @@ class TestResponse: + ) + + fp = BytesIO(data) +- r = HTTPResponse(fp, headers={"content-encoding": "zstd"}) +- assert r.data == b"foobar" ++ result = bytearray() ++ r = HTTPResponse( ++ fp, headers={"content-encoding": "zstd"}, preload_content=False ++ ) ++ total_length = 6 ++ while len(result) < total_length: ++ chunk = r.read(read_amt, decode_content=True) ++ if read_amt is None: ++ assert len(chunk) == total_length ++ else: ++ assert len(chunk) == min(read_amt, total_length - len(result)) ++ result += chunk ++ assert bytes(result) == b"foobar" ++ ++ @onlyZstd() ++ def test_decode_multiframe_zstd_with_max_length_close_to_compressed_data_size( ++ self, ++ ) -> None: ++ """ ++ Test decoding when the first read from the socket returns all ++ the compressed frames, but then it has to be decompressed in a ++ couple of read calls. ++ """ ++ data = ( ++ # Zstandard frame ++ zstd_compress(b"x" * 1024) ++ # skippable frame (must be ignored) ++ + bytes.fromhex( ++ "50 2A 4D 18" # Magic_Number (little-endian) ++ "07 00 00 00" # Frame_Size (little-endian) ++ "00 00 00 00 00 00 00" # User_Data ++ ) ++ # Zstandard frame ++ + zstd_compress(b"y" * 1024) ++ ) ++ ++ fp = BytesIO(data) ++ r = HTTPResponse( ++ fp, headers={"content-encoding": "zstd"}, preload_content=False ++ ) ++ # Read the whole first frame. ++ assert r.read(1024) == b"x" * 1024 ++ assert len(r._decoded_buffer) == 0 ++ # Read the whole second frame in two reads. ++ assert r.read(512) == b"y" * 512 ++ assert len(r._decoded_buffer) == 0 ++ assert r.read(512) == b"y" * 512 ++ assert len(r._decoded_buffer) == 0 ++ # Ensure no more data is left. ++ assert r.read() == b"" ++ assert len(r._decoded_buffer) == 0 + + @onlyZstd() + def test_chunked_decoding_zstd(self) -> None: +@@ -535,6 +631,169 @@ class TestResponse: + decoded_data += part + assert decoded_data == data + ++ _test_compressor_params: list[ ++ tuple[str, tuple[str, typing.Callable[[bytes], bytes]] | None] ++ ] = [ ++ ("deflate1", ("deflate", zlib.compress)), ++ ("deflate2", ("deflate", deflate2_compress)), ++ ("gzip", ("gzip", gzip.compress)), ++ ] ++ if _brotli_gte_1_2_0_available: ++ _test_compressor_params.append(("brotli", ("br", brotli.compress))) ++ else: ++ _test_compressor_params.append(("brotli", None)) ++ if _zstd_available: ++ _test_compressor_params.append(("zstd", ("zstd", zstd_compress))) ++ else: ++ _test_compressor_params.append(("zstd", None)) ++ ++ @pytest.mark.parametrize("read_method", ("read", "read1")) ++ @pytest.mark.parametrize( ++ "data", ++ [d[1] for d in _test_compressor_params], ++ ids=[d[0] for d in _test_compressor_params], ++ ) ++ def test_read_with_all_data_already_in_decompressor( ++ self, ++ request: pytest.FixtureRequest, ++ read_method: str, ++ data: tuple[str, typing.Callable[[bytes], bytes]] | None, ++ ) -> None: ++ if data is None: ++ pytest.skip(f"Proper {request.node.callspec.id} decoder is not available") ++ original_data = b"bar" * 1000 ++ name, compress_func = data ++ compressed_data = compress_func(original_data) ++ fp = mock.Mock(read=mock.Mock(return_value=b"")) ++ r = HTTPResponse(fp, headers={"content-encoding": name}, preload_content=False) ++ # Put all data in the decompressor's buffer. ++ r._init_decoder() ++ assert r._decoder is not None # for mypy ++ decoded = r._decoder.decompress(compressed_data, max_length=0) ++ if name == "br": ++ # It's known that some Brotli libraries do not respect ++ # `max_length`. ++ r._decoded_buffer.put(decoded) ++ else: ++ assert decoded == b"" ++ # Read the data via `HTTPResponse`. ++ read = getattr(r, read_method) ++ assert read(0) == b"" ++ assert read(2500) == original_data[:2500] ++ assert read(500) == original_data[2500:] ++ assert read(0) == b"" ++ assert read() == b"" ++ ++ @pytest.mark.parametrize( ++ "delta", ++ ( ++ 0, # First read from socket returns all compressed data. ++ -1, # First read from socket returns all but one byte of compressed data. ++ ), ++ ) ++ @pytest.mark.parametrize("read_method", ("read", "read1")) ++ @pytest.mark.parametrize( ++ "data", ++ [d[1] for d in _test_compressor_params], ++ ids=[d[0] for d in _test_compressor_params], ++ ) ++ def test_decode_with_max_length_close_to_compressed_data_size( ++ self, ++ request: pytest.FixtureRequest, ++ delta: int, ++ read_method: str, ++ data: tuple[str, typing.Callable[[bytes], bytes]] | None, ++ ) -> None: ++ """ ++ Test decoding when the first read from the socket returns all or ++ almost all the compressed data, but then it has to be ++ decompressed in a couple of read calls. ++ """ ++ if data is None: ++ pytest.skip(f"Proper {request.node.callspec.id} decoder is not available") ++ ++ original_data = b"foo" * 1000 ++ name, compress_func = data ++ compressed_data = compress_func(original_data) ++ fp = BytesIO(compressed_data) ++ r = HTTPResponse(fp, headers={"content-encoding": name}, preload_content=False) ++ initial_limit = len(compressed_data) + delta ++ read = getattr(r, read_method) ++ initial_chunk = read(amt=initial_limit, decode_content=True) ++ assert len(initial_chunk) == initial_limit ++ assert ( ++ len(read(amt=len(original_data), decode_content=True)) ++ == len(original_data) - initial_limit ++ ) ++ ++ # Prepare 50 MB of compressed data outside of the test measuring ++ # memory usage. ++ _test_memory_usage_decode_with_max_length_params: list[ ++ tuple[str, tuple[str, bytes] | None] ++ ] = [ ++ ( ++ params[0], ++ (params[1][0], params[1][1](b"A" * (50 * 2**20))) if params[1] else None, ++ ) ++ for params in _test_compressor_params ++ ] ++ ++ @pytest.mark.parametrize( ++ "data", ++ [d[1] for d in _test_memory_usage_decode_with_max_length_params], ++ ids=[d[0] for d in _test_memory_usage_decode_with_max_length_params], ++ ) ++ @pytest.mark.parametrize("read_method", ("read", "read1", "read_chunked", "stream")) ++ # Decoders consume different amounts of memory during decompression. ++ # We set the 10 MB limit to ensure that the whole decompressed data ++ # is not stored unnecessarily. ++ # ++ # FYI, the following consumption was observed for the test with ++ # `read` on CPython 3.14.0: ++ # - deflate: 2.3 MiB ++ # - deflate2: 2.1 MiB ++ # - gzip: 2.1 MiB ++ # - brotli: ++ # - brotli v1.2.0: 9 MiB ++ # - brotlicffi v1.2.0.0: 6 MiB ++ # - brotlipy v0.7.0: 105.8 MiB ++ # - zstd: 4.5 MiB ++ @pytest.mark.limit_memory("10 MB", current_thread_only=True) ++ def test_memory_usage_decode_with_max_length( ++ self, ++ request: pytest.FixtureRequest, ++ read_method: str, ++ data: tuple[str, bytes] | None, ++ ) -> None: ++ if data is None: ++ pytest.skip(f"Proper {request.node.callspec.id} decoder is not available") ++ ++ name, compressed_data = data ++ limit = 1024 * 1024 # 1 MiB ++ if read_method in ("read_chunked", "stream"): ++ httplib_r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type] ++ httplib_r.fp = MockChunkedEncodingResponse([compressed_data]) # type: ignore[assignment] ++ r = HTTPResponse( ++ httplib_r, ++ preload_content=False, ++ headers={"transfer-encoding": "chunked", "content-encoding": name}, ++ ) ++ next(getattr(r, read_method)(amt=limit, decode_content=True)) ++ else: ++ fp = BytesIO(compressed_data) ++ r = HTTPResponse( ++ fp, headers={"content-encoding": name}, preload_content=False ++ ) ++ getattr(r, read_method)(amt=limit, decode_content=True) ++ ++ # Check that the internal decoded buffer is empty unless brotli ++ # is used. ++ # Google's brotli library does not fully respect the output ++ # buffer limit: https://github.com/google/brotli/issues/1396 ++ # And unmaintained brotlipy cannot limit the output buffer size. ++ if name != "br" or brotli.__name__ == "brotlicffi": ++ assert len(r._decoded_buffer) == 0 ++ + def test_multi_decoding_deflate_deflate(self) -> None: + data = zlib.compress(zlib.compress(b"foo")) + diff --git a/meta/recipes-devtools/python/python3-urllib3_2.5.0.bb b/meta/recipes-devtools/python/python3-urllib3_2.5.0.bb index 7892fc0874e..e277a192e53 100644 --- a/meta/recipes-devtools/python/python3-urllib3_2.5.0.bb +++ b/meta/recipes-devtools/python/python3-urllib3_2.5.0.bb @@ -10,6 +10,7 @@ inherit pypi python_hatchling SRC_URI += "\ file://CVE-2025-66418.patch \ file://CVE-2026-21441.patch \ + file://CVE-2025-66471.patch \ " DEPENDS += "python3-hatch-vcs-native"