From patchwork Mon Oct 5 09:23:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 99995 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED465CA6004 for ; Mon, 5 Oct 2026 09:23:56 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16132.1791192228644084262 for ; Mon, 05 Oct 2026 02:23:48 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Ssor2DJj; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3589; q=dns/txt; s=iport01; t=1791192228; x=1792401828; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=wpD1Sv+wphFbxMIssDf6pxmxfHDetGjI3YkBAsFIwQQ=; b=Ssor2DJjub49Shlg36pozw/sKrKN+ktTxh3KVpl8qmaOd0NmoSWhnIox E6R/s05db7BNKVkr61qNQhRQHgc2DfkTTR6G2a1nodMhd1AiiEJdu0uI1 5v8CX7AIjlWwr7+MvVgaCcAcgzACiGWR6Oayb4z+7tIeBjBjg9VeMB/u9 HD/h3iTzkB2qmftt2qr+lLdyCVdDblQnBB0GIYJApj3B+Tq02RCPpp/5C Ls4gQbFtRSifZD4OXUDB5cV4TGrUQHyabFFFal/wi0/FxL7f/CTm5bOy4 suh4S9oQTF5OKlkzujE/RfmP8tF+Dag6k2lDQ6aadZh8xoZA5YSLJ9OeF w==; X-CSE-ConnectionGUID: Wiuxby0cThetPiDvI+Na8w== X-CSE-MsgGUID: iZTZ4yNuRbmUnefyONSd5Q== X-IPAS-Result: A0BGAgC3a8Nq/5T/Ja1aglmCV3VhQkmWSotnkjaBfg8BAQEPRA0EAQGEP0aOCwImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECASoLARgBLSwDAQJPCyMhgwIBgjoDNwIBEbUxgXkzgQGDKQE/AkNQ2EsNgloBCxQBBYEzhUCCf4UkXRgBhHwnGxuBcoEVg2mBBYEaQgEBAoE2hm0EgiKBDIFaHpNOSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklRRJHJiIIEgkBExowC4EbODwJKEQXDBAYDUgRLDcVGQQ+bgeQUB6CE00BegkKASoBIoEhQaN9giGgHnEKKIN2jCKPPoV8GjOEBJQXklQLmH2OCoQJkV9ohGmBaDyBRwsHcBWDIglKGQ+OOYNrgX+DFMcmJDUCCTIBAQcCBw4DC4FokAGBfQEB IronPort-Data: A9a23:PaT0kKIgxP3QROwwFE+Rh5QlxSXFcZb7ZxGr2PjKsXjdYENS0TcBy 2ROWDuDaf3fa2anf99yYY3n8kwHsJLUmtBgTQAd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2Yoajh8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1RDVwmN5xA8dp3DH129 NAGCXMrZ0Cc0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVLAtQIvIROPB4towMDUY358VW62BI ZBENHw2MESojx5nYj/7DLo+gOehhXDlWzZZs1mS46Ew5gA/ySQsi+G3YIaFJ4ziqcN9n3Skl D7X2XnDCBQnMtGR2B2jyX7xv7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++NukCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:qNk5NqN2bY1n1cBcTu2jsMiBIKoaSvp037Dk7S9MoHtuA6mlfq +V/cjzuSWYtN9zYgBDpTn/Asm9qBrnnPYfi7X5Vo3NYOCJggeVxahZnO/fKkXbak7D398Y87 t8eK5jD9C1J117gcHmpDScKb8bsb66GGTCv5am85+rJjsaDZ1d0w== X-Talos-CUID: 9a23:Q2YplmM1yNEF6u5DZyh65EQFQssZcnDB9Hb8PW77L285V+jA X-Talos-MUID: 9a23:chJUIg6rHUXDHIlvduLNtQk/xoxp0ZicVFErjK8MvvSCOCJhHBGmgGmOF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,141,1787011200"; d="scan'208";a="531284858" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Oct 2026 09:23:47 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 9397618000140; Mon, 5 Oct 2026 09:23:47 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id BE38DCC1292; Mon, 5 Oct 2026 02:23:46 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH v2 1/8] libxml2: Fix CVE-2026-86137 Date: Mon, 5 Oct 2026 02:23:39 -0700 Message-Id: <20261005092346.1670265-1-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 09:23:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247226 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86137 Signed-off-by: Hetvi Thakar --- Changes in v2 - limit backport changes to 80 characters --- .../libxml/libxml2/CVE-2026-86137.patch | 63 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 64 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch new file mode 100644 index 0000000000..4a22436563 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch @@ -0,0 +1,63 @@ +From a9d489b86e46188d1c0fde7dbd0aa8281596e6d6 Mon Sep 17 00:00:00 2001 +From: Hieu Le Minh +Date: Sat, 18 Apr 2026 21:18:24 +0700 +Subject: [PATCH] xmlregexp: Prevent out-of-bounds read in NXT macro + +Fixes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1099 + +CVE: CVE-2026-86137 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2] + +Backport Changes: +- Add the parser-context length field and allocation-failure guard required by + the Scarthgap 2.12.10 source, which lacks both pieces of the upstream + context. +- The allocation-failure guard is completed by the subsequent + CVE-2026-86141.patch, which moves strlen() after the xmlStrdup() null check; + keep that patch after this one in SRC_URI. + +(cherry picked from commit 76fe08d97de88bfaef2f7d5cd27f11954cc5bee2) +Signed-off-by: Hetvi Thakar +--- + xmlregexp.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/xmlregexp.c b/xmlregexp.c +index f434a0cf..320a35ce 100644 +--- a/xmlregexp.c ++++ b/xmlregexp.c +@@ -56,7 +56,9 @@ + xmlRegexpErrCompile(ctxt, str); + #define NEXT ctxt->cur++ + #define CUR (*(ctxt->cur)) +-#define NXT(index) (ctxt->cur[index]) ++#define NXT(index) \ ++ (((size_t)(ctxt->cur + index - ctxt->string) < ctxt->len) \ ++ ? ctxt->cur[index] : 0) + + #define NEXTL(l) ctxt->cur += l; + #define XML_REG_STRING_SEPARATOR '|' +@@ -245,6 +247,7 @@ typedef xmlRegParserCtxt *xmlRegParserCtxtPtr; + struct _xmlAutomata { + xmlChar *string; + xmlChar *cur; ++ size_t len; + + int error; + int neg; +@@ -698,8 +701,14 @@ xmlRegNewParserCtxt(const xmlChar *string) { + if (ret == NULL) + return(NULL); + memset(ret, 0, sizeof(xmlRegParserCtxt)); +- if (string != NULL) ++ if (string != NULL) { + ret->string = xmlStrdup(string); ++ ret->len = strlen((const char *) ret->string); ++ if (ret->string == NULL) { ++ xmlFree(ret); ++ return(NULL); ++ } ++ } + ret->cur = ret->string; + ret->neg = 0; + ret->negs = 0; diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index d476ba14b6..e4db345af4 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -32,6 +32,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-0992-03.patch \ file://CVE-2026-1757.patch \ file://CVE-2026-11979.patch \ + file://CVE-2026-86137.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Mon Oct 5 09:23:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 99989 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CE22CA5FFF for ; Mon, 5 Oct 2026 09:23:56 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16133.1791192228872231660 for ; Mon, 05 Oct 2026 02:23:49 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=UeykYd6X; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3346; q=dns/txt; s=iport01; t=1791192228; x=1792401828; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=gXHW8rSiFUZKra4+wlt4bwickkJVQNpF7+sPEE6ibo0=; b=UeykYd6XKfFbXAEcmeNRlicPY85J6cK7wqfkB6g9ZpaI9kM6K1e2K6EQ 4RSPw5rFeb5m1QFII/bH7Y56WzoJbq7w2ntkPeekG/nEvb5ASiNsCrN9U YX0DXvKf+q0/FsyB2PkfDKLuZ5xAL3yeyu8EofkcZcw+Pcs+6Hwp3fVKG +ThrdZlaT4/pglO2s86OBvC+Zvn+z2zNGOMwR9wBP9EnF4aBf/e1I/hKW YpkEGeEHZbU9rEviArxrByUAknkZu7jBgcX/c5WDJVl7RKja3A3hvJdwF /mQSJvoZUXKZpQU2TrtcdpGB9FRg07wtrR+Hnv7I6kW37Gy/QaeNli35K Q==; X-CSE-ConnectionGUID: li9eVVuVSD6L9VvK+2fU8Q== X-CSE-MsgGUID: t+pI71z+R6C3NGdZP+IscA== X-IPAS-Result: A0BIAgA6a8Nq/5P/Ja1aHgEBCxIMggULgld1YUJJlkoDi2SSNoF+DwEBAQ9EDQQBAYQ/RgKOCQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMyARgBLRAcAwECLyALIwgZgwIBgjoDNwIBEbU1giyBAYMpAT8CQ1DYSw2CWgELFAEFgTOFQIJ/hSRdGAGEfCcbG4FygRWDaYEFgRpCAQECiCMEgiKBDIFaHpNOSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklRRJHJiIIEgkBExowC4EbODwJKEQXDBAYDUgRLDcVGQQ+bgeQUB6CEzoMB4EOASoBpgGCIaAecQoog3aMIo8+hXwaM6pvC5h9jgqECZJHhGmBaDyBRwsHcBWDIglKGQ+OOYNrgX+DFMcmJDUCCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:qO5tgq4tmFpw6pdYzWHhrQxRtG7GchMFZxGqfqrLsTDasY5as4F+v jRJWG6FPfiKZTDzetlzbd7koEtQvpSAx4diHFM6qng0Zn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpMt/rZwP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eOYxJ99hJHF912 aI8eQ4TTVPZid/m+efuIgVsrpxLwMjDJogTvDRkiDreF/tjGMiFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEQUrsUIMpWcOOAhmX/ej5RsnqepLE85C7YywkZPL3FbYGNJIbXGJ8F9qqej n6F50WmWwNZDoK0khyq/kCUxc7UlgquDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXzBCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1rN94cRva1fApEFI/ IronPort-HdrOrdr: A9a23:msxwya3Yk1M65YtyqO55OAqjBGokLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmoFFebvN5CBB/KXHyTj9Nco8y9+a963tr+Lfw3BxCTxOUchbnn5E4sLxKDwMeOGAbqBJbK ah2g== X-Talos-CUID: 9a23:I4wRq2OygoV71u5DXCg2+XAqB/4eXiP5nUnOAAziB1s5cejA X-Talos-MUID: 9a23://d42Q0tL3axrbuiH7IvrgdlmzUj/+e2KR9Ug9Y85eLfEwN8CQ/erS+8a9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,141,1787011200"; d="scan'208";a="530625528" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Oct 2026 09:23:47 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id BD1CC180008A1; Mon, 5 Oct 2026 09:23:47 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id EFC68CC129C; Mon, 5 Oct 2026 02:23:46 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH v2 2/8] libxml2: Fix CVE-2026-86138 Date: Mon, 5 Oct 2026 02:23:40 -0700 Message-Id: <20261005092346.1670265-2-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261005092346.1670265-1-hthakar@cisco.com> References: <20261005092346.1670265-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 09:23:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247227 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86138 Signed-off-by: Hetvi Thakar --- .../libxml/libxml2/CVE-2026-86138.patch | 52 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch new file mode 100644 index 0000000000..9b918f7570 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch @@ -0,0 +1,52 @@ +From d2e3efc8502313a1099ccc4aac19e8e03734e8c9 Mon Sep 17 00:00:00 2001 +From: mohammadmseet-hue +Date: Thu, 16 Apr 2026 02:54:24 +0200 +Subject: [PATCH] fix: add overflow checks to xmlDictAddQString in dict.c + +xmlDictAddString has overflow guards for pool size calculations, but its +sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1 +addition can overflow unsigned int, and 4 * (overflowed_value) produces +a small allocation, leading to heap buffer overflow when memcpy writes +the prefix and name. + +Add the same SIZE_MAX-based overflow guards and safe size_t cast. + +CVE: CVE-2026-86138 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4] + +(cherry picked from commit a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4) +Signed-off-by: Hetvi Thakar +--- + dict.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/dict.c b/dict.c +index d7156ed3..ae0210ea 100644 +--- a/dict.c ++++ b/dict.c +@@ -225,10 +225,21 @@ xmlDictAddQString(xmlDictPtr dict, const xmlChar *prefix, unsigned int plen, + return(NULL); + } + +- if (size == 0) size = 1000; +- else size *= 4; /* exponential growth */ +- if (size < 4 * (namelen + plen + 1)) +- size = 4 * (namelen + plen + 1); /* just in case ! */ ++ if (size == 0) { ++ size = 1000; ++ } else { ++ if (size < (SIZE_MAX - sizeof(xmlDictStrings)) / 4) ++ size *= 4; /* exponential growth */ ++ else ++ size = SIZE_MAX - sizeof(xmlDictStrings); ++ } ++ if (size / 4 < namelen + plen + 1) { ++ if ((size_t) namelen + plen + 1 < ++ (SIZE_MAX - sizeof(xmlDictStrings)) / 4) ++ size = 4 * ((size_t) namelen + plen + 1); /* just in case ! */ ++ else ++ return(NULL); ++ } + pool = (xmlDictStringsPtr) xmlMalloc(sizeof(xmlDictStrings) + size); + if (pool == NULL) + return(NULL); diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index e4db345af4..28ae601118 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -33,6 +33,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-1757.patch \ file://CVE-2026-11979.patch \ file://CVE-2026-86137.patch \ + file://CVE-2026-86138.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Mon Oct 5 09:23:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 99994 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12CE7CA6005 for ; Mon, 5 Oct 2026 09:23:57 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16132.1791192228644084262 for ; Mon, 05 Oct 2026 02:23:49 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=ILPdHNrB; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=1832; q=dns/txt; s=iport01; t=1791192229; x=1792401829; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=m9Pqos+t6ZOR/C3Ii3yRNMmAvAj50oWo21YSbDPxMWk=; b=ILPdHNrBmcfC1C1m8ffSeqlFWqSg+2sMxL8A05I347sRkZLon9MRCDUE Ais2Sz9YgqPDSJiqRwE+wbQQnQZmNkOwMkwBknZRkQZAh2X0A+az1O62a ydKWE+HgW0mseAjrq26eZ1oX8SeZG7oZ6wbm7fh/KyvmBTZY5EH7dlVzb +VORFb2HF4E8n1oF0/Vn9segpJKk0wHozNeLuDt54Bw2YpW8WJd8qxvow ruN9oAEuHlE/MIRqHVQWgFikjsdnzIFY0/A0+tw+IdvkbslJr/3V98Oh7 n8SUmuasi+MtxjbluE9IbjWdGZGt2IulxF6x2duoqMbEqpuFEWEZXns7o g==; X-CSE-ConnectionGUID: 46gdK/D3Q+2jDlyGJnkbrQ== X-CSE-MsgGUID: mrjPRWcFTVO6EnJ2pAUlVg== X-IPAS-Result: A0BGAgC3a8Nq/5L/Ja1aglmCV3VhQkmWSgOBE50HgX4PAQEBD0QNBAEBhD9GAo4JAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZATAgEDMgEYAS0QIDErKxmDAgGCdAIBEQa1K4IsgQGDKQE/AkNQ2zIBCxQBBYEzhUCII3aEfCcbG4FygRWCc3aBBYFcAQECgiuFeASCIoEMgXiTTkiBHgNZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUUSRyYiCBIJARMaMAuBGzg8CShEFwwQGA1IESw3FRkEPm4HkFAegW1zgQ4sFwkCgWIBk1+DIo8coQ8KKIN2jCKVOhozqm+ZCI4KllCEaYFoPIFHCwdwFYMiCUoZD445g2uBf4MUxyYkNQIBCDIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:qsVjra2xAMX+mQc2OvbD5YVwkn2cJEfYwER7XKvMYLTBsI5bp2dSn GUYWzuHPP2DZWujfYt+O9jl9hhVvMPQzdUyGgFp3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYsbjpOg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGUB85Ma5f1r1OQjtM2 fgJBxILbRqZvrfjqF67YrEEasULNsLnOsYb/3pn1zycVadgSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUieC/FMEg9/5JYWnPuoj3r2aRVTqUmeouw85G27IAlZjeO0aoqJKoHbLSlTtkOCp Fr8wG/XPi89avGZ62Cd20+ouOCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1ffDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:qbEYGqFAa6libM0+pLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:aw+eX2sS43C4BSqZC+aQacA86It5LHLR7zD8eHb7U2RFTKy6a1mT8rldxp8= X-Talos-MUID: 9a23:RlRLFQ2Qz+uZnVtWj65ky5rgCzUj5r6sMHoymrs6he7aGCpSYS+0sTCJTdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,141,1787011200"; d="scan'208";a="531284859" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Oct 2026 09:23:48 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id DAE7A18000211; Mon, 5 Oct 2026 09:23:47 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 49AD1CC12B5; Mon, 5 Oct 2026 02:23:47 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH v2 3/8] libxml2: mark CVE-2026-86139 fixed Date: Mon, 5 Oct 2026 02:23:41 -0700 Message-Id: <20261005092346.1670265-3-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261005092346.1670265-1-hthakar@cisco.com> References: <20261005092346.1670265-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 09:23:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247228 From: Hetvi Thakar The fix for CVE-2026-86139 adds a zero-length guard in xmlURIEscapeStr, as shown in the upstream commit [1]. The libxml2 2.12.10 source already contains the equivalent guard [3], so no additional patch is required. Mark the CVE as fixed in the recipe. [1] https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86139 [3] https://github.com/GNOME/libxml2/blob/v2.12.10/uri.c#L1689-L1700 Signed-off-by: Hetvi Thakar --- Changes in v2 - added xmlURIEscapeStr function url --- meta/recipes-core/libxml/libxml2_2.12.10.bb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 28ae601118..53e8660366 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -46,6 +46,11 @@ CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail # https://gitlab.gnome.org/GNOME/libxml2/-/issues/958 CVE_STATUS[CVE-2025-8732] = "disputed: the code maintainer explains, that the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided. https://gitlab.gnome.org/GNOME/libxml2/-/issues/958" +# The Scarthgap 2.12.10 source already contains the equivalent zero-length +# guard required for the xmlURIEscapeStr integer-overflow issue. +# https://github.com/GNOME/libxml2/blob/v2.12.10/uri.c#L1689-L1700 +CVE_STATUS[CVE-2026-86139] = "fixed-version: xmlURIEscapeStr returns NULL when xmlStrlen returns zero" + BINCONFIG = "${bindir}/xml2-config" PACKAGECONFIG ??= "python \ From patchwork Mon Oct 5 09:23:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 99991 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B35FCA6001 for ; Mon, 5 Oct 2026 09:23:56 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16134.1791192229269951145 for ; Mon, 05 Oct 2026 02:23:49 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=bjfxFJ/n; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3193; q=dns/txt; s=iport01; t=1791192229; x=1792401829; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=tNvc3OU0PD8PB4E0sqombF2QregvsOM5kAbxn9esO8Q=; b=bjfxFJ/ntwLBq9CJr2QjENsicmr4qGO8VHI6LsJdyHTeKQgxm++OM57n neVTn5McSfHA9WU/xB6fkRNp025Kz8SL5Rwa3nJrVju7P7GsKJ4QeQdSJ BYDQCvK0W84cfegX63LYwglXe3ZtwSRsdVn/8pnkOe81pnSCgoCXQpIP2 QiKMX+iJK/vAluuYEcLZkNFdxNWU478EZVIjhRdkpd41q9U3KsmYbc0/l 8qlQu4RBCk+f+mdNTOp11Jpw8ISPSo6ZYnuJVrRwHRX6ESjy0dak2qNh7 Gj8ozbUyzKEof3Q67hcEDCzI99bBzDLXVpEqjTNazh9skhPbXlQyv7juc Q==; X-CSE-ConnectionGUID: ITr+F7SGS8KC9KnmOykIUw== X-CSE-MsgGUID: tOwNL8iwQNyuz+U1TL30dg== X-IPAS-Result: A0BJAgA6a8Nq/4r/Ja1aglmCV3VhQkmWTYtkkjaBfg8BAQEPRA0EAQGEP0YCjgkCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvIAsjCBmDAgGCOgM3AgERtTWBeTOBAYMpAT8CQ1DYSw2CWgELFAEFgTOFQIJ/hSRdGAGEfCcbG4FygRWDaYEFgRpCAQECiCMEgiKBDIFaHpNOSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklRRJHJiIIEgkBExowC4EbODwJKEQXDBAYDUgRLDcVGQQ+bgeQUB6CE02BDgEqAYJOozOCIaAecQoog3aMIo8+hXwaM6pvC5h9jgqECZJHhGmBaDyBRwsHcBWDIglKGQ+OOYNrgX+DFMcmJDUCCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:U+O3yagyUn/3cH/XoyZPoRG+X161NhEKZh0ujC45NGQN5FlHY01je htvDDvTbKqPYGD3et13aNzg80NU75CHzIU1SAs+/31gEStjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/rf8EkHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqU5xvw0Lz512 sdICxtcTRaGoPO14Y+kH7wEasQLdKEHPasFsX1miDWcBvE8TNWbGuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWYQd/5JEWxI9EglH/bz1Rq1uPjaE2+GPUigd21dABNfKIIIfTH5QLwxzwS mTu40PmJDVKNcOm7yuY4DGR39Prxnv3V9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cF3hKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:P2tXu6HK35lXKE5ipLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:dchCcmOiEUTv4O5DeRV9t2BLIe8eIl72nVTWJmipCkdUV+jA X-Talos-MUID: 9a23:3B/9cAbuMaQ3ceBTqxjzohUyNdhRxbWzGgMwyKki4JGIOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,141,1787011200"; d="scan'208";a="523129652" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Oct 2026 09:23:48 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 44368180001C5; Mon, 5 Oct 2026 09:23:48 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 95908CC1273; Mon, 5 Oct 2026 02:23:47 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH v2 4/8] libxml2: Fix CVE-2026-86140 Date: Mon, 5 Oct 2026 02:23:42 -0700 Message-Id: <20261005092346.1670265-4-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261005092346.1670265-1-hthakar@cisco.com> References: <20261005092346.1670265-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 09:23:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247230 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86140 Signed-off-by: Hetvi Thakar --- .../libxml/libxml2/CVE-2026-86140.patch | 56 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch new file mode 100644 index 0000000000..bc7e069b09 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch @@ -0,0 +1,56 @@ +From 7d324fcfa71e8567678ad254c0e10e509ebae99b Mon Sep 17 00:00:00 2001 +From: mohammadmseet-hue +Date: Thu, 16 Apr 2026 02:54:37 +0200 +Subject: [PATCH] fix: add bounds checks to xmlSnprintfElements in valid.c + +CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat() +writes, but the sibling function xmlSnprintfElements has the identical +unfixed pattern. The strcat(buf, "(") before the while loop and +strcat(buf, ")") after the loop exit have no bounds checks. + +Add remaining-space checks before both strcat calls, with early return +and ellipsis when space is insufficient. + +CVE: CVE-2026-86140 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340] + +(cherry picked from commit d1686f91dbda141a752200419d35639fd6b38340) +Signed-off-by: Hetvi Thakar +--- + valid.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/valid.c b/valid.c +index ae4bb822..718e6d85 100644 +--- a/valid.c ++++ b/valid.c +@@ -5047,7 +5047,15 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + int len; + + if (node == NULL) return; +- if (glob) strcat(buf, "("); ++ len = strlen(buf); ++ if (glob) { ++ if (size - len < 50) { ++ if ((size - len > 4) && (buf[len - 1] != '.')) ++ strcat(buf, " ..."); ++ return; ++ } ++ strcat(buf, "("); ++ } + cur = node; + while (cur != NULL) { + len = strlen(buf); +@@ -5111,7 +5119,11 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + } + cur = cur->next; + } +- if (glob) strcat(buf, ")"); ++ if (glob) { ++ len = strlen(buf); ++ if (size - len > 1) ++ strcat(buf, ")"); ++ } + } + + /** diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 53e8660366..98a3e3ce36 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -34,6 +34,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-11979.patch \ file://CVE-2026-86137.patch \ file://CVE-2026-86138.patch \ + file://CVE-2026-86140.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Mon Oct 5 09:23:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 99990 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F85ECA5FFD for ; Mon, 5 Oct 2026 09:23:56 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16135.1791192229326238163 for ; Mon, 05 Oct 2026 02:23:49 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=IezUgGR4; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2630; q=dns/txt; s=iport01; t=1791192229; x=1792401829; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=CIZjcM8/TiDFNY6aP0bkmvfhSevvH34tS1CkMRrI3AM=; b=IezUgGR4G8A9Q08e1yE+ddqhcrpaUSytU06KfY9IEldYq7TeyEDi32/L FDFDPlzkbzkYUKHi9mxcJihKmDpZ6WCH2oF+OAyTUOoCS03OfyN7hC2/F Hq2GNnj+5nNFlIlaMfrn0fQl9EAL77Hbmh88F8CtuoYkm/g6Eh1GOOGgU Q6qc4vGIMr+/L5c+2SiCPgj7Cfpbz6tNYEdkTTwfaWaXh5VDEk73hpD5L SLJghFGswqLGPsoj3nmr4UIcMwGLKXQ0CXmgSn5sd7vURM/NzX+Z13sw2 jZySGIWs9GQDrPiBOdCsLATTpcDUrt+Ubz+oMJ8LMJfNQGVvVaOgXywjs g==; X-CSE-ConnectionGUID: q6H0p13RRB+tRlRY1dxajg== X-CSE-MsgGUID: Ja8BJJxNSHy7SGg26bghTA== X-IPAS-Result: A0BNAgA+bMNq/4r/Ja1aglmCV3VhQkmWTZoWhASBfg8BAQEPRA0EAQGEP0YCjgkCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AgERtTGBeTOBAYMpAT8CQ1DbMgELFAEFgTOFQIgjXRgBhHwnGxuBcoEVg2mBBYFcAQECgiuFeASCIoEMgVoek05IgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVFEkcmIggSCQETGjALgRs4PAkoRBcMEBgNSBEsNxUZBD5uB5BQHoITTYEOASoBpgGCIaEPCiiDdowilToaM6pvC5h9igspg1aWUIRpgWg8gUcLB3AVgyIJShkPjjmDa4F/gxTHJiQ1AgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:DjFnraAA5cGTPhVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApD4g02dUz WpNWWyPOP3fZjDzc9gjOoi+8UsOvp6Az4VgOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQf9h2YuWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE2qtOVFlvZrci0KVrO2V0x KUUODkPYUXW7w626OrTpuhEnM8vKozveYgYoHwllWifBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGE/BPjDS0Un1lM/CI4+leShnFH0ciZTrxSeoq9fD237kVcoiuO1aIaPEjCMbedczmy6h HLgxEToXSo1O4bBwzWFzlv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvOS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6dV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:qdsJN6F8tSKTqRg5pLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:Q9uzZGgKVIotlp74HIBxWqYSvDJuayP9lG+JeHWCIyV1crmveAac6KpmnJ87 X-Talos-MUID: 9a23:QDffoQZYVbpuXeBTlTa8rhNAJOFTw7XxM28Cy8sMtMm4HHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,141,1787011200"; d="scan'208";a="531230042" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Oct 2026 09:23:48 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 5B600180002B6; Mon, 5 Oct 2026 09:23:48 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id E1188CC1292; Mon, 5 Oct 2026 02:23:47 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH v2 5/8] libxml2: Fix CVE-2026-86141 Date: Mon, 5 Oct 2026 02:23:43 -0700 Message-Id: <20261005092346.1670265-5-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261005092346.1670265-1-hthakar@cisco.com> References: <20261005092346.1670265-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 09:23:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247231 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86141 Signed-off-by: Hetvi Thakar --- .../libxml/libxml2/CVE-2026-86141.patch | 35 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch new file mode 100644 index 0000000000..416a50eda5 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch @@ -0,0 +1,35 @@ +From adb9287ae35770d9b281ed8f2160774198fbaf25 Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Mon, 4 May 2026 07:56:18 +0200 +Subject: [PATCH] xmlregexp: Calc string length after null checking + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107 + +CVE: CVE-2026-86141 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55] + +(cherry picked from commit e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55) +Signed-off-by: Hetvi Thakar +--- + xmlregexp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/xmlregexp.c b/xmlregexp.c +index 320a35ce..72e8e459 100644 +--- a/xmlregexp.c ++++ b/xmlregexp.c +@@ -702,12 +702,12 @@ xmlRegNewParserCtxt(const xmlChar *string) { + return(NULL); + memset(ret, 0, sizeof(xmlRegParserCtxt)); + if (string != NULL) { +- ret->string = xmlStrdup(string); +- ret->len = strlen((const char *) ret->string); ++ ret->string = xmlStrdup(string); + if (ret->string == NULL) { + xmlFree(ret); + return(NULL); + } ++ ret->len = strlen((const char *) ret->string); + } + ret->cur = ret->string; + ret->neg = 0; diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 98a3e3ce36..240e8fe670 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -35,6 +35,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-86137.patch \ file://CVE-2026-86138.patch \ file://CVE-2026-86140.patch \ + file://CVE-2026-86141.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Mon Oct 5 09:23:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 99993 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82C58CA6003 for ; Mon, 5 Oct 2026 09:23:56 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16133.1791192228872231660 for ; Mon, 05 Oct 2026 02:23:49 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Z3JHCE1f; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2892; q=dns/txt; s=iport01; t=1791192229; x=1792401829; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=YbvEYg8TC0HWh0dA/x3iLMSyl7iJ8mGtEGLlEVBDxak=; b=Z3JHCE1f7bR64M08sOl7Oy2iOqnuojgI9vtCLjNP/oPpVGe2pqvfaoIk BlBRShWNJdn0EAkZNPr5bGeIza8wNSDgCXThyzrSzpwUyQHq0dp4STAG6 dedYNpkElB13Ec+BykR1G+LrQNjWz6y5AUt++TIpAfcwDy0iy79D1DFXa spAEP8YtG4+fD+FvJ5A7XqzvZ/rJNReHm6gccoFSiL7qcwCrlHiby+DFU ugxItj3z2J2z7PNlnnCzCDgIulHDC1aniM6tR5jkwqBW9TpnoV4TUpCOs dNdkRvYUDMmTT0kM+zgS0xy+/vXaxuwzC55hCR8kpmJf4hkjlT2DssyDJ A==; X-CSE-ConnectionGUID: eNOMHENwTECIl7YdNpubNw== X-CSE-MsgGUID: 8UJwV8cgS2uUNEtmw3q3Yg== X-IPAS-Result: A0BNAgA6a8Nq/5H/Ja1aglmCV3VhQkmWSgOaFoQEgX4PAQEBD0QNBAEBhD9GAo4JAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAIBEbU1gXkzgQGDKQE/AkNQ2zIBCxQBBYEzhUCII10YAYR8JxsbgXKBFYNpgQWBXAEBAoE2dYV4BIIigQyBWh6TTkiBHgNZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUUSRyYiCBIJARMaMAuBGzg8CShEFwwQGA1IESw3FRkEPm4HkFAeghNNAXoJCgEqAYFalAqQHYIhoQ8KKIN2jCKVOhozqm8LmH2KC4N/llCEaYFoPIFHCwdwFYMiCUoZD445g2uBf4MUxyYkNQIJMgEBBwIHDgMLgWiQAYF9AQE IronPort-Data: A9a23:UheJa6qm0290/N9zP0zP2E5KWvVeBmJOZBIvgKrLsJaIsI4StFCzt garIBnSMveIN2LxeNt+O4yx9x8PvpDcmIUxTVBvrHhmFiIUoOPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8E835pwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0utRJkRu2 NoHFB0mTxTctu6Q2K+xbPY506zPLOGzVG8ekmtrwTecCbMtRorOBv2ao9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LVfrSn8/w7pX7Wz1EqFuWrLAf6GnIxws327/oWDbQUoHRHZsPwxvD+ woq+UypPzMFCoyUxgHf70+Kq/PKgnjiA7MdQejQGvlCxQf7KnYoIBoOWF22pPO0hkKzV5dUL FYZ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YRLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWra1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:eobiIKDRfjB/0FDlHel055DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygd179 YHT0EHMqySMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ASV0mlhD0JcTpy1SZNNXF7OaY= X-Talos-CUID: 9a23:qfkjGG8Eued4GnGviQGVv0MyPeUFX1vC8Fr7AkvnOGpPUKCfb0DFrQ== X-Talos-MUID: 9a23:aGQQUA/MlxaMeCCYctrSSXuQf5dVwbuQWEsCqs8bhu+pKSlvYC7GvTviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,141,1787011200"; d="scan'208";a="530625535" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Oct 2026 09:23:48 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id B6E21180001C1; Mon, 5 Oct 2026 09:23:48 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 4FE36CC129C; Mon, 5 Oct 2026 02:23:48 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH v2 6/8] libxml2: Fix CVE-2026-86142 Date: Mon, 5 Oct 2026 02:23:44 -0700 Message-Id: <20261005092346.1670265-6-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261005092346.1670265-1-hthakar@cisco.com> References: <20261005092346.1670265-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 09:23:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247229 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86142 Signed-off-by: Hetvi Thakar --- Changes in v2 - limit backport changes to 80 characters --- .../libxml/libxml2/CVE-2026-86142.patch | 40 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch new file mode 100644 index 0000000000..3308188649 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch @@ -0,0 +1,40 @@ +From 51f0e78349cbbc9081f14e02f440733e5880fb3d Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Mon, 4 May 2026 09:32:43 +0200 +Subject: [PATCH] xpointer: Check overflow in xmlXPtrEvalXPtrPart + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113 + +CVE: CVE-2026-86142 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58] + +Backport Changes: +- Use xmlXPathErr(ctxt, XPATH_MEMORY_ERROR) because the Scarthgap xpointer + implementation does not provide the newer xmlXPathPErrMemory() call shape. + This preserves the XPath parser error state as well as reporting the + allocation failure. + +(cherry picked from commit 6b3a736c0edc74ceec3d82f5252499d7911b3a58) +Signed-off-by: Hetvi Thakar +--- + xpointer.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/xpointer.c b/xpointer.c +index 6e1e5f46..f5457c9f 100644 +--- a/xpointer.c ++++ b/xpointer.c +@@ -956,6 +956,13 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) { + level = 1; + + len = xmlStrlen(ctxt->cur); ++ /* Overflow in xmlStrlen */ ++ if (len == 0 && ctxt->cur != NULL && *ctxt->cur != 0) { ++ xmlXPathErr(ctxt, XPATH_MEMORY_ERROR); ++ xmlFree(name); ++ return; ++ } ++ + len++; + buffer = (xmlChar *) xmlMallocAtomic(len); + if (buffer == NULL) { diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 240e8fe670..ec4b41bde5 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -36,6 +36,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-86138.patch \ file://CVE-2026-86140.patch \ file://CVE-2026-86141.patch \ + file://CVE-2026-86142.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Mon Oct 5 09:23:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 99992 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A186ECA6002 for ; Mon, 5 Oct 2026 09:23:56 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.16183.1791192229840090796 for ; Mon, 05 Oct 2026 02:23:50 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=HIbBXFGy; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4758; q=dns/txt; s=iport01; t=1791192229; x=1792401829; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=RS6467yJbRugOeSNowLLrGg5k1ipLxzkosyB7h7oeFU=; b=HIbBXFGypEKDmg1CAf2K3ylGa3iIO97ZoSN+1UaQnmrYud14kfO5nr1J gNXRxrAxEohupJFMfndYjkXaNDm+pcwaSKWdKfzMl8EozMKdL+Axh9hDH PrV8Tu6opsu62osdbe8FWwHOcNc/mpKpbKiFJV6L22fEKpRrch6GipuoW kYCeYfngyzLrDaE5J1T8UPghySrgfxa7L50X+rAxqE+S4P15ggLne4e5C Dd3VbjF1X/+tHXK9vaPPUSjtEDKLJ6dJ+8YTu0GYf89J6/bcMJBw02myF LAJijNknH2quiCrjtmcQjli8rVqyLaNIOl0pJS9ECoj1y2+SVrJgrPmV2 Q==; X-CSE-ConnectionGUID: WQzBg7l9SBiGPzQNI69kDg== X-CSE-MsgGUID: faqLVf8zQDqeY/3hEDpVkA== X-IPAS-Result: A0BNAgC3a8Nq/47/Ja1aglmCV3VhQkmWSgOaFoQEgX4PAQEBD0QNBAEBhD9GAo4JAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAIBEbUxgXkzgQGDKQE/AkNQ2zIBCxQBBYEzhUCII10YAYR8JxsbgXKBFYNpgQWBXAEBAoE2hm0EgiKBDIFaHpNOSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklRRJHJiIIEgkBExowC4EbODwJKEQXDBAYDUgRLDcVGQQ+bgeQUB6CE0wBATw+EwEqAYEFUIEloweCIaEPCiiDdowilToaM6pvC5h9igspg1aWUIRpgWg8gUcLB3AVgyIJShkPjjmDa4F/gxTHJiQ1AgkyAQEHAgcOAwuBaJABgX0BAQ IronPort-Data: A9a23:3acuza4Svi7M6+XBdGSJAQxRtG7GchMFZxGqfqrLsTDasY5as4F+v mAXCmGDaPfca2Ohc9p2bdjg/UkG6seHzddrHVRr+39nZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpMt/rZwP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eArQK0OkoBTB13 /03ECI0SDHd1uGaz+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGc2FSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEVUrsUIMpWcOOAhmX/ej5RsnqepLE85C7YywkZPL3FbYOKIoHQH5kN9qqej mzP5kDHDEEIDfCGxAvCqXKBqvfxngquDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjVCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1r994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:PfquHajU0XmNLLWeOj+mLZlLgnBQXgIji2hC6mlwRA09TyVXra +TdZMgpHjJYVkqOU3I9ersBEDEewK/yXcX2/h0AV7dZmnbUQKTRekIh7cKgQeQfhEWndQy6U 4PScRD4fTLfD5HZL7BkWqFOudl5sWb+6a1guqb5XJsQQZ2L5xE1W5Ce3+m+okcfng8OXL/f6 DsnvZ6mw== X-Talos-CUID: 9a23:tpUoqGAuVNS2/EX6ExZe5mQbRcR0SVfc40/CGmmZVzdqZLLAHA== X-Talos-MUID: 9a23:FkzOFwrOU4Qd1hNSSgwezz9rLeNW7fS8MWwUnKRB4MmpGTROOB7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,141,1787011200"; d="scan'208";a="517052240" Received: from rcdn-l-core-05.cisco.com ([173.37.255.142]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Oct 2026 09:23:49 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-05.cisco.com (Postfix) with ESMTPS id D842418000232; Mon, 5 Oct 2026 09:23:48 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 76189CC1292; Mon, 5 Oct 2026 02:23:48 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH v2 7/8] libxml2: Fix CVE-2026-86143 Date: Mon, 5 Oct 2026 02:23:45 -0700 Message-Id: <20261005092346.1670265-7-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261005092346.1670265-1-hthakar@cisco.com> References: <20261005092346.1670265-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: rcdn-l-core-05.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 09:23:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247232 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86143 Signed-off-by: Hetvi Thakar --- Changes in v2 - limit backport changes to 80 characters --- .../libxml/libxml2/CVE-2026-86143.patch | 96 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 97 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch new file mode 100644 index 0000000000..98335f88fb --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch @@ -0,0 +1,96 @@ +From 83259eee08067b547d2aaedd436504939b2c343b Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Mon, 4 May 2026 09:54:34 +0200 +Subject: [PATCH] xmlIO: Check for int overflow before calling writecallback + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111 + +CVE: CVE-2026-86143 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35] + +Backport Changes: +- Change nbchars to size_t in both Scarthgap write functions before assigning + the size_t result of xmlBufUse(). Add the INT_MAX guard to both + xmlOutputBufferWrite() callback paths. The upstream commit assumes earlier + refactoring that changed nbchars to size_t and routed + xmlOutputBufferWriteEscape() through the protected write path; the existing + flush guards are retained. + +(cherry picked from commit 90f293ba74d28b1d570920382e707586f68ebf35) +Signed-off-by: Hetvi Thakar +--- + xmlIO.c | 26 ++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +diff --git a/xmlIO.c b/xmlIO.c +index 95d27157..de227d8c 100644 +--- a/xmlIO.c ++++ b/xmlIO.c +@@ -3318,7 +3318,7 @@ + */ + int + xmlOutputBufferWrite(xmlOutputBufferPtr out, int len, const char *buf) { +- int nbchars = 0; /* number of chars to output to I/O */ ++ size_t nbchars = 0; /* number of chars to output to I/O */ + int ret; /* return from function call */ + int written = 0; /* number of char written to I/O so far */ + int chunk; /* number of byte current processed from buf */ +@@ -3378,6 +3378,10 @@ + if ((nbchars < MINLEN) && (len <= 0)) + goto done; + ++ if (nbchars >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + /* + * second write the stuff to the I/O channel + */ +@@ -3487,7 +3491,7 @@ + int + xmlOutputBufferWriteEscape(xmlOutputBufferPtr out, const xmlChar *str, + xmlCharEncodingOutputFunc escaping) { +- int nbchars = 0; /* number of chars to output to I/O */ ++ size_t nbchars = 0; /* number of chars to output to I/O */ + int ret; /* return from function call */ + int written = 0; /* number of char written to I/O so far */ + int oldwritten=0;/* loop guard */ +@@ -3572,6 +3576,10 @@ + if ((nbchars < MINLEN) && (len <= 0)) + goto done; + ++ if (nbchars >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + /* + * second write the stuff to the I/O channel + */ +@@ -3667,15 +3675,25 @@ + */ + if ((out->conv != NULL) && (out->encoder != NULL) && + (out->writecallback != NULL)) { ++ size_t bufsize = xmlBufUse(out->conv); ++ if (bufsize >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + ret = out->writecallback(out->context, + (const char *)xmlBufContent(out->conv), +- xmlBufUse(out->conv)); ++ bufsize); + if (ret >= 0) + xmlBufShrink(out->conv, ret); + } else if (out->writecallback != NULL) { ++ size_t bufsize = xmlBufUse(out->buffer); ++ if (bufsize >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + ret = out->writecallback(out->context, + (const char *)xmlBufContent(out->buffer), +- xmlBufUse(out->buffer)); ++ bufsize); + if (ret >= 0) + xmlBufShrink(out->buffer, ret); + } diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index ec4b41bde5..1363beba7a 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -37,6 +37,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-86140.patch \ file://CVE-2026-86141.patch \ file://CVE-2026-86142.patch \ + file://CVE-2026-86143.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Mon Oct 5 09:23:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 99988 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08F9CCA5FCE for ; Mon, 5 Oct 2026 09:23:55 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.16184.1791192230137299284 for ; Mon, 05 Oct 2026 02:23:50 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Blf4sKIw; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9507; q=dns/txt; s=iport01; t=1791192230; x=1792401830; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=JG19SmV7Y+sY7jV0hVvWm8f/dfMcrxDGCHF0M9T7E5Y=; b=Blf4sKIwEmIYSmc9ziPpojE/J08cPBb6rQ2enihBSL3T6kLwKVPB5SD0 glOLI+xyikPhJWKQhIb0qlmTTInjxcEdUW6v6JB+aLxptdaYSTJPPeGYw GuMRpzmXFTAhmdlHubnVeOL9Rp6Gbdw2sQrRYSdREG90hOuhP8hSLQtUq tytT9UesfrvXvBDS+VnMt+bu6Y0htqpWMaYsYJ6cgrCPh7Sg1sG5DgTvY LeDUqHXgydNApzCUgzcHpi0ZG2QnaTDGmkJD7YQecOzYxaj2xpDQwm9bC hTnqhg7jotVLsrri6WXEEUqRyirHl9gxjlGfpEuUVpMXoYaVEQbB14W1U Q==; X-CSE-ConnectionGUID: gszlBoUpR72sqiqKkBEQxQ== X-CSE-MsgGUID: 0qLiXRv9QNGTxeERc2Ccaw== X-IPAS-Result: A0BIAgA6a8Nq/43/Ja1aHgEBCxIMggULgld1YUJJlkoDgROdB4F+DwEBAQ9EDQQBAYQ/RgKOCQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQCARG1NYF5M4EBgykBPwJDUNsyAQsUAQWBM4VAiCNdGAFEhDgnGxuBcoEVgTuBOHaBBYFcAQECgTaGbQSCIoEMgVoek05IgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVFEkcmIggSCQETGjALgRs4PAkoRBcMEBgNSBEsNxUZBD5uB5BQHoITLRkHAXoTASgCAReBHYEyknSQJ4IhgTWfWgoog3aMIpU6GjOqbwuYfY4KlTSBHIRpgWg8gUcLB3AVgyIJShkPjjmDa4F/gxTHJiQ1AgkyAQEHAgcOAwuBaJABgX0BAQ IronPort-Data: A9a23:/uZYrK8aGURmPo8jbcvRDrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3z WcZCDzUPviPZTbxLdsiPd/j8h4F7MCGndMxGgJlrylEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajpIs/jrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k5Jp8c0OFKGVsRr +cBKSkubTquvvKPlefTpulE3qzPLeHxN48Z/3UlxjbDALN+HdbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0Qn1lQ/UPrSmM+omnn2cDRCgFmUvqEwpWPUyWSd1ZCwa4OIJofWHpg9ckCw/ nvi/lTDHEAjEvOj2TeoyHn2reTGgnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWi4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:n885oKEQFZ7b5mN4pLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:pwWlvmzXID1ZHBTSux/FBgUbAdIhWHrg1E2PeVShCH9KS5e4cE+prfY= X-Talos-MUID: 9a23:n9Z7qwxJjLuEobHEHg52hlpsksWaqPy3LEE9q4tXgu+rCTx9Fg2W1h+8S5Byfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,141,1787011200"; d="scan'208";a="531543435" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Oct 2026 09:23:49 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 1691C180001A0; Mon, 5 Oct 2026 09:23:49 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id A031DCC12B5; Mon, 5 Oct 2026 02:23:48 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH v2 8/8] libxml2: Fix CVE-2026-86144 Date: Mon, 5 Oct 2026 02:23:46 -0700 Message-Id: <20261005092346.1670265-8-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261005092346.1670265-1-hthakar@cisco.com> References: <20261005092346.1670265-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 09:23:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247233 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86144 Signed-off-by: Hetvi Thakar --- Changes in v2 - limit backport changes to 80 characters --- .../libxml/libxml2/CVE-2026-86144.patch | 225 ++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 226 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch new file mode 100644 index 0000000000..77dd2a07e2 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch @@ -0,0 +1,225 @@ +From 8d0c6eb94f8a32a49e3c9122a6da82c519198063 Mon Sep 17 00:00:00 2001 +From: Ruben Thijssen +Date: Fri, 15 May 2026 15:42:18 +1000 +Subject: [PATCH] fix(xinclude): propagate parseFlags in xmlXIncludeProcess and + xmlXIncludeProcessTree + +CVE: CVE-2026-86144 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61] + +Backport Changes: +- Use xmlLoadExternalEntity() with xmlCtxtUseOptions() because Scarthgap + 2.12.10 predates xmlLoadResource() and resource-loader callbacks. +- Adapt the regression tests for 2.12.10 by using the global structured-error + handler, matching 2.12.10 loader network-entity diagnostics, and restoring + the test handler after xmlXIncludeProcess(). +- Omit the upstream XML_IO_NETWORK_ATTEMPT filter because the 2.12.10 + xmlLoadExternalEntity() path has no corresponding post-load error-filtering + block. +- Add a parser-context allocation guard because the target version can return + NULL from xmlNewParserCtxt(). + +(cherry picked from commit b63cd517afecb76582dd9488c55e54ceaf50de61) +Signed-off-by: Hetvi Thakar +--- + result/XInclude/issue1120-1.xml | 4 ++ + result/XInclude/issue1120-1.xml.err | 1 + + result/XInclude/issue1120-2.xml | 4 ++ + result/XInclude/issue1120-2.xml.err | 1 + + runtest.c | 75 +++++++++++++++++++++++++ + test/XInclude/issue1120/issue1120-1.xml | 6 ++ + test/XInclude/issue1120/issue1120-2.xml | 6 ++ + xinclude.c | 9 ++- + 8 files changed, 104 insertions(+), 2 deletions(-) + create mode 100644 result/XInclude/issue1120-1.xml + create mode 100644 result/XInclude/issue1120-1.xml.err + create mode 100644 result/XInclude/issue1120-2.xml + create mode 100644 result/XInclude/issue1120-2.xml.err + create mode 100644 test/XInclude/issue1120/issue1120-1.xml + create mode 100644 test/XInclude/issue1120/issue1120-2.xml + +diff --git a/result/XInclude/issue1120-1.xml b/result/XInclude/issue1120-1.xml +new file mode 100644 +index 00000000..5d83cc96 +--- /dev/null ++++ b/result/XInclude/issue1120-1.xml +@@ -0,0 +1,4 @@ ++ ++ ++ Network access is not allowed ++ +diff --git a/result/XInclude/issue1120-1.xml.err b/result/XInclude/issue1120-1.xml.err +new file mode 100644 +index 00000000..c134bed1 +--- /dev/null ++++ b/result/XInclude/issue1120-1.xml.err +@@ -0,0 +1 @@ ++I/O error : Attempt to load network entity http://example.invalid/file.txt +diff --git a/result/XInclude/issue1120-2.xml b/result/XInclude/issue1120-2.xml +new file mode 100644 +index 00000000..af5bde91 +--- /dev/null ++++ b/result/XInclude/issue1120-2.xml +@@ -0,0 +1,4 @@ ++ ++ ++

Network access is not allowed

++ +diff --git a/result/XInclude/issue1120-2.xml.err b/result/XInclude/issue1120-2.xml.err +new file mode 100644 +index 00000000..051f5928 +--- /dev/null ++++ b/result/XInclude/issue1120-2.xml.err +@@ -0,0 +1 @@ ++I/O error : Attempt to load network entity http://example.invalid/file.xml +diff --git a/runtest.c b/runtest.c +index e91e2dfd..297cb5e2 100644 +--- a/runtest.c ++++ b/runtest.c +@@ -2444,6 +2444,75 @@ noentParseTest(const char *filename, const char *result, + return(res); + } + ++#ifdef LIBXML_XINCLUDE_ENABLED ++/** ++ * Parse a file and run xmlXIncludeProcess() to verify that doc->parseFlags ++ * is propagated properly. ++ * ++ * @param filename the file to parse ++ * @param result the file with expected result ++ * @param err the file with error messages ++ * @returns 0 in case of success, an error code otherwise ++ */ ++static int ++xincludeProcessTest(const char *filename, const char *result, const char *err, ++ int options) { ++ xmlParserCtxtPtr ctxt; ++ xmlDocPtr doc; ++ xmlChar *base = NULL; ++ int size, res; ++ int ret = 0; ++ ++ nb_tests++; ++ ++ /* Create a new parser context */ ++ ctxt = xmlNewParserCtxt(); ++ if (ctxt == NULL) ++ return(-1); ++ ++ /* Load the data from `filename` into a parser context */ ++ xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); ++ doc = xmlCtxtReadFile(ctxt, filename, NULL, options); ++ xmlFreeParserCtxt(ctxt); ++ ++ /* Check if `doc` was created successfully */ ++ if (doc == NULL) { ++ testErrorHandler(NULL, "%s : failed to parse\n", filename); ++ return(-1); ++ } ++ ++ /* ++ * Run xmlXIncludeProcess() with a structured error handler to check that ++ * the parse flags are propagated. ++ */ ++ xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); ++ xmlXIncludeProcess(doc); ++ xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); ++ ++ /* Check the result and for any errors */ ++ if (result) { ++ xmlDocDumpMemory(doc, &base, &size); ++ res = compareFileMem(result, (char *) base, size); ++ xmlFree(base); ++ if (res != 0) { ++ fprintf(stderr, "Result for %s failed in %s\n", filename, result); ++ ret = -1; ++ } ++ } ++ ++ if ((ret == 0) && (err != NULL)) { ++ res = compareFileMem(err, testErrors, testErrorsSize); ++ if (res != 0) { ++ fprintf(stderr, "Error for %s failed\n", filename); ++ ret = -1; ++ } ++ } ++ ++ xmlFreeDoc(doc); ++ return(ret); ++} ++#endif ++ + /** + * errParseTest: + * @filename: the file to parse +@@ -5134,6 +5203,12 @@ testDesc testDescriptions[] = { + { "XInclude regression tests without reader", + errParseTest, "./test/XInclude/without-reader/*", "result/XInclude/", "", + ".err", XML_PARSE_XINCLUDE }, ++ { "XInclude issue1120 regression tests", ++ errParseTest, "./test/XInclude/issue1120/*", "result/XInclude/", "", ++ ".err", XML_PARSE_XINCLUDE | XML_PARSE_NONET }, ++ { "XInclude xmlXIncludeProcess() issue1120 regression tests", ++ xincludeProcessTest, "./test/XInclude/issue1120/*", "result/XInclude/", ++ "", ".err", XML_PARSE_NONET }, + #endif + #ifdef LIBXML_XPATH_ENABLED + #ifdef LIBXML_DEBUG_ENABLED +diff --git a/test/XInclude/issue1120/issue1120-1.xml b/test/XInclude/issue1120/issue1120-1.xml +new file mode 100644 +index 00000000..b0b8feef +--- /dev/null ++++ b/test/XInclude/issue1120/issue1120-1.xml +@@ -0,0 +1,6 @@ ++ ++ ++ ++ Network access is not allowed ++ ++ +diff --git a/test/XInclude/issue1120/issue1120-2.xml b/test/XInclude/issue1120/issue1120-2.xml +new file mode 100644 +index 00000000..b4c9fe5e +--- /dev/null ++++ b/test/XInclude/issue1120/issue1120-2.xml +@@ -0,0 +1,6 @@ ++ ++ ++ ++

Network access is not allowed

 ++ ++ +diff --git a/xinclude.c b/xinclude.c +index b6581558..0d57f5a1 100644 +--- a/xinclude.c ++++ b/xinclude.c +@@ -1688,6 +1688,11 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, + * Load it. + */ + pctxt = xmlNewParserCtxt(); ++ if (pctxt == NULL) { ++ xmlXIncludeErrMemory(ctxt, ref->elem, NULL); ++ goto error; ++ } ++ xmlCtxtUseOptions(pctxt, ctxt->parseFlags); + inputStream = xmlLoadExternalEntity((const char*)URL, NULL, pctxt); + if(inputStream == NULL) + goto error; +@@ -2416,7 +2421,7 @@ xmlXIncludeProcessFlags(xmlDocPtr doc, int flags) { + */ + int + xmlXIncludeProcess(xmlDocPtr doc) { +- return(xmlXIncludeProcessFlags(doc, 0)); ++ return(xmlXIncludeProcessFlags(doc, doc ? doc->parseFlags : 0)); + } + + /** +@@ -2461,7 +2466,7 @@ xmlXIncludeProcessTreeFlags(xmlNodePtr tree, int flags) { + */ + int + xmlXIncludeProcessTree(xmlNodePtr tree) { +- return(xmlXIncludeProcessTreeFlags(tree, 0)); ++ return(xmlXIncludeProcessTreeFlags(tree, (tree && tree->doc) ? tree->doc->parseFlags : 0)); + } + + /** diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 1363beba7a..5e4cabbf5d 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -38,6 +38,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-86141.patch \ file://CVE-2026-86142.patch \ file://CVE-2026-86143.patch \ + file://CVE-2026-86144.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"