From patchwork Tue Oct 13 04:39:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100537 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 077E0CC6B03 for ; Tue, 13 Oct 2026 04:40:31 +0000 (UTC) Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.359.1791866420511910827 for ; Mon, 12 Oct 2026 21:40:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=EVa31YO5; spf=pass (domain: gmail.com, ip: 209.85.215.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-cd61cef87f1so21597a12.0 for ; Mon, 12 Oct 2026 21:40:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866420; x=1792471220; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Q5SQBJTrK6/1j3bU8KsixfJhb7T+dkT8VhDHmqHBiIs=; b=EVa31YO5o5sMdZSTL6ha6KFREqsyfLmGZjOUt8hXYX33mBwK27TFR0YSXlAwSOECjL +lG1/wiDUeRrraSL/M+sVPwJUe40TBIO3P22OALXfMPBt/Cmvym7bLl6voOFLnbljHwv u+XZ2Z7jO3o9eADbTFGYSlFcvVmtC8UwzMxpNUpGraVZR8wqP7Yf1QF240IKKEQnofhj 6e+layrQnkIT4USKFi4EsMPV77vlBlbeP6fuvI0Xm93+kEX/qX9Jb25QLz9+WAgR+K9T BmiCwGMeiBeRZWoo9XXaKVxTswGC9bfxDtjjIGgz4KsL/1iNbvF9rZQ2QZGG8FANqGVq q0mQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866420; x=1792471220; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Q5SQBJTrK6/1j3bU8KsixfJhb7T+dkT8VhDHmqHBiIs=; b=l2vhIUj5yCQaAoexkwmg0xztF8lpEfWuXp2O9XMTxo4rIXuQS23CYg+8Nf07xwaSCW stwAG1+BAQ83iUcV17T0Enc66fPmY+nkZB/RGIOk6g93qg6pEZOHhN3+8RFt1VsVQSMr GeoKg6Xfx25zGcZCj1K/uSP8JnfmdwPG2HnQ36i1KRPHGksSf45RC7XEh4eFv4/1LnUF ngbkmz1MYSO8WORlRi84MH9WODxtqUnTuJTlN81uA7w4PbJxdsGzSsiWOH1pJeszt+Ls twJGIlnNV2MfLDBkAaDqDFumdBXFmTiTqLlYcW2gxhttefIi01WyYEOvk6Jf7+NxIcjC WnnA== X-Gm-Message-State: AFq9FYJQl2i8Nk/CSdUXgSMzYfc47eCxnvzHcgijgpfAOTy6ja7vhLuP itCTOAW5gtgp9NBxYqL2lfQ4FbZoLpvjN0I8m7LeOGXqjdZ+xb7p5bvjbgRo1A== X-Gm-Gg: AYBFou1bzvc3wEd4oIFnZkzQETwYe8S9+7b+y2HsD1RaqaNI3iqX7rB0zfLoZPBvSTU LMSN3tYVj0QyviudnEaiv6IFQS3IIKa52aREcn0nsCPc4mH3jMepHdj2XLhH/tEftk0xQhdWk5D 94JiU2M69UUF+AfmoeDWNbFSQReSpXQGfcHJZe0HnVDHNzWgo0q6WEqa8+dqLxzXuSCvbMqNc+p uSMTfDcb5Zrh9J/xBjeuxMhaG8YuddX1b3jdLj1ZCq77Fw1t7cUvdeHZJVaDVmgE5gb3T29JLeD TBTzeKngFmBgdInMmzYX0yLJeFBdWSoDW7cbBS/78kqnSiFuozoUXbotbbyLylXy7e9P5OnaENE Op7B/ZYgj09f0mH1GIpPpArDLboj2YiPvO11Sj4ih7+an4rdthzRtmMGkLCQdVfPGaYvLsU8GAQ TlAygIu4MMM9dclPQSFnOUIQkmEXBm86JbqXLmTN79um1Ux/fqUtCGgOqKJOtlqG39iQS7/dSpW /YJutDYerCwhHgtbPvaJpxnf6E9Ms64pE83hlc= X-Received: by 2002:a17:90b:224c:b0:3ab:2ad1:f10a with SMTP id 98e67ed59e1d1-3ab3a0ef48emr8723288a91.0.1791866419626; Mon, 12 Oct 2026 21:40:19 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:19 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][PATCH 1/16] openvpn: upgrade 2.7.7 -> 2.7.8 Date: Tue, 13 Oct 2026 17:39:51 +1300 Message-ID: <20261013044006.834868-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130815 From: Ankur Tyagi Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8 Signed-off-by: Ankur Tyagi --- .../openvpn/{openvpn_2.7.7.bb => openvpn_2.7.8.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-networking/recipes-support/openvpn/{openvpn_2.7.7.bb => openvpn_2.7.8.bb} (98%) diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.8.bb similarity index 98% rename from meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb rename to meta-networking/recipes-support/openvpn/openvpn_2.7.8.bb index 604162a7f2..6040935d4a 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.8.bb @@ -15,7 +15,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads" -SRC_URI[sha256sum] = "3ab8f48fd6c26d49ba2333a092433949afdb5c85c0e6a1ff265784fbc04a2463" +SRC_URI[sha256sum] = "c070d1d2440b5a6fca6c2c68645c98cd492116ac36ef4f0946177115532c8e36" CVE_STATUS[CVE-2020-27569] = "not-applicable-config: Applies only Aviatrix OpenVPN client, not openvpn" From patchwork Tue Oct 13 04:39:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100538 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 29FF2CC6B0A for ; Tue, 13 Oct 2026 04:40:31 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.361.1791866423303955510 for ; Mon, 12 Oct 2026 21:40:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=XamD41lh; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-3ab4178ee33so1242590a91.3 for ; Mon, 12 Oct 2026 21:40:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866422; x=1792471222; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bEDQS+kx9VMgq5JbOjminOwY+7UtO3rsA4XnZSG/ZsI=; b=XamD41lh9h2vJfomMpBeBKtUFSYlUEoliAvUaGxItuZR9tWjVZHQSBG2yyei6CcyVb LHf/WHNSLdGnsfEOEv8WfpOg9ZycQyZKlgluGISHfeQZdfdcGnh6w9MrTHgA485KwppA eutyOZ9bHHuSSQVrRYwz/pLAnxJK2NsBawOPp72Szihuy4h4LfvI5NmuxP7xgsa3HpcW PBmDQPmcO1ihCDGnjrm+7GQt5RLzTVIESHtewyIkj+WgEuF4XqlBOXoC1h+5/Df7OZsz T1Rc5Lhw58VYf5npb0u9AxmFF+i/ymShAKbaNwU/vJEypsoKx9QI0fjZYKWAH+lRoF5D wxmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866422; x=1792471222; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bEDQS+kx9VMgq5JbOjminOwY+7UtO3rsA4XnZSG/ZsI=; b=Auu0ve7N0msiH37BReoJWyesVxO4CEAhuBaYdESyv7QIWWdgjTXitli16QaLw9YI2W 6SqN3DzErFx2wVnU5uNJrhFZEfQ9GVAgk0WJDm6iP/wcWWN7uAWaeSJmqDeUVKUlhV+o SicH68wTQhC58rIWgrutjySkX2AvQ6hDSPgRXxPMtJ0KHWqrQKz8yfwo9MyeDgdnMKAp HoT5VMAKWWJ0zqUxlF4w6OxrLPsMNbnsBVWpnzo+GoexeV9h3YhIPiuNoC3XOopc9Rcl pyYV+tuTLQvjt2U9oBGu7X6eQWVuO2WoyefvUgaYXqZLMKXtW7Y9jq3v+sx6lnH96Tiu +1vg== X-Gm-Message-State: AFq9FYLV1HSA8qZyR3iz4NEa5f4MTiTlpq18TDeM8kOV5b01ZHyCtzSb SvLwEs9jf/YxvI8oAN3OGWwkXW4hgDQgOOUKe7Z8VF2Fr4b5GuFEwpixkRYPyg== X-Gm-Gg: AYBFou0D7F4qz0p70HlFWSkk7EZjtmOLknUtoXiDwQm/4Klea7zrdwM0p1wj9dfCITg KirjM1Qdw3MTpcPHe8CJC+GFAnKSNdJUFMqZjPf0uLou4dH0opGQ9jy2wXu6TpVhSIppDLhwaZQ XuQgYZJs4RrMB5D7ZP3XUE1ZdVnLohQZUkN+8+nE4v6R8x8uaPtECoKHXVXpSRfLM05Pu93WkxQ tpzOdr3I4gNEM2OBrSqIZrmio4Lj0jBO3+k0KhCR2B7VuIYzLbgj36Lzf1qecckJKCc7uy7kiSE FsSsE8C8mjz7dfyvmddhknJcMspniG+q6tmhF6Azx0FFfRKHGmX/LZio+UE6RAKo/Fsav8ZrrbE RySks+ZpwEoKFCS6kpi4PF6yOP3I+XBAWluFpVAn9JERDsdixVMBnGUpbBlGN3SbFdQJRWc2yrE 0VPsZka1LqB+tVjljIWMUt+Hdu03eQJnc+vnm+PfVXXbjcE1aMZwenqJrYH6zd44u9b6SIvBCXs sZzGT8EA3X4h/KN9W7eMAPRWs6TJ+ZI6diszzQ= X-Received: by 2002:a17:90b:314e:b0:3a4:cb6d:aca9 with SMTP id 98e67ed59e1d1-3ab3acdda28mr8508070a91.64.1791866422536; Mon, 12 Oct 2026 21:40:22 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:22 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-python][PATCH 2/16] python3-eventlet: mark CVE-2023-29483 fixed Date: Tue, 13 Oct 2026 17:39:52 +1300 Message-ID: <20261013044006.834868-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130816 From: Ankur Tyagi Fix[1] for the CVE is part of the upstream version. Details: https://nvd.nist.gov/vuln/detail/cve-2023-29483 [1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 47b2ce9cc77297c740ecf50d00d6956f5a867144) Signed-off-by: Ankur Tyagi --- meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb b/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb index 3292950e2c..67a69b1478 100644 --- a/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb +++ b/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb @@ -17,3 +17,5 @@ RDEPENDS:${PN} += " \ python3-dnspython \ python3-greenlet \ " + +CVE_STATUS[CVE-2023-29483] = "fixed-version: fixed since v0.35.2" From patchwork Tue Oct 13 04:39:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100536 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03B1DCA9ED0 for ; Tue, 13 Oct 2026 04:40:31 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.362.1791866425970424135 for ; Mon, 12 Oct 2026 21:40:26 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YFJEyIT5; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3ac397836fbso345158a91.1 for ; Mon, 12 Oct 2026 21:40:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866425; x=1792471225; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nHw5JRLgOlcFY5DYdmACJelptg6LctIJStO918gX8nQ=; b=YFJEyIT55jsDZ8UnGmtVCFJceOIFD3aJx7EVlnBtk/PnSla8XM6e44IUw+FV8E08Hi QGhHgF+f36Zazos9RSJxzlNOuFfmS63EpGU2sTOGBX8RsTc13KUblnz5Vv8mNGQ1oWB9 4yKPwazqIBJ7huBIa4hKRVDhs3ihdUPmVmyz3bNAvmyD786ZkET3M50XZVRwANo4qVVw v/54/ZAjX32jXb/tkSveAJwtcHzC0INCS5ObWuc3sVWcJqxnWi5o5SdE8/vtDReFZdtp qv+FoqlLz9tirQdh0Bo7cXjTVzaS67+CmZY3ebDUravqzcFJ76fmMGBEvNeuA1nZnDJW B6Fw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866425; x=1792471225; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=nHw5JRLgOlcFY5DYdmACJelptg6LctIJStO918gX8nQ=; b=xuLAoyDZrecTmjwAau5qHDlqe9hFK90LyMN+1KYKLIGjhFI3tsCylpcjhbIhI53c3q P1c/AqKbNM2epyJidaMb6E8vU8Pq9fLCcGN6g7HIGD+n3NK/t32aUbGgYTqSRCtjmRTB WvVlSjjRL6eeZ8XQ3g9Opl/SwTnxNZTVBcb+CRmwpdwi8djP5Mh0KzmhpbvKvqD8co/y 0vhoOgdY1DE0yBDkcdmPmI9UImZlTvCNJMi0T4jJjHnNWkwJfmKdLM4L9ON9H/5QIVzi 9NYHOtw4S8pDUStKpNVxbuJ7p8KJAnRIag7Bv8ewi8sdudVWUMs51LQ5zjDIIR31u2TZ hA8A== X-Gm-Message-State: AFq9FYIFCtV/fyGFD0Jw0HrR2chDto1f1H5+Zc8pKUTllJQhvHYjx3C4 tJGFBgs96oRJOqlgUueGwnAnbWFN4cHfxSa9zldhvwg4El2ivoFI0f71DSWfJw== X-Gm-Gg: AYBFou25JRDCrLYK5E1k2ZKGvZzaZSxYwOg3iABKnPsLFEn+YFX+t4gSTlHQ+7sCVU+ sZ9Ntuky5B6MI57VXUVSjdDFX2c4DphrCq3Y9Tyt3MTiBV1fgUiz+nWEFef3ETmZL1KP7UbALY6 0uFRslb3jkXT+nxACctPjf5M4wNa0YnhdHkmibx9d2B/ar9dySlM+CD8RTF9yyT/UWoWB+w9BoO 1Kvip91/uQ8v4K9f5OAxpStWnGdaAujyYWQLDRZbCPU4aITd5o5evdrdGfsFQXDZQUYkVKF0Gg6 B8BwuhX7brJgbgtfDHPlH/OW0gr7q5TL0cFTwm9lA81dFZ2/e8jV6udxFpRcPKK7ONV1suN5m1S IgiwuLDtA7We2VQMN3f97tC0Di15zRU3xacLFQey4iyC2+xUE02aWU2gV/nXJ3zPQs2AAB4Sowp 9ontmk46ZZxxWsM/RloIb4eNhRACX6DE/3J1RDZ2xnnZg24J0nhd040Wf3Wf3N8m6ITPtcoEXlP vz5P+b8NPZSQ2cDHaQmIZmZgVlfH2iSS18vn+KETQrLjl7rYg== X-Received: by 2002:a17:90b:6c5:b0:3ac:450a:f9ac with SMTP id 98e67ed59e1d1-3ac450b4782mr350436a91.64.1791866425267; Mon, 12 Oct 2026 21:40:25 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:24 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 3/16] cjson: patch CVE-2026-87933 Date: Tue, 13 Oct 2026 17:39:53 +1300 Message-ID: <20261013044006.834868-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130817 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-87933 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2b3f5cbbd85177f06cea6f89f0b6d83bba48da40) Signed-off-by: Ankur Tyagi --- .../cjson/cjson/CVE-2026-87933.patch | 110 ++++++++++++++++++ .../recipes-devtools/cjson/cjson_1.7.19.bb | 1 + 2 files changed, 111 insertions(+) create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch new file mode 100644 index 0000000000..3972e5eafc --- /dev/null +++ b/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch @@ -0,0 +1,110 @@ +From a1b370963c98e1374e5538e97841f9d476a8932e Mon Sep 17 00:00:00 2001 +From: lilu5458 +Date: Wed, 16 Sep 2026 09:55:35 +0800 +Subject: [PATCH] Fix: heap-use-after-free in merge_patch when patch is subtree + of target (#1065) + +When cJSONUtils_MergePatch(target, patch) is called with a non-object +patch (scalar, array, or NULL) that happens to be a subtree of target, +merge_patch() called cJSON_Delete(target) first, which freed the patch +memory, and then cJSON_Duplicate(patch, 1) read the already-freed memory, +triggering a heap-use-after-free (detected by AddressSanitizer at +cJSON_Duplicate_rec, cJSON.c:2808). + +Fix: duplicate the patch first into a local variable, then delete the +target, then return the duplicate. This matches the Option B approach +proposed in issue #1060. + +Verified locally: +- Reproduced the UAF with a minimal PoC under ASan before the fix. +- After the fix the PoC runs cleanly (exit 0, correct result [1,2,3]). +- Added a regression unit test + (merge_patch_should_not_read_freed_memory_when_patch_is_subtree). +- Full ctest suite passes (22/22 tests). + +Fixes #1060 + +Signed-off-by: lilu +(cherry picked from commit 6d9f2443ab071f86e5d9b43025a40929ec41c46c) + +CVE: CVE-2026-87933 +Upstream-Status: Backport [https://github.com/DaveGamble/cJSON/commit/6d9f2443ab071f86e5d9b43025a40929ec41c46c] + +Signed-off-by: Ankur Tyagi +--- + cJSON_Utils.c | 8 ++++++-- + tests/old_utils_tests.c | 34 ++++++++++++++++++++++++++++++++++ + 2 files changed, 40 insertions(+), 2 deletions(-) + +diff --git a/cJSON_Utils.c b/cJSON_Utils.c +index 8fa24f8..6f41875 100644 +--- a/cJSON_Utils.c ++++ b/cJSON_Utils.c +@@ -1324,9 +1324,13 @@ static cJSON *merge_patch(cJSON *target, const cJSON * const patch, const cJSON_ + + if (!cJSON_IsObject(patch)) + { +- /* scalar value, array or NULL, just duplicate */ ++ /* scalar value, array or NULL, just duplicate. ++ * Duplicate the patch first in case it is a subtree of target, ++ * otherwise cJSON_Delete(target) would free the patch memory ++ * and the subsequent cJSON_Duplicate would read freed memory. */ ++ cJSON *duplicate = cJSON_Duplicate(patch, 1); + cJSON_Delete(target); +- return cJSON_Duplicate(patch, 1); ++ return duplicate; + } + + if (!cJSON_IsObject(target)) +diff --git a/tests/old_utils_tests.c b/tests/old_utils_tests.c +index 690dbb5..bdc7393 100644 +--- a/tests/old_utils_tests.c ++++ b/tests/old_utils_tests.c +@@ -189,6 +189,39 @@ static void merge_tests(void) + } + } + ++static void merge_patch_should_not_read_freed_memory_when_patch_is_subtree(void) ++{ ++ /* When patch is a subtree of target, merge_patch must duplicate the patch ++ * before deleting target. Otherwise cJSON_Delete(target) frees the patch ++ * memory and the subsequent cJSON_Duplicate reads freed memory (UAF). ++ * See CVE candidate: heap-use-after-free in merge_patch (cJSON_Utils.c). */ ++ cJSON *target = cJSON_Parse("{\"a\":[1,2,3]}"); ++ cJSON *patch = cJSON_GetObjectItem(target, "a"); ++ cJSON *result = NULL; ++ cJSON *first = NULL; ++ cJSON *second = NULL; ++ cJSON *third = NULL; ++ ++ TEST_ASSERT_NOT_NULL(target); ++ TEST_ASSERT_NOT_NULL(patch); ++ ++ /* patch (array [1,2,3]) is a subtree of target. This used to trigger ++ * heap-use-after-free under AddressSanitizer before the fix. */ ++ result = cJSONUtils_MergePatch(target, patch); ++ TEST_ASSERT_NOT_NULL(result); ++ TEST_ASSERT_TRUE(cJSON_IsArray(result)); ++ TEST_ASSERT_EQUAL_INT(3, cJSON_GetArraySize(result)); ++ ++ first = cJSON_GetArrayItem(result, 0); ++ second = cJSON_GetArrayItem(result, 1); ++ third = cJSON_GetArrayItem(result, 2); ++ TEST_ASSERT_EQUAL_INT(1, first->valueint); ++ TEST_ASSERT_EQUAL_INT(2, second->valueint); ++ TEST_ASSERT_EQUAL_INT(3, third->valueint); ++ ++ cJSON_Delete(result); ++} ++ + static void generate_merge_tests(void) + { + size_t i = 0; +@@ -219,6 +252,7 @@ int main(void) + RUN_TEST(misc_tests); + RUN_TEST(sort_tests); + RUN_TEST(merge_tests); ++ RUN_TEST(merge_patch_should_not_read_freed_memory_when_patch_is_subtree); + RUN_TEST(generate_merge_tests); + + return UNITY_END(); diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb index d914018331..b4e57d7297 100644 --- a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb +++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb @@ -7,6 +7,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0" SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \ file://run-ptest \ file://0001-allow-build-with-cmake-4.patch \ + file://CVE-2026-87933.patch \ " SRCREV = "c859b25da02955fef659d658b8f324b5cde87be3" From patchwork Tue Oct 13 04:39:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100535 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04C6FCC6B09 for ; Tue, 13 Oct 2026 04:40:31 +0000 (UTC) Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.363.1791866428172927929 for ; Mon, 12 Oct 2026 21:40:28 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=mhZke6jf; spf=pass (domain: gmail.com, ip: 209.85.215.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-cd5d2dafeccso893523a12.2 for ; Mon, 12 Oct 2026 21:40:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866427; x=1792471227; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aCNrHROzSGrBwyuBelOAqyHW2e2UcD7LzYWMrr5DFYU=; b=mhZke6jfW56e8OErsmR/EO246g8xi3CIIn3fXXX/eGWXsxwa6Oz5V3LQL0RgcPWAu/ qKlUZTJiXcxVeVurkGCXVqZ82tw4qLVbpzAF/VPqixzd0Z+1LfR6+9ctFGhQIXzBessV UCU+lviigjEGdQy83YwTqAw58hT2Jlw85yprNAFaJ5TKM7/kUIbeoSnAJOkG0cn2cA8g 0eji3e22ywecnysXH/8MtJtS84pAR1tHmprDG4WYK9KoulRGu5cG4xiAUv3spHn3uDBb lAjpRZDPdW9vb4mJZMH3M6J4pH59whgwINolagj62EnuL5wJkYTxvk6pbW62eEm+lItv n6TA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866427; x=1792471227; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aCNrHROzSGrBwyuBelOAqyHW2e2UcD7LzYWMrr5DFYU=; b=Yxfxs6rYiFj2sOvpVK4hjpTDBhs5b9Xdb4GnYqnGdzeExcYgyBMi/iYP5S+J1n11yQ sZXBVN/n2Fq5f/St72MkNFCx9zZc91pqHrCv7aFOPt2E/o8ds/p0SpMVT5RSfUF/INFH bcbqAFcGfLmJnZg5Oc1wOtOediJm3aV4DF0SWTItkTiD12OYk5kA+T7mGOK4ajgQmkJh UFJO97XxlEThFRO9Q2nGG2d17ptz33pPc/tJIy6xpwfexC28vZPzlYybhTIzGAmHxgFo pvon8eJIR8ymWOYWNUTDwNJ0MVfdwI6GtDh7EtcwFo8EzU3p/BaLuBxYakFzuHAzZuq4 0MGQ== X-Gm-Message-State: AFq9FYJ24VMUNX4jOYaUD2ROukbDAvul4r3d+vN+ClQs7z2XqmwJug47 UxaeBug00AwmBDa6ED5Vdb2jRWjs+NC478jNyYWOgQMbgV8bAelGvv1k5CZJTg== X-Gm-Gg: AYBFou2E5cZS7m1rTev5L0o4AH4Dg9oNNS+OH+dzmbq8BRBr3zTUvSsxjck7PNBWqzK C8q2bHIR77oscMo2X/VLwEUHAyPGWV8m1uP254HdsV0HPpVDqsc7PPbEk/vYjrfva3rgDBf/fcC LW1ruWRoHU2QiYqjWq6XCqW/owqs0AHSke+nFGMPvHoXteE4jdfnQEZKUQz3BjKNe2IzJIgsat+ /4VUqK4OiEhX87WDaO2Ti2gMuX5tzHV1HtLFGiKnwFhFQvyAQ1h1zUhr9wQ12kq97+8jOlFNhxv aMiXaPBmfiQMt8iPO0Y7nC3/Mw/FDtwMx32aPZJesnsHfFavMx7ZRBDFkXLOx+qnld7fxZsolrc 7amjVSIpnxsK4StiXLZ/p3oN5HhZTnnUChunnVnmq39+tX6aGtaPgzn4ho450rj2H3ztGPwRVxO KnD5dTVjdSeI2qex6DkrQxssoiG8Av6jk/yT1mZyE2qCYk6XFx3NpZE7M4PZ7lH8rqm8Ur/lUdU xw0CHdGDU5nWo8N5rU2UbFGNWlQbkFjzpxcv6Oy895xfQzfuQ== X-Received: by 2002:a17:90b:48c7:b0:3a4:adf9:5d38 with SMTP id 98e67ed59e1d1-3ab3a3596c5mr8850758a91.4.1791866427500; Mon, 12 Oct 2026 21:40:27 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:27 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 4/16] smarty: mark CVE-2026-82531 patched Date: Tue, 13 Oct 2026 17:39:54 +1300 Message-ID: <20261013044006.834868-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130818 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-82531 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/smarty/smarty_5.8.5.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-support/smarty/smarty_5.8.5.bb b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb index 83f428d388..c700ed5d93 100644 --- a/meta-oe/recipes-support/smarty/smarty_5.8.5.bb +++ b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb @@ -35,3 +35,4 @@ FILES:${PN} += "${datadir}/php/smarty3/" RDEPENDS:${PN} = "php" CVE_PRODUCT = "smarty:smarty smarty-php:smarty" +CVE_STATUS[CVE-2026-82531] = "fixed-version: fixed in v5.8.5" From patchwork Tue Oct 13 04:39:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100539 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F6F1CA9ED0 for ; Tue, 13 Oct 2026 04:40:41 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.350.1791866431028504203 for ; Mon, 12 Oct 2026 21:40:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=GIjCG1mA; spf=pass (domain: gmail.com, ip: 209.85.216.44, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-398b3c37877so1154330a91.0 for ; Mon, 12 Oct 2026 21:40:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866430; x=1792471230; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Qb8/j2uKVCmvYEcp11K6RjURHYDD16OFpwlyTN8Ral8=; b=GIjCG1mAxplHJ05mpiiYhL2b9DHbOFxE2dRx4j8KVUhC5zJEUwiKiUSITM4hhY/oC+ kTwneaoQRJmLs68o6QYH1wG7IOiTZf6B38bey8qIsFkiY+bmAxjU8s9/BCkbyXWQlyTz muY5lvIiOc4mtj8rcU/738Y4TfkXWeNqCr/263pha/IZw9Gxra+jq3mDG3hYKK5+z8Oc WzSWzzbwZ6k+EBtoq+RMj194gW9JdRHjIlWlcJXVXFN6TmfcK6WvIvZc8rhr4LzWLV2K jhuq2YgqaJGjoCEV1cpJKnZB6h0dxUsOynkzYAwX1WA9w7UAQvVOyMByYkGFvvdxJWzq I8FQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866430; x=1792471230; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Qb8/j2uKVCmvYEcp11K6RjURHYDD16OFpwlyTN8Ral8=; b=JFLPEj+mScRDL8cYpllrFSPJIkk1p6yzqLlMtTNlZdHTFpthz0pNKqrtJ4MLyIMAA2 alt1OvwCwWrpGB/gfbPfZBqobITLtMT8/YQ0hhpeDbb0X/NCVhRrHdlx7NTg1yakn8WB 4agB3dYQcLSLT2e7UTCtAYCm4dI9NCVRUn/r5rMzuJX89OKpO8QnM8w5u58eOGC4HfHh fnc1odBwNxcMd2LvhCHVdE7+oE8TfoW4ufww0OBg+nBewMq2trBBnkvE26mGTP08y0LN MQtGfHgHZjmhX3CgCVZZHwU+RoaB6I9s1qK7/6jkP/Kmq3my+zF1GLF8DTPkUAcXfBbN 3/0g== X-Gm-Message-State: AFq9FYKUD6mlSwg3RlsMi2AI85xzGDFqrBjJ1AwoKuTSvFeCwezVAYUQ ODjfXMZ/yMjIc4Pc/rYWeLXsM/jCb9ozqkGtN/AEuV0mwPk+3ty3/QpblaL4jg== X-Gm-Gg: AYBFou0NjC6i8nl7wMDyT5fBfO8npDOQRN++4prlz2dIKNyK/APUo3KL4RpPz5r2+kG GrBNO7bnVw93tyHoWvl2vgNayAMpzS0Y7dBj5djV7DeMmciQR4LurQVzSWht5DtvuKLtuk7dY4Q /rta/PITQYrnxTjxKo1KXjU55V7eemb5hrCBxFvfRjATbikreV+gY05ZCAmkiSnQ46eIEOYK+R3 DinTn1Pjt2Fe6eGhhBlBsrxHCrwrh0l17icS5Us2HCMNiXi4FTlKN4lYtE8hMZDfwg/XMFHsUXt QylT9rXKIkZ2EvT1c2C+r8Rno7tE+yxwrClItqbS50/deGRbCSjjpaOXJAQrInQfVFG2uh/ddRl L3BOo+AzeWMynuhX9PYc3z1Bypym23N5Tfm3r+Mq85z3C+zOLhXV88wehgtnfxuEErm0Wp7j3A9 1ZM0AcUJbVHeiWgzsH6WesPH4j2XjJzNWa0MlhdIIRdlKkd3yho0dUmQMyYKx/SaPNYTZwiPJey o/SvP3Fvh7fSy1nk4z5hhggZUNvMAGVysVAdN+f53krCK93Aw== X-Received: by 2002:a17:90b:48c5:b0:39d:efa9:cd1a with SMTP id 98e67ed59e1d1-3ab3a4871f1mr9713426a91.4.1791866430190; Mon, 12 Oct 2026 21:40:30 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:29 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 5/16] ntopng: patch CVE-2026-84990 Date: Tue, 13 Oct 2026 17:39:55 +1300 Message-ID: <20261013044006.834868-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130819 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-84990 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2d932fa4e349690dc42485b9dd04ab04d19710d9) Signed-off-by: Ankur Tyagi --- .../ntopng/files/CVE-2026-84990.patch | 53 +++++++++++++++++++ .../recipes-support/ntopng/ntopng_6.6.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch new file mode 100644 index 0000000000..0b443e3050 --- /dev/null +++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch @@ -0,0 +1,53 @@ +From 2f36e393fc35f576d7c447af337848e81990b084 Mon Sep 17 00:00:00 2001 +From: Alfredo Cardigliano +Date: Fri, 17 Jul 2026 11:51:03 +0200 +Subject: [PATCH] Add admin check in conf backup listing and download + +(cherry picked from commit f912ee93bc143330b6ff3bb946ee7211e5ee9e1a) + +CVE: CVE-2026-84990 +Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/f912ee93bc143330b6ff3bb946ee7211e5ee9e1a] +Signed-off-by: Ankur Tyagi +--- + .../rest/v2/get/system/configurations/download_backup.lua | 5 +++++ + .../v2/get/system/configurations/list_available_backups.lua | 6 ++++++ + 2 files changed, 11 insertions(+) + +diff --git a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua +index 1603a94c48..404b09ed97 100644 +--- a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua ++++ b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua +@@ -12,6 +12,11 @@ local backup_config = require("backup_config") + + -- ############################################## + ++if not isAdministratorOrPrintErr() then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end ++ + local download = _GET["download"] + local epoch = _GET["epoch"] + +diff --git a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua +index d901a876b0..8a08ad15d5 100644 +--- a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua ++++ b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua +@@ -8,11 +8,17 @@ package.path = dirs.installdir .. "/scripts/lua/modules/system_config/?.lua;" .. + + -- ############################################## + ++require "lua_utils" + local backup_config = require("backup_config") + local rest_utils = require("rest_utils") + + -- ############################################## + ++if not isAdministratorOrPrintErr() then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end ++ + local rc = rest_utils.consts.success.ok + + local order = _GET["order"] or "desc" diff --git a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb index 03350f240c..b4a1ff1883 100644 --- a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb +++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb @@ -19,6 +19,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \ file://0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch \ file://ntopng.service \ file://0001-Fix-build-with-OpenSSL-4.0.patch \ + file://CVE-2026-84990.patch \ " # don't use the lua under thirdparty as it supports cross compiling badly From patchwork Tue Oct 13 04:39:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100541 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64FDACC6B0E for ; Tue, 13 Oct 2026 04:40:41 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.351.1791866433815080290 for ; Mon, 12 Oct 2026 21:40:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=hHzYd0i7; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-381b831d535so2972100a91.0 for ; Mon, 12 Oct 2026 21:40:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866433; x=1792471233; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Fu7dE7rXvJZDuxDzliREsmItfHQTI6WQZRQJ4oaFchY=; b=hHzYd0i79LKS36LI19Kt3TigtHzhroL1adhXg8mgoIhNV1ERq5yFSTvtwxDw5o42z6 pTr8H8cAf/VUwAU2NusCRL9F4WUpo3tq737FdxoHx5LK4U+ux23+C/98zKvbGWUj5fr0 pnJoLBlf7/UnlnomG951pBKonzXNX8ET4wil85kYdNga7B2CzrNuGtmA9ujySn/t4hjG yBf/X0iRAwTSYG0eC82ztyU/t4wnWkHcY1OGfbz52nXh+aqDDD4C3Zqe4h7t6oPDPh9b 2RuKQCxZAqDs4NcybP0GDXNEKUrCzJm4ibAVRjhNV4ab1dyRg5FQ8ngAMQbgqRgnZnS6 GqwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866433; x=1792471233; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Fu7dE7rXvJZDuxDzliREsmItfHQTI6WQZRQJ4oaFchY=; b=T8TcrjTYZq6vzboqqOUqt2cC/ekTKrZShMW02sk0x2vczD6LYcZqpc1OfkCn3AIcnB b6xyNrla+W4OFpnON1Ds9eYC4AMZG8EIxcl2O0g0cZO3GB4fu4IZKu9qJip9W+pDsVgX frYdJYXLsYRIr4kyEDMaEVdesBt5eNlLX0zhTYOxJoVUIrnufmub9gmqA+V++oehvMXV aTsTezCqc21awmJuII/yFSZJM7ugG1Ns1nVXATSXtnhb9aIg6jJCv5mTjHfmvpPSrHG2 gVc03LSdPxX7odr9zTeQTc5Kl0Mr0ygIeXFi7KpDBuUEsBHNqDJCswbKBu3QAad1TaGR fz/A== X-Gm-Message-State: AFq9FYL13X7gwaxfL1NqNLs8OL5tn2jxvFS5BF/K/iop6rrMXUlXuqv3 VVindTFBSu1QyfxJ3lQMbbLKjGCSFedvOfJbV6D0b5QxuG8C87AoN83w5TbcbA== X-Gm-Gg: AYBFou2LOTWWf6aQg1U6hk3aBI6hqcRfbNcs1xH1IMlv1t9ofuygXRNi5eQ7/RHOO1l RXGbsuHwIOb+m2R2znOp9p7eFe3f1UiK99Adezd3d5yl+bdYIQCdrOACRBuQLz4GcWHxk4anUCP wAqus89nsH5HRiHaRji5dSG+t3P2iAEj6Gw8Xhf9tg8LZ/fak9UO/znzZP2skv01yRoTWFONtNC tG/IADxrJKhtaUxOBNDswD8hQRA3CGs1BR1UmTedIA+BM94JurYJ1FlXnRVXU3YpTWWRCEPkkdt M2ADKbuGbn8MLCBMP5X5qwp8JmvirSpRfn8E49WRUniMPDvsCSZnj/7j19XL/576SdyudXWnX38 DCT37o9TyFvAvOxroLvEoOaklxGpgIsMDuS3LdsNw2S69I1xHD2HUI7hvBKvkT4Dkitn6OD/9MM 7fEfEOpxgkYi3HJlDEJRw1WRPOgUEWW3IYEXYpgpLvqa7p9xoFnz5UetmNu/DlMqfgfu6j30Ail d+zbtiVjLaEPQiYAtR+Oom8H1lRWBsYvq3BY2k= X-Received: by 2002:a17:90b:224c:b0:3a8:6a6b:596d with SMTP id 98e67ed59e1d1-3ab3a9a8d66mr11434457a91.26.1791866433120; Mon, 12 Oct 2026 21:40:33 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:32 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 6/16] ntopng: patch CVE-2026-86090 and CVE-2026-86091 Date: Tue, 13 Oct 2026 17:39:56 +1300 Message-ID: <20261013044006.834868-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130820 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-86090 https://nvd.nist.gov/vuln/detail/cve-2026-86091 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit ae180302f4c7f7dc0ba45c330d55b127aeefaf01) Signed-off-by: Ankur Tyagi --- .../files/CVE-2026-86090-CVE-2026-86091.patch | 67 +++++++++++++++++++ .../recipes-support/ntopng/ntopng_6.6.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch new file mode 100644 index 0000000000..a8a3ba72ac --- /dev/null +++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch @@ -0,0 +1,67 @@ +From c6f4d42e1bb029463f927532819c5f5b331ea066 Mon Sep 17 00:00:00 2001 +From: Alfredo Cardigliano +Date: Thu, 16 Jul 2026 14:42:29 +0200 +Subject: [PATCH] Fix user capability check for deleting notification endpoints + and pools + +(cherry picked from commit 7d830f31af367745431c5d92e2e82fc432f6bdd8) + +CVE: CVE-2026-86090 CVE-2026-86091 +Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8] +Signed-off-by: Ankur Tyagi +--- + scripts/lua/modules/pools/pools_rest_utils.lua | 5 +++++ + scripts/lua/rest/v2/delete/endpoints.lua | 6 ++++++ + scripts/lua/rest/v2/delete/recipients.lua | 6 ++++++ + 3 files changed, 17 insertions(+) + +diff --git a/scripts/lua/modules/pools/pools_rest_utils.lua b/scripts/lua/modules/pools/pools_rest_utils.lua +index 9b692ea5db..73f08e0c8d 100644 +--- a/scripts/lua/modules/pools/pools_rest_utils.lua ++++ b/scripts/lua/modules/pools/pools_rest_utils.lua +@@ -452,6 +452,11 @@ end + + -- @brief Get all pools of all the available (currently implemented) pool instances + function pools_rest_utils.delete_all_instances_pools() ++ if not auth.has_capability(auth.capabilities.pools) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++ end ++ + local all_instances = pools_lua_utils.all_pool_instances_factory() + + for _, instance in pairs(all_instances) do +diff --git a/scripts/lua/rest/v2/delete/endpoints.lua b/scripts/lua/rest/v2/delete/endpoints.lua +index 31852cedab..6d25c01953 100644 +--- a/scripts/lua/rest/v2/delete/endpoints.lua ++++ b/scripts/lua/rest/v2/delete/endpoints.lua +@@ -10,6 +10,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" .. + local rest_utils = require "rest_utils" + local endpoints = require("endpoints") + local recipients = require "recipients" ++local auth = require "auth" ++ ++if not auth.has_capability(auth.capabilities.notifications) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end + + endpoints.reset_configs() + recipients.cleanup() +diff --git a/scripts/lua/rest/v2/delete/recipients.lua b/scripts/lua/rest/v2/delete/recipients.lua +index cbdffcae4c..14b3956498 100644 +--- a/scripts/lua/rest/v2/delete/recipients.lua ++++ b/scripts/lua/rest/v2/delete/recipients.lua +@@ -8,6 +8,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" .. + + local rest_utils = require "rest_utils" + local recipients = require "recipients" ++local auth = require "auth" ++ ++if not auth.has_capability(auth.capabilities.notifications) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end + + recipients.cleanup() + rest_utils.answer(rest_utils.consts.success.ok) diff --git a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb index b4a1ff1883..808967e969 100644 --- a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb +++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb @@ -20,6 +20,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \ file://ntopng.service \ file://0001-Fix-build-with-OpenSSL-4.0.patch \ file://CVE-2026-84990.patch \ + file://CVE-2026-86090-CVE-2026-86091.patch \ " # don't use the lua under thirdparty as it supports cross compiling badly From patchwork Tue Oct 13 04:39:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100542 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D285CC6B03 for ; Tue, 13 Oct 2026 04:40:41 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.352.1791866436501019582 for ; Mon, 12 Oct 2026 21:40:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=HZIiFRky; spf=pass (domain: gmail.com, ip: 209.85.216.44, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-3a8adb68d8bso1681271a91.1 for ; Mon, 12 Oct 2026 21:40:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866436; x=1792471236; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2NjEwcz1evegYdskFb76XdF6DQwohpaVPIJPmv8IdZU=; b=HZIiFRkynIpiJ4VRxZPIzRm2J87G1W2mBgn9lu0DVvMAughDksleCpy8V9k438f6GG zEPfRc6RSD86p+gZc9Pm7QCuvR6eRyuM6A/7kHOg8nF5N+xXQFzXkWY+qXKocHGKuwDd dqXZOXDwYxZI+NLWYis8cOiN8qhbBptWjNwh8Wd4pa6vUOaigGyZmy5W/0GzcM3ZGFM4 /azZjxKP2XQgB8qC6QtQayu3ExtzKkiam+yESWqzMG/9dfMgu7eCMWosTjj5R/Xohp2n pFG6UGMr67m+EqsKzOAzWJAd+Aq4KGNQcap2yvn+VOwl7gPYTKcZbNkHiWEIKaHhAow5 QZtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866436; x=1792471236; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=2NjEwcz1evegYdskFb76XdF6DQwohpaVPIJPmv8IdZU=; b=SWq52Ak4fnEAeE/XHb7hnAfKB6DIl+CZ7Rf88duFKZV2gEE5/OlQa23fHHPzOBHou9 E69dgcyWDfutTvFL3+sV9i1O1jt0mIm47yXHOrzyJsoqtBZ4Q96CXukdU5P0gn9vU4Zr wTrmhvs2ty0ZtqQ6SU/Qe+KBgavymVXVvTJy+KLnVvsZpgGMldsMwugNbBK/Epl7RGC7 FUA8f08sev7hg88b59G2m9Vbvp1PfYGmRYz6JKHk2AhyvvCcJgGywHAAn9FGelA61nNg V/OL23qWds8ssldCbg1tdkDvB9UFK5B46RLaI5vpcB1ZwnIZTJTWWNbs3ZJkkHBuiAJz PVlA== X-Gm-Message-State: AFq9FYLGsQox+C6kCiomv1QEJIktAKBQK+BAeQOSP/zOyacP92hSseL9 uR6sMhJbO2RwFsVfHSvW3emEa4/ejUPHQWRgqh1TvSC7ZkQtBH1gxIb8ZJWpRg== X-Gm-Gg: AYBFou1CjWeqTQ6LrJ51IxAGPtJ3+R4q3vXGDMgercsZJUQ8wkUr5B78lW9gvW5b7hx xCf8l/R8nSqH5BZDJ5viD2EHmbSxXit9lDj8/Gtf+BJJ2iDmALZ5mJCU2zF2hNJIRi6Q+MCpYlw yY+sU5cAHTEwiZ6hryLy9hrSvRs/Z0tBRJo8V/u4J3wnBNP3TTr5wK7fhvyPKS8ME/CxA65G5vs KR6hYiTwTl5aZO7kzHPdI7mQROd5Ve+qsJmJwJjHuxV923+nvoOwic4cosznx7Fbujk3H4L4ALR vV8w3PIrNB9I8yT9B6TwA+oglDNU7BoV5wj2Aco3VUrRKcKMGFAuQx98KGlbgvRd5oQazo8QwJt gnZNyD9Md4EfywTRBU420QEcq/jAl9e+nATI7CwrNC/WuHjGtmiobaIEorn47L+ofZJGrg06/Ma Ro7v/4g8dfVORJ3f2lDpyCND9xK4e/Cvw9H/kfrJvMDgb+zX5vlwwxhId/JCQnqE+3P4yNgh+rb tVe2y+eMRJhpKqYmFr/VSe+hJB423k5IcwD6fQ= X-Received: by 2002:a17:90b:5486:b0:39e:6a7f:1dcd with SMTP id 98e67ed59e1d1-3ab3ab1d56cmr10251925a91.41.1791866435816; Mon, 12 Oct 2026 21:40:35 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:35 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 7/16] sngrep: patch CVE-2026-90558 Date: Tue, 13 Oct 2026 17:39:57 +1300 Message-ID: <20261013044006.834868-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130821 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-90558 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 36ddee53b179b5108186cc3e8d76c0f6a5e5d069) Signed-off-by: Ankur Tyagi --- .../sngrep/sngrep/CVE-2026-90558.patch | 84 +++++++++++++++++++ .../recipes-support/sngrep/sngrep_1.8.4.bb | 4 +- 2 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch diff --git a/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch new file mode 100644 index 0000000000..64fd8044a9 --- /dev/null +++ b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch @@ -0,0 +1,84 @@ +From 399346a12ca3bcf7703734fa33b5b3427775b014 Mon Sep 17 00:00:00 2001 +From: Kaian +Date: Fri, 7 Aug 2026 08:45:42 +0200 +Subject: [PATCH] fix: prevent stack buffer overflow in SIP attribute + formatting + +call_get_attribute() formatted the Call-ID, X-Call-ID and Reason header +text with an unbounded sprintf("%s"). Call-ID/X-Call-ID can hold up to +MAX_CALLID_SIZE/MAX_XCALLID_SIZE (1023 bytes) and Reason text is copied +from the raw payload (up to MAX_SIP_PAYLOAD), while all callers pass a +255-byte SIP_ATTR_MAXLEN stack buffer (call list rendering, sort compare). +A SIP message with a long Call-ID, X-Call-ID or Reason header overflowed +the stack, triggerable via pcap, live capture or HEP/EEP remote capture. + +Bound these writes with "%.*s" and SIP_ATTR_MAXLEN - 1. Also fix a +matching off-by-one in msg_get_attribute(), where the existing "%.*s" +used SIP_ATTR_MAXLEN as the precision and could write 256 bytes +(255 chars + NUL) into the 255-byte buffer. + +Thanks to TristanInSec for reporting the issue. + +(cherry picked from commit 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b) + +CVE: CVE-2026-90558 +Upstream-Status: Backport [https://github.com/irontec/sngrep/commit/1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b] + +SIP contract change was dropped during backport as it was introduced in +v1.8.4[1] + +[1]https://github.com/irontec/sngrep/commit/c61a26d90c166f996e31aceefc9c2f8f831ccd86 + +Signed-off-by: Ankur Tyagi +--- + src/sip_call.c | 6 +++--- + src/sip_msg.c | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/src/sip_call.c b/src/sip_call.c +index bea879a..68ecb50 100644 +--- a/src/sip_call.c ++++ b/src/sip_call.c +@@ -257,10 +257,10 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value) + sprintf(value, "%d", call->index); + break; + case SIP_ATTR_CALLID: +- sprintf(value, "%s", call->callid); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->callid); + break; + case SIP_ATTR_XCALLID: +- sprintf(value, "%s", call->xcallid); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->xcallid); + break; + case SIP_ATTR_MSGCNT: + sprintf(value, "%d", vector_count(call->msgs)); +@@ -282,7 +282,7 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value) + break; + case SIP_ATTR_REASON_TXT: + if (call->reasontxt) +- sprintf(value, "%s", call->reasontxt); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->reasontxt); + break; + case SIP_ATTR_WARNING: + if (call->warning) +diff --git a/src/sip_msg.c b/src/sip_msg.c +index 379a40a..6762862 100644 +--- a/src/sip_msg.c ++++ b/src/sip_msg.c +@@ -136,13 +136,13 @@ msg_get_attribute(sip_msg_t *msg, int id, char *value) + } + break; + case SIP_ATTR_METHOD: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, sip_get_msg_reqresp_str(msg)); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, sip_get_msg_reqresp_str(msg)); + break; + case SIP_ATTR_SIPFROM: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_from); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_from); + break; + case SIP_ATTR_SIPTO: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_to); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_to); + break; + case SIP_ATTR_SIPFROMUSER: + if (msg->sip_from && (ar = strchr(msg->sip_from, '@'))) { diff --git a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb b/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb index 5bb30da6db..c7457fd0c0 100644 --- a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb +++ b/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb @@ -15,7 +15,9 @@ DEPENDS = "\ ncurses \ " -SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV}" +SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV} \ + file://CVE-2026-90558.patch \ +" SRCREV = "9c370866afaf5ccb258bf03848b2d22f30cf61bd" inherit cmake pkgconfig From patchwork Tue Oct 13 04:39:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100540 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 302D1CC6B09 for ; Tue, 13 Oct 2026 04:40:41 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.353.1791866439645521245 for ; Mon, 12 Oct 2026 21:40:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=hjToQAc9; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-cc4b1f7e8f4so1364108a12.1 for ; Mon, 12 Oct 2026 21:40:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866439; x=1792471239; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ruEFNvF/oog/e3udKVsp4XeOS530kqu1POusOijh2F8=; b=hjToQAc9/mfCkEABhmxCZuMfMQlT27fOu5uafGJylX4M7ltvYiQzlTi0MLDxjoaI2k ZH5Ot8hws3mnmXorik96KmsjZ9y9rdDjiMVPW+yxlQj6g36ip600mSYh8nIL6I6vZK8L SSmdjimx6vmJHSSq16JQsprduejPVHziaVPIcZ2BGQOPjsv7N9xZP8G4njOu9H92s1tu bAP8ltoum7GAuPieFEl59CnF5fpg9d1KNFsTyPC9pg2gXYRlJSlMX2GIOyxXZqL4zp7Y bHC22Ue1sDH3H2x/dtySiMzuNGKesC1oQdLfDozbNSVZ/Pl84VRibKe/ttDkibibY7Vi QBcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866439; x=1792471239; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ruEFNvF/oog/e3udKVsp4XeOS530kqu1POusOijh2F8=; b=LA0FDXhEyCmJnMZZKn51h4kGcu21nvLAoO7S0Ec5Fr+sMIo8tFxlLW6wXlve67GBvN POvW6rI1Lw7uZRI62Nm77YBdCDX0QCkGtiDuL1lqjb9jMqXCW08ycerE1f+WVfFE/0xK yjIfHNW14LCkKeHBREbvP1rvUvS+o+YT9PtFTH/qKoV6WiTZBoDlLVhxAjLsWmID9LN5 Rueq01l4ey6IvUTvtFOA6ZwRilkW4+s4DeAsukyVuKSUXXN7njLretmDUm21PFvLtsh3 SRQm++9VQogD5DYdfIP/xRbsIIzRPyJlw/r3qIv6MYMV3zCgv/1dD4bsRH9xK7US5OAH LZmQ== X-Gm-Message-State: AFq9FYKAY4VdHG4uuofdBNZJMiB7OAlKKmwvRY9vrPGO5ujZZUzAN2q1 Q6Vk7gjjTwTEs5/jlZ4RI3TphJF8pdDwyIIRrfZAloboj7U98SEjPpX9Vz5oCg== X-Gm-Gg: AYBFou009pbzE0E1wdJYpAsrBigXEg7dEv2Gk2ANu28Zld2P7qGlHAhg6Hxld7FOKnh JbaU+PHmwP1RZY9/8Z+b7bu/PdfVRGVVEgGaQAw2FFipROhHspeR2tWnsITOqDx5i5tfEVpYKqB S2SjFM7gLGQegvQEjulkWG3+MWU1qfsoVbwuXn+KlQ7/OBfm6RUszvlWefh9G07L0wIz3eK4CYR ko852J+iJmeND4sYRPciGIMT0WcpbivqGmQ/2mwgZfso+HTyPx+szKeFtiCA07gCIv8GQ895XiK QJi8XVHfoiGMRwgR42SH9+f5EM5pLMINXVbl0p+t/eTLo7eNfoCBSwUGStABuIUiK4d0uERJLan iSgQFi3kMrEbuxKnFlHfmnGp9iM6RmQ3R+3irsh7hG7prya4LH1WYMvDozm/9pqIl7OqYspG446 scOjY4968Ot2SJ8RuiSZ3fMzisfR+0/+P1aoUTR/YhzcbIKb/70yO8w4F/PYNSw0YRkYZAY/jxU gQwRa0+B9qVtQtH7bK+9M1RCVAoN7Du3QI4Y08= X-Received: by 2002:a17:90a:e09:b0:3ab:3d8e:f29 with SMTP id 98e67ed59e1d1-3ab3d8e36e0mr6000062a91.46.1791866438976; Mon, 12 Oct 2026 21:40:38 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:37 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][PATCH 8/16] strongwan: upgrade 6.0.7 -> 6.1.0 Date: Tue, 13 Oct 2026 17:39:58 +1300 Message-ID: <20261013044006.834868-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130822 From: Ankur Tyagi - Remove PACKAGECONFIG entries for soup, tnc-ifmap, tnccs-11, tnccs-dynamic - Include xauth-generic in default PACKAGECONFIG. This preserves default plugin as upstream disabled IKEv1 by default. root@qemux86-64:~# swanctl --stats uptime: 38 seconds, since Oct 13 03:27:29 2026 worker threads: 16 total, 11 idle, working: 4/0/1/0 job queues: 0/0/0/0 jobs scheduled: 0 IKE_SAs: 0 total, 0 half-open mallinfo: sbrk 1503232, mmap 0, used 552176, free 951056 loaded plugins: charon-systemd random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pgp dnskey sshkey pem openssl pkcs8 xcbc cmac kdf drbg curl sqlite attr kernel-netlink resolve socket-default vici updown xauth-generic Changelog: https://github.com/strongswan/strongswan/releases/tag/6.1.0 Signed-off-by: Ankur Tyagi --- .../{strongswan_6.0.7.bb => strongswan_6.1.0.bb} | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) rename meta-networking/recipes-support/strongswan/{strongswan_6.0.7.bb => strongswan_6.1.0.bb} (94%) diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.1.0.bb similarity index 94% rename from meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb rename to meta-networking/recipes-support/strongswan/strongswan_6.1.0.bb index 117c148865..f6dac33c0f 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.1.0.bb @@ -10,7 +10,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2" -SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" +SRC_URI[sha256sum] = "fe6c97481298767213cfc2e9a1da29fdd8018d481ff4cb9cf0283099654f20d4" UPSTREAM_CHECK_REGEX = "strongswan-(?P\d+(\.\d+)+)\.tar" @@ -21,7 +21,7 @@ EXTRA_OECONF = " \ EXTRA_OECONF += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '--with-systemdsystemunitdir=${systemd_unitdir}/system/', '--without-systemdsystemunitdir', d)}" -PACKAGECONFIG ?= "curl openssl sqlite3 swanctl \ +PACKAGECONFIG ?= "curl openssl sqlite3 swanctl xauth-generic \ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd-charon', 'charon', d)} \ ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'tpm2', '', d)} \ ${@bb.utils.contains('DISTRO_FEATURES', 'ima', 'tnc-imc imc-hcd imc-os imc-scanner imc-attestation', '', d)} \ @@ -48,10 +48,10 @@ PACKAGECONFIG[pkcs12] = "--enable-pkcs12,--disable-pkcs12,,${PN}-plugin-pkcs12" PACKAGECONFIG[rc2] = "--enable-rc2,--disable-rc2,,${PN}-plugin-rc2" PACKAGECONFIG[sha1] = "--enable-sha1,--disable-sha1,,${PN}-plugin-sha1" PACKAGECONFIG[sha2] = "--enable-sha2,--disable-sha2,,${PN}-plugin-sha2" -PACKAGECONFIG[soup] = "--enable-soup,--disable-soup,libsoup,${PN}-plugin-soup" PACKAGECONFIG[sqlite3] = "--enable-sqlite,--disable-sqlite,sqlite3,${PN}-plugin-sqlite" PACKAGECONFIG[stroke] = "--enable-stroke,--disable-stroke,,${PN}-plugin-stroke" PACKAGECONFIG[swanctl] = "--enable-swanctl,--disable-swanctl,,libgcc" +PACKAGECONFIG[xauth-generic] = "--enable-xauth-generic,--disable-xauth-generic,,${PN}-plugin-xauth-generic" PACKAGECONFIG[curve25519] = "--enable-curve25519,--disable-curve25519,, ${PN}-plugin-curve25519" # requires swanctl @@ -80,12 +80,9 @@ PACKAGECONFIG[imv-attestation] = "--enable-imv-attestation,--disable-imv-attesta PACKAGECONFIG[imv-swima] = "--enable-imv-swima, --disable-imv-swima, json-c," PACKAGECONFIG[imv-hcd] = "--enable-imv-hcd, --disable-imv-hcd,," -PACKAGECONFIG[tnc-ifmap] = "--enable-tnc-ifmap,--disable-tnc-ifmap, libxml2, ${PN}-plugin-tnc-ifmap" PACKAGECONFIG[tnc-pdp] = "--enable-tnc-pdp,--disable-tnc-pdp,, ${PN}-plugin-tnc-pdp" -PACKAGECONFIG[tnccs-11] = "--enable-tnccs-11,--disable-tnccs-11,libxml2, ${PN}-plugin-tnccs-11" PACKAGECONFIG[tnccs-20] = "--enable-tnccs-20,--disable-tnccs-20,, ${PN}-plugin-tnccs-20" -PACKAGECONFIG[tnccs-dynamic] = "--enable-tnccs-dynamic,--disable-tnccs-dynamic,,${PN}-plugin-tnccs-dynamic" inherit autotools systemd pkgconfig @@ -174,7 +171,6 @@ RDEPENDS:${PN} += "\ ${PN}-plugin-updown \ ${PN}-plugin-vici \ ${PN}-plugin-x509 \ - ${PN}-plugin-xauth-generic \ ${PN}-plugin-xcbc \ " From patchwork Tue Oct 13 04:39:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100543 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 634C0CA9ED0 for ; Tue, 13 Oct 2026 04:40:51 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.355.1791866443282669526 for ; Mon, 12 Oct 2026 21:40:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=m+qpzq2M; spf=pass (domain: gmail.com, ip: 209.85.215.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-cc4dbcf2b85so998749a12.3 for ; Mon, 12 Oct 2026 21:40:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866443; x=1792471243; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=RqoBVTvuWIA3oRwlp4pXxdSlrh9dq7DOjEbbCIaPUvY=; b=m+qpzq2MHFMLd5sRPBsvK/0juNrAOOp6XUrd3dF5nN87q/NixTVX3TYv2m61omfjf6 YeiS7bxu5x8ziVnv//A59Dt04OqjznhmekhO9OchBFrtbhRyR8sSkRZqNei2kKg5PgRR Qjh1Rb5Zh0bGZfXIHyrtr+F4yYTl4A5l3uxXZzuchDe/FSprSHsg0PAbarVgjtuN5fpr f9bxNiUTS3ai4ofShjSend40/UXR7mRKHdkb6w0WLiZacP5tMWakSaHTWL1hKrc2kWbh Ogq6nHRqgwD5ONaTUaBmtic+lj8gwS43kgqF154wq5zmJ+6zFXQXXj/0pRDAk7AIVWA1 thtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866443; x=1792471243; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=RqoBVTvuWIA3oRwlp4pXxdSlrh9dq7DOjEbbCIaPUvY=; b=IZHRfsjYxiNuJZI4C2MtqDOovUfKje25NjlUj53RIi9gs73ehlWWuxIIiNoV7lWrMr MK6QPp9DgZ56zrtqf8qbmcg3gxiU/O8QZg2x0U1kk0Qix+ZpeaUGTXlSkbjLopfXpQQU lqz9nmMAm1u08IKEdRw9CHTQqcKcHEgJmq9U2PFIRALybYORADDW0E7Yafs6a/+HalFY VgQHnPvzHZpRfZPVPjKwUWTznnMhZFSXc28y7PX1DRJMpmE56uEfh1vAKBQaQFcjbFoh TcDfdifC6lvu1mlcQeBSsKdQo0wM/8XnDBhM1jIhLn8Gk1iStNgHmRA0ft5v4+ZIHqBl Leew== X-Gm-Message-State: AFq9FYJEA0yApzuUcZ/yVSIEcMUekJ977XzCbUOpdJjoZrFGsREUHt+6 bJX51Lg8Lwy3Nsr86GNSj8OVIxblGBPqlKjZfdFuXZB/PpyZRNQAjpkCm97nBA== X-Gm-Gg: AYBFou38QvpHz7HhcE/P2Cl4eWh8KqtGO1mYM9vXWLUvjzBuVHxYD/6JjvcLo0568mh /2JfwAxZgM1EQqYtN1LIll686myuQ4KhwwmOgClg75T5X8hj3/U6L7nOI9EQSAbLnOSElUkTPsY 1jMWgndF8VrAl31wmg12m3724AxavayFVctSZOyTbqn0bUUKF+hYqGkMWQ7LR0VRw8jvXouGBXx 7P2920QyzYbpES5zWGIb9djX9o7b/eAM9ZCKGuMqmtGmcQ9T7jvrIyGEOPRZAETRLSMcMrcbNnh dU+NDheRX7wTqFKuo9/EQ/1AD8pvTolXZOZGoMBkANOFvflswVdSV2X6BNLBlTG6x6SbZ4KDBtV TsnoQE1homUgoSUtI0SOjZrHz0vYFLzSYMG3z5YYIHl9c9yDa5swnPjz79+9wHwAiNUKCwJ7q4K YPPvgEJvHFYgALMPWMdy6bRt+/Tepqzsy1SiQWd5RrOccKf87wkp5w7naCvqkVu71etNM/EO4Be ZrQ6hU7brA4gFjNV27FgzPd4JM/SZRvRj5j+DdNXw== X-Received: by 2002:a17:90b:5444:b0:3a7:82ef:bcdd with SMTP id 98e67ed59e1d1-3ab3ab22794mr9089262a91.41.1791866442486; Mon, 12 Oct 2026 21:40:42 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:41 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 9/16] tesseract: patch CVE-2026-88052 Date: Tue, 13 Oct 2026 17:39:59 +1300 Message-ID: <20261013044006.834868-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130823 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88052 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 251dd7f80d1fc19515e162f5afd1eb889839bbaf) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88052.patch | 165 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 5 +- 2 files changed, 168 insertions(+), 2 deletions(-) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch new file mode 100644 index 0000000000..e55968135a --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch @@ -0,0 +1,165 @@ +From c60ad589ff3a645a3fdf13cb24fe719313145a06 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 18:34:33 +0200 +Subject: [PATCH] Reject unicharset files whose inserts desync id from unichars + +UNICHARSET::load_via_fgets reads the unichar count via sscanf and +trusts it as the loop bound, indexing the unichars vector with the +loop index id via the unchecked set_* accessors. unichar_insert is a +no-op for duplicate (or empty) representations, so once any insert +no-ops, unichars.size() falls behind id and the subsequent +set_*(id, ...) and unichars[id].properties writes land past the end +of the vector - a deterministic heap out-of-bounds write (including a +std::string assignment via set_normed) for every remaining line, on +both the LSTM and legacy init paths. A malformed unicharset with a +duplicate line (e.g. two identical entries) triggers it; a +non-positive header count likewise loads an empty unicharset +"successfully". + +Key changes: +- unicharset.cpp: reject unicharset_size <= 0, and after each insert + verify the vector actually grew to id + 1; on mismatch report the + offending line and reject the file instead of writing out of bounds. +- unittest: add unicharset_load_test with a duplicate-representation + unicharset (on unpatched code the test dies on the + container-overflow in load_via_fgets), a zero and a negative count, + and a positive control that a valid unicharset still loads. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 2d04d640db2e8c7e3bab2369d599343b5a8b8443) + +CVE: CVE-2026-88052 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/2d04d640db2e8c7e3bab2369d599343b5a8b8443] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 +++ + src/ccutil/unicharset.cpp | 12 ++++++ + unittest/unicharset_load_test.cc | 64 ++++++++++++++++++++++++++++++++ + 3 files changed, 81 insertions(+) + create mode 100644 unittest/unicharset_load_test.cc + +diff --git a/Makefile.am b/Makefile.am +index bec9ab0e..22c2c7a0 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1220,6 +1220,7 @@ check_PROGRAMS += tfile_test + if ENABLE_TRAINING + check_PROGRAMS += unichar_test + check_PROGRAMS += unicharcompress_test ++check_PROGRAMS += unicharset_load_test + check_PROGRAMS += unicharset_test + check_PROGRAMS += validate_grapheme_test + check_PROGRAMS += validate_indic_test +@@ -1493,6 +1494,10 @@ unicharcompress_test_SOURCES = unittest/unicharcompress_test.cc + unicharcompress_test_CPPFLAGS = $(unittest_CPPFLAGS) + unicharcompress_test_LDADD = $(TRAINING_LIBS) $(ICU_UC_LIBS) + ++unicharset_load_test_SOURCES = unittest/unicharset_load_test.cc ++unicharset_load_test_CPPFLAGS = $(unittest_CPPFLAGS) ++unicharset_load_test_LDADD = $(TESS_LIBS) ++ + unicharset_test_SOURCES = unittest/unicharset_test.cc + unicharset_test_CPPFLAGS = $(unittest_CPPFLAGS) + unicharset_test_LDADD = $(TRAINING_LIBS) $(ICU_UC_LIBS) +diff --git a/src/ccutil/unicharset.cpp b/src/ccutil/unicharset.cpp +index b29ec3b7..0e72ae48 100644 +--- a/src/ccutil/unicharset.cpp ++++ b/src/ccutil/unicharset.cpp +@@ -791,6 +791,9 @@ bool UNICHARSET::load_via_fgets( + sscanf(buffer, "%d", &unicharset_size) != 1) { + return false; + } ++ if (unicharset_size <= 0) { ++ return false; ++ } + for (UNICHAR_ID id = 0; id < unicharset_size; ++id) { + char unichar[256]; + unsigned int properties; +@@ -884,6 +887,15 @@ bool UNICHARSET::load_via_fgets( + } else { + this->unichar_insert_backwards_compatible(unichar); + } ++ // A duplicate or empty representation makes the insert a no-op, ++ // desynchronizing id from the unichars vector; the set_* calls and ++ // unichars[id] below would then write out of bounds. The file is ++ // malformed, so reject it. ++ if (size() != static_cast(id) + 1) { ++ fprintf(stderr, "%s:%d unichar %d has a duplicate or empty representation\n", ++ __FILE__, __LINE__, id); ++ return false; ++ } + + this->set_isalpha(id, properties & ISALPHA_MASK); + this->set_islower(id, properties & ISLOWER_MASK); +diff --git a/unittest/unicharset_load_test.cc b/unittest/unicharset_load_test.cc +new file mode 100644 +index 00000000..d775e233 +--- /dev/null ++++ b/unittest/unicharset_load_test.cc +@@ -0,0 +1,64 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: unicharset_load_test.cc ++// Description: Tests that UNICHARSET::load_via_fgets rejects unicharset ++// files whose insertions desynchronize the id loop index ++// from the unichars vector (duplicate or empty ++// representations), which would make the subsequent set_* ++// calls write out of bounds, and non-positive size counts. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "serialis.h" // for TFile ++#include "unicharset.h" ++ ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Loads the given unicharset text via the TFile-based loader. ++bool LoadUnicharset(const char *text, UNICHARSET *unicharset) { ++ TFile fp; ++ if (!fp.Open(text, std::strlen(text))) { ++ return false; ++ } ++ return unicharset->load_from_file(&fp, false); ++} ++ ++// A duplicate representation makes the second insert a no-op, so on ++// unpatched code the set_* calls for the remaining lines write past ++// the end of the unichars vector (ASan container-overflow). ++TEST(UnicharsetLoadTest, RejectsDuplicateRepresentation) { ++ const char *text = "3\nA 0 Latin\nA 0 Latin\nB 0 Latin\n"; ++ UNICHARSET unicharset; ++ EXPECT_FALSE(LoadUnicharset(text, &unicharset)); ++} ++ ++// A non-positive size count must be rejected; on unpatched code a ++// zero or negative count loads an empty unicharset successfully. ++TEST(UnicharsetLoadTest, RejectsNonPositiveCount) { ++ const char *texts[] = {"0\n", "-1\n"}; ++ for (const char *text : texts) { ++ UNICHARSET unicharset; ++ EXPECT_FALSE(LoadUnicharset(text, &unicharset)); ++ } ++} ++ ++// A valid unicharset must still be accepted. ++TEST(UnicharsetLoadTest, AcceptsValidUnicharset) { ++ const char *text = "3\nA 0 Latin\nB 0 Latin\nC 0 Latin\n"; ++ UNICHARSET unicharset; ++ ASSERT_TRUE(LoadUnicharset(text, &unicharset)); ++ EXPECT_EQ(unicharset.size(), 3u); ++ EXPECT_STREQ(unicharset.id_to_unichar(1), "B"); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 0d9b178dc9..81359b761b 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -6,8 +6,9 @@ LICENSE = "Apache-2.0" LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" -SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV}" - +SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ + file://CVE-2026-88052.patch \ +" DEPENDS = "leptonica" From patchwork Tue Oct 13 04:40:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100545 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7E076CC6B09 for ; Tue, 13 Oct 2026 04:40:51 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.356.1791866445976280243 for ; Mon, 12 Oct 2026 21:40:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=pN0u1j61; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3ab33730821so1375627a91.3 for ; Mon, 12 Oct 2026 21:40:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866445; x=1792471245; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9Xu+zkfTcubefsRDXfR68Hr9MeQvRbPWzNonwptWFoY=; b=pN0u1j61sfRuHJt4RDebh8aoIvodOe91H3uKBemDhNX9wHkv2in6c+iKvqGuOWSbOB 5MkXAy8A8fKkk/Gi5neDcSZeCsWZrI1Hy71yGpnEnSG4SU34JNYfHgF7/SMM6Hr2k8o6 c1PUjOL41IVXFNOo35gbO7mGFVd0qV3Hdl0G2jFdtoZQsm9Qoc2iUIpaMtQvgU9fP+ai Dy5px+HxRnUoerRg/B9na9NY3MUfnO+iko+GVwf9qJOxtQ09c1o4/Pvr5JonoptoIyj5 wMuwuAOhKsfmgAbYcHRJXWRTEb4GBUzLtomfeJHAhmLf3VUP+huWSXrnV7U3TGuxi+kN t/Eg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866445; x=1792471245; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9Xu+zkfTcubefsRDXfR68Hr9MeQvRbPWzNonwptWFoY=; b=lmjELp19kCsJxe3i5Fu+Qvr6I0EfF5aaIRBUaOG3hRz+jlEyd5gu2tAwYgpCwzQsvX Fexvslo0Z4a+E5clSChCICoo84cG2Yp50rewHTx9L2Rg2e7lgVT+bm4xmCMQdyII0e7T yFZx9gKo7hLjMgci47vI+JuLWiOM8p+oPFwkZVv/VI6xIoiwcX5Ngjjx9IVainIfB5mr 03TG/gZRLqUu/RCic4gpLLWYP46rosQ2aHSnHFUUdWalzTl5jI/B9QdtrTxe3I2b+d7p fvEzv649EGG+J0d6/6PYK8UQAEH9MogVzn7rVe1xuMCEID31NPDZHpeouh9n0v3JO3FQ Bh0g== X-Gm-Message-State: AFq9FYKersA//ZR3dzTEgbvXGQMYRXnSvgJiSBRaKTCgyX+mjF66/hVE 5k4wL53+nbHS8kIzIPd2ogDucnJIBi/TK/RmHhrMcVaO3soVF99Ea7EygV86Hg== X-Gm-Gg: AYBFou1JlTvuvffuygHitAYRgdB7tuE2KYSZa7mUXBvHbX+gaL4RGr7t7KxEqHOkbiC pmT+kBkY4fyvJ4AdeIT4E0wMeCWMbWAWkm5AOHnP0MvMMycoEjuyEPN5IIdE3gCYOwIVrM2vh4T rAOnhmkKvBK/bUUet3lL7sGXkct4kcGaklyLnSGNi1IaOkM/lizOBQMSi4O74X09EZpwN/Ftc5y aeiBl66bC9cTYtiU13TOFP6M7BLhzDikMlDwureJ/zTZpk5QTPeB8b3g9u6AReYVt2pAQYhZvzs MK9U6NUdoKZ7vuRcCRgG8p4Z8X6oh+soz9FkuWCfJ0EthC/La/TNWM/1wivDFeFNDOjfAT5IBMM 7qfl00+0f8LChBnBExKWPo/0Co81JKr8Kj+z5+NSxn4yR8doy/8pk0lHu16tBOZDD3usjM+H/aH FbTHc9L40q+vxTC1z4KgmAKuhsAbsWGp0YeioNZ49ld7uiukwNisDrds4PGFymlX0avTehMke8K FVv/ruU06DfScOuPrFEjpoEH1svpe/TyYze0TY= X-Received: by 2002:a17:90b:28ce:b0:3a0:809b:1972 with SMTP id 98e67ed59e1d1-3ab3a745e5bmr9021459a91.26.1791866445161; Mon, 12 Oct 2026 21:40:45 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:44 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 10/16] tesseract: patch CVE-2026-88048 Date: Tue, 13 Oct 2026 17:40:00 +1300 Message-ID: <20261013044006.834868-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130824 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88048 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 9e544d6e5087f701a0d6a9d66ae3f87b6dcc8c5e) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88048.patch | 227 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 228 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch new file mode 100644 index 0000000000..abfd502667 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch @@ -0,0 +1,227 @@ +From b2fbc8282c34f0a5a426622a9eb6a79ad0df0fe4 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 15:23:59 +0200 +Subject: [PATCH] Validate FullyConnected weight matrix dimensions at load + +FullyConnected::DeSerialize read the WeightMatrix without checking +that its dimensions match the layer's declared ni/no. MatrixDotVector +drives the dot product from the matrix dimensions (writes w.dim1() +results, reads w.dim2()-1 inputs) while the scratch buffers are sized +from no_ and ni_, so a crafted .traineddata with a mismatched matrix +performed a heap out-of-bounds write (up to 65535 rows) and out-of- +bounds read on the first recognition step (crash, or heap corruption +with attacker-influenced size and content). + +Key changes: +- weightmatrix.h: add Dim1()/Dim2() accessors for the active weight + matrix (int or float), alongside the existing NumOutputs(). +- fullyconnected.cpp: reject the layer in DeSerialize unless + Dim1() == no_ and Dim2() == ni_ + 1 (the second dimension + includes the bias column), the layout that InitWeightsFloat + always produces. +- unittest: new fullyconnected_test that builds a Softmax network + with mismatched matrix dimensions and expects CreateFromFile to + return nullptr; on unpatched code the test reaches Forward and + ASan catches the out-of-bounds write in MatrixDotVector. A + second test verifies that matching dimensions are still accepted. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 103dc134eb36411ddc6833ec20aa2c76795bd0ff) + +CVE: CVE-2026-88048 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/103dc134eb36411ddc6833ec20aa2c76795bd0ff] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/lstm/fullyconnected.cpp | 11 ++- + src/lstm/weightmatrix.h | 7 ++ + unittest/fullyconnected_test.cc | 115 ++++++++++++++++++++++++++++++++ + 4 files changed, 137 insertions(+), 1 deletion(-) + create mode 100644 unittest/fullyconnected_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 22c2c7a0..284f8b53 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1158,6 +1158,7 @@ if !DISABLED_LEGACY_ENGINE + check_PROGRAMS += equationdetect_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += fileio_test ++check_PROGRAMS += fullyconnected_test + check_PROGRAMS += heap_test + check_PROGRAMS += imagedata_test + if !DISABLED_LEGACY_ENGINE +@@ -1290,6 +1291,10 @@ fileio_test_SOURCES = unittest/fileio_test.cc + fileio_test_CPPFLAGS = $(unittest_CPPFLAGS) + fileio_test_LDADD = $(TRAINING_LIBS) + ++fullyconnected_test_SOURCES = unittest/fullyconnected_test.cc ++fullyconnected_test_CPPFLAGS = $(unittest_CPPFLAGS) ++fullyconnected_test_LDADD = $(TESS_LIBS) ++ + heap_test_SOURCES = unittest/heap_test.cc + heap_test_CPPFLAGS = $(unittest_CPPFLAGS) + heap_test_LDADD = $(TESS_LIBS) +diff --git a/src/lstm/fullyconnected.cpp b/src/lstm/fullyconnected.cpp +index a0ee1b02..d999f575 100644 +--- a/src/lstm/fullyconnected.cpp ++++ b/src/lstm/fullyconnected.cpp +@@ -121,7 +121,16 @@ bool FullyConnected::Serialize(TFile *fp) const { + + // Reads from the given file. Returns false in case of error. + bool FullyConnected::DeSerialize(TFile *fp) { +- return weights_.DeSerialize(IsTraining(), fp); ++ if (!weights_.DeSerialize(IsTraining(), fp)) { ++ return false; ++ } ++ // The weight matrix must match the declared sizes (the second dimension ++ // includes the bias column); otherwise Forward would read or write ++ // outside the scratch buffers sized from ni_ and no_. ++ if (weights_.Dim1() != no_ || weights_.Dim2() != ni_ + 1) { ++ return false; ++ } ++ return true; + } + + // Runs forward propagation of activations on the input line. +diff --git a/src/lstm/weightmatrix.h b/src/lstm/weightmatrix.h +index eaca3ffb..6c5ab236 100644 +--- a/src/lstm/weightmatrix.h ++++ b/src/lstm/weightmatrix.h +@@ -107,6 +107,13 @@ public: + int NumOutputs() const { + return int_mode_ ? wi_.dim1() : wf_.dim1(); + } ++ // The dimensions of the active weight matrix (wi_ in int mode, else wf_). ++ int Dim1() const { ++ return int_mode_ ? wi_.dim1() : wf_.dim1(); ++ } ++ int Dim2() const { ++ return int_mode_ ? wi_.dim2() : wf_.dim2(); ++ } + // Provides one set of weights. Only used by peep weight maxpool. + const TFloat *GetWeights(int index) const { + return wf_[index]; +diff --git a/unittest/fullyconnected_test.cc b/unittest/fullyconnected_test.cc +new file mode 100644 +index 00000000..f9697de4 +--- /dev/null ++++ b/unittest/fullyconnected_test.cc +@@ -0,0 +1,115 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: fullyconnected_test.cc ++// Description: Tests that a FullyConnected (softmax) network layer with ++// weight-matrix dimensions that do not match the declared ++// ni/no is rejected at load. Without the check, ++// MatrixDotVector writes w.dim1() results into a scratch ++// buffer sized from no_ and reads w.dim2()-1 inputs from ++// a buffer sized from ni_ (heap out-of-bounds write/read) ++// on the first recognition step. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "network.h" // for Network, NetworkType ++#include "networkio.h" ++#include "networkscratch.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++void PutDoubleLE(ByteWriter *w, double d) { ++ union { ++ double d; ++ uint64_t u; ++ } conv; ++ conv.d = d; ++ w->PutU32(static_cast(conv.u & 0xFFFFFFFF)); ++ w->PutU32(static_cast(conv.u >> 32)); ++} ++ ++// Builds a serialized NT_SOFTMAX network: header with the given ni/no, ++// then a float-mode WeightMatrix with the given (corrupt) dimensions. ++// The matrix is stored as doubles on disk (see WeightMatrix::DeSerialize). ++std::vector MakeSoftmaxNetwork(int ni, int no, int32_t dim1, int32_t dim2) { ++ ByteWriter w; ++ w.PutU8(static_cast(NT_SOFTMAX)); ++ w.PutU8(0); // training: TS_DISABLED ++ w.PutU8(0); // needs_to_backprop ++ w.PutU32(0); // network_flags ++ w.PutU32(static_cast(ni)); ++ w.PutU32(static_cast(no)); ++ w.PutU32(0); // num_weights (not cross-checked, kept consistent anyway) ++ w.PutU32(0); // name (empty string) ++ // WeightMatrix::DeSerialize: ++ w.PutU8(128); // mode: kDoubleFlag, float mode ++ w.PutS32(dim1); ++ w.PutS32(dim2); ++ PutDoubleLE(&w, 0.0); // empty_ cell ++ for (int32_t i = 0; i < dim1 * dim2; ++i) { ++ PutDoubleLE(&w, 0.0); // weight data ++ } ++ return w.data(); ++} ++ ++// A FullyConnected layer whose weight matrix does not match the declared ++// sizes must be rejected by CreateFromFile; on unpatched code the test ++// reaches Forward, where MatrixDotVector performs the out-of-bounds ++// write this regression test guards against. ++TEST(FullyconnectedTest, RejectsWeightMatrixDimensionMismatch) { ++ // ni_=no_=1 but dim1=3 (OOB write of 3 results into a 1-result buffer) ++ // and dim2=5 (OOB read of 4 inputs from a 1-input buffer). ++ std::vector bytes = MakeSoftmaxNetwork(1, 1, 3, 5); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the mismatched layer is rejected at load. ++ } ++ NetworkIO input; ++ input.Resize2d(false, /*width=*/1, /*num_features=*/1); ++ NetworkScratch scratch; ++ NetworkIO output; ++ net->Forward(false, input, nullptr, &scratch, &output); ++ delete net; ++ FAIL() << "crafted FullyConnected layer with mismatched weight matrix was accepted"; ++} ++ ++// Consistent dimensions must still be accepted. ++TEST(FullyconnectedTest, AcceptsMatchingDimensions) { ++ std::vector bytes = MakeSoftmaxNetwork(1, 2, 2, 2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ ASSERT_NE(net, nullptr); ++ delete net; ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 81359b761b..bed16f9806 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ file://CVE-2026-88052.patch \ + file://CVE-2026-88048.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 04:40:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100544 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E0ADCC6B03 for ; Tue, 13 Oct 2026 04:40:51 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.357.1791866448808512546 for ; Mon, 12 Oct 2026 21:40:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YSBknNL4; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-3ab98332238so1207893a91.3 for ; Mon, 12 Oct 2026 21:40:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866448; x=1792471248; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0jtEXI6DzBOUNNFoHZSKvXiTIYRqf/dnrlUdsu1s60M=; b=YSBknNL4KGiR/SzSzorvA/YbFksULqsyf5G35fCcPF+JjcG/AOw2qR8zDeOKAxAZLD tCoYX0I4jEZkV7VAl/PJPY0eeTTLrt6mtH8il7VNNZ46klCueyBrO/Xi2GblblEdB6NM m4Q1JfOxvzMyVY8kl6dBtIgBN2RPW6BO0Gp4odRPpupKEHuX3CfaXAckvZdNZ+EC4693 LK4xfyL89BXjC7/KlT0Om1Yo3JUVLHCIhwP4NSHKHuo4ZqyhCsD2ns7HIVLdAK9xnIST G/H0HRE3+htp5i2lmMLn9YaX1t0nsWAOs4a450klphmKZAkrYqh3jGDVNhmK+89m98Kb 5Dxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866448; x=1792471248; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0jtEXI6DzBOUNNFoHZSKvXiTIYRqf/dnrlUdsu1s60M=; b=dcGMi7A8bExmD9QdWCtGJMgegqB+x1SsIr5De4Mt5Hhn5qYXIGfaCheCOApKJjugn2 wD/zWVd2mX90XC5mCJCywLkOzbDRLrFHix7LgUs5HQQtU770lGpnnknUXy2taq6yT9Gf CXM42JmI0mQE5FzT1+vSyDDjrfM8sF3y1uDzy0EkwX6RijSTZ+E5SI6OODhM1hSwIJ1Q onTtKncl6XARSFYL5vSvxN7BLNceXsmZDCTiu6KZD/viv+T1ShgQpoC327NXbdWBiN5h ZNAb6lnFmc2h9sflNhP0Je219kva+CR1U9T6tbvEkJg751RpLIZpB/yQkQ/rMgBIpKpG bpfg== X-Gm-Message-State: AFq9FYKEzmONKu4D7Wu+rStZR5hCFpHx3kDw4m/9dNbqJI7zAhhYeuSr uJIrPM9QGQzy/j0faEuwO3pig7zGjjeY07pXhcd/WIYOvsAe2qxBoAre5S5DPg== X-Gm-Gg: AYBFou1I3AhaGrZQ5vKQgaW0nVgFah6pdm1xY2lOSwl3Ah0NkpYbO7Ou9rk3xw8nTJm A3MGE058cMZvRKNERyKiwTmWFH3tOIwBHnFvveOVjhswvEbQ86sfGu6cwwArlaQEuLnDrmmbUOS zwL/8U4P8VYIOQt9ULDT0sz5TSrLlzAgtKcvVwkBg+ku3EPRit2c4myQZRXKFttNGFkYz4tYhTb /e7UDxrZfZyDYNsrrw0uv4RrTl97VoJhAISuGVm+4iCt1AOPaQ3j0dsIMAegwnQFfSYZIlSoZce qSIng45EVGHj9T0HVk0GhggfLU+w7e3OxRzu5lkNHCuuhVRXxAruamIm3acBv/WGOjtSN94dA49 K4xOWF59oOGH43rB4wvSTQpksJ3DEbUZ8tM90IvsDu9VkL9H/oBA2DcuFWjQyq7b1GB4ngsbKo8 oDJffzRAASStFjKlm3f7tBvo84mjNYoh+zc7BLjG14evZW4E8PuZMRbD2Fswe/3fxZy2eumiO8O 2eW7KF65o4QquSpG2DY/a9d0P6pp/PHaZoGEKo= X-Received: by 2002:a17:90b:5444:b0:39e:6a7e:ee18 with SMTP id 98e67ed59e1d1-3ab3ad26901mr8014057a91.36.1791866447929; Mon, 12 Oct 2026 21:40:47 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:47 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 11/16] tesseract: patch CVE-2026-88049 Date: Tue, 13 Oct 2026 17:40:01 +1300 Message-ID: <20261013044006.834868-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:40:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130825 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88049 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 218b6a19b168587a67d1eab85160c302013164db) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88049.patch | 315 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 316 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch new file mode 100644 index 0000000000..b6a5e5275d --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch @@ -0,0 +1,315 @@ +From 62fabbca097d127e7d5a8fe3869102d2e4918b80 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 16:41:51 +0200 +Subject: [PATCH] Validate LSTM gate matrix dimensions against na_/no_ at load + +LSTM::DeSerialize read na_ from the untrusted TESSDATA_LSTM component +and derived ns_ from the CI gate matrix's dim1, but never checked that +the deserialized dimensions were mutually consistent. The forward pass +sizes its buffers from na_, no_ and ns_ while the gate matrices drive +their own dimensions, so a crafted .traineddata performed heap +out-of-bounds writes and reads during the first recognition step, e.g. +WriteTimeStepPart writing ns_ floats at offset ni_+nf_ into a source_ +buffer sized from na_ (up to ~256 KB with an attacker-chosen gate +matrix dim1). + +The bounds assertions added by 2f4d2f4 (CVE-2026-73066) covered only +NetworkIO::CopyTimeStepGeneral and Randomize, leaving +WriteTimeStepPart and AddTimeStepPart unguarded. + +Key changes: +- weightmatrix.h: add Dim1()/Dim2() accessors for the active weight + matrix (int or float), alongside the existing NumOutputs(). +- lstm.cpp: reject the layer in DeSerialize unless na_ == + ni_ + nf_ + (is_2d_ ? 2 : 1) * ns_, every deserialized gate has + Dim1() == ns_ and Dim2() == na_ + 1 (the layout InitWeightsFloat + always produces), ns_ == no_ for plain NT_LSTM/NT_LSTM_SUMMARY, and + the softmax layer's sizes match ns_/no_ for the softmax variants. +- networkio.cpp: add the same defense-in-depth bounds assertions to + WriteTimeStepPart and AddTimeStepPart as 2f4d2f4 added to + CopyTimeStepGeneral and Randomize. +- unittest: add lstm_layer_test with crafted NT_LSTM layers for the + na_ mismatch, gate dim1 mismatch, and gate dim2 mismatch cases + (each rejected at load; on unpatched code the tests reach Forward + and ASan catches the out-of-bounds write in WriteTimeStepPart), + plus a positive control that a consistent layer loads and runs. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit b494ac18925f9d9aff9ef5815475de9943ab19bf) + +CVE: CVE-2026-88049 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 + + src/lstm/lstm.cpp | 20 ++++ + src/lstm/networkio.cpp | 2 + + unittest/lstm_layer_test.cc | 177 ++++++++++++++++++++++++++++++++++++ + 4 files changed, 204 insertions(+) + create mode 100644 unittest/lstm_layer_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 284f8b53..4bcc858b 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1171,6 +1171,7 @@ check_PROGRAMS += layout_test + check_PROGRAMS += ligature_table_test + check_PROGRAMS += linlsq_test + check_PROGRAMS += list_test ++check_PROGRAMS += lstm_layer_test + if ENABLE_TRAINING + check_PROGRAMS += lstm_recode_test + check_PROGRAMS += lstm_squashed_test +@@ -1352,6 +1353,10 @@ loadlang_test_SOURCES = unittest/loadlang_test.cc + loadlang_test_CPPFLAGS = $(unittest_CPPFLAGS) + loadlang_test_LDADD = $(TESS_LIBS) $(LEPTONICA_LIBS) + ++lstm_layer_test_SOURCES = unittest/lstm_layer_test.cc ++lstm_layer_test_CPPFLAGS = $(unittest_CPPFLAGS) ++lstm_layer_test_LDADD = $(TESS_LIBS) ++ + lstm_recode_test_SOURCES = unittest/lstm_recode_test.cc + lstm_recode_test_CPPFLAGS = $(unittest_CPPFLAGS) + lstm_recode_test_LDADD = $(TRAINING_LIBS) +diff --git a/src/lstm/lstm.cpp b/src/lstm/lstm.cpp +index 7bfd19b5..bfffa5de 100644 +--- a/src/lstm/lstm.cpp ++++ b/src/lstm/lstm.cpp +@@ -274,12 +274,32 @@ bool LSTM::DeSerialize(TFile *fp) { + is_2d_ = na_ - nf_ == ni_ + 2 * ns_; + } + } ++ // The deserialized dimensions must be mutually consistent: the forward ++ // pass sizes its buffers from na_, no_ and ns_ while the gate matrices ++ // drive their own dimensions. ++ if (na_ != ni_ + nf_ + (is_2d_ ? 2 : 1) * ns_) { ++ return false; ++ } ++ for (int w = 0; w < WT_COUNT; ++w) { ++ if (w == GFS && !Is2D()) { ++ continue; ++ } ++ if (gate_weights_[w].Dim1() != ns_ || gate_weights_[w].Dim2() != na_ + 1) { ++ return false; ++ } ++ } ++ if ((type_ == NT_LSTM || type_ == NT_LSTM_SUMMARY) && ns_ != no_) { ++ return false; ++ } + delete softmax_; + if (type_ == NT_LSTM_SOFTMAX || type_ == NT_LSTM_SOFTMAX_ENCODED) { + softmax_ = static_cast(Network::CreateFromFile(fp)); + if (softmax_ == nullptr) { + return false; + } ++ if (softmax_->NumInputs() != ns_ || softmax_->NumOutputs() != no_) { ++ return false; ++ } + } else { + softmax_ = nullptr; + } +diff --git a/src/lstm/networkio.cpp b/src/lstm/networkio.cpp +index 8e1c6679..7a31034b 100644 +--- a/src/lstm/networkio.cpp ++++ b/src/lstm/networkio.cpp +@@ -641,6 +641,7 @@ void NetworkIO::AddTimeStep(int t, TFloat *inout) const { + + // Adds part of a single timestep to floats. + void NetworkIO::AddTimeStepPart(int t, int offset, int num_features, float *inout) const { ++ ASSERT_HOST(offset + num_features <= NumFeatures()); + if (int_mode_) { + const int8_t *line = i_[t] + offset; + for (int i = 0; i < num_features; ++i) { +@@ -662,6 +663,7 @@ void NetworkIO::WriteTimeStep(int t, const TFloat *input) { + // Writes a single timestep from floats in the range [-1, 1] writing only + // num_features elements of input to (*this)[t], starting at offset. + void NetworkIO::WriteTimeStepPart(int t, int offset, int num_features, const TFloat *input) { ++ ASSERT_HOST(offset + num_features <= NumFeatures()); + if (int_mode_) { + int8_t *line = i_[t] + offset; + for (int i = 0; i < num_features; ++i) { +diff --git a/unittest/lstm_layer_test.cc b/unittest/lstm_layer_test.cc +new file mode 100644 +index 00000000..2c874995 +--- /dev/null ++++ b/unittest/lstm_layer_test.cc +@@ -0,0 +1,177 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: lstm_layer_test.cc ++// Description: Tests that an NT_LSTM network layer with mutually ++// inconsistent deserialized dimensions is rejected at ++// load. The forward pass sizes its buffers from na_, no_ ++// and ns_ while the gate weight matrices drive their own ++// dimensions, so a crafted .traineddata performs heap ++// out-of-bounds writes/reads during the first ++// recognition step (e.g. WriteTimeStepPart writing ns_ ++// floats into a source_ buffer sized from na_). ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "network.h" // for Network, NetworkType ++#include "networkio.h" ++#include "networkscratch.h" ++#include "serialis.h" // for TFile ++#include "stridemap.h" ++ ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++void PutDoubleLE(ByteWriter *w, double d) { ++ union { ++ double d; ++ uint64_t u; ++ } conv; ++ conv.d = d; ++ w->PutU32(static_cast(conv.u & 0xFFFFFFFF)); ++ w->PutU32(static_cast(conv.u >> 32)); ++} ++ ++// A serialized float-mode WeightMatrix with the given dimensions, ++// all weight data zeroed. ++void PutGateMatrix(ByteWriter *w, int32_t dim1, int32_t dim2) { ++ w->PutU8(128); // mode: kDoubleFlag, float mode ++ w->PutS32(dim1); ++ w->PutS32(dim2); ++ PutDoubleLE(w, 0.0); // empty_ cell ++ for (int32_t i = 0; i < dim1 * dim2; ++i) { ++ PutDoubleLE(w, 0.0); ++ } ++} ++ ++// A serialized 1-D NT_LSTM network: header with the given ni/no, na_, ++// then the four gates CI, GI, GF1, GO (GFS is not serialized for 1-D). ++std::vector MakeLstmNetwork(int ni, int no, int32_t na, ++ const int32_t gate_dim1[4], const int32_t gate_dim2[4]) { ++ ByteWriter w; ++ w.PutU8(static_cast(NT_LSTM)); ++ w.PutU8(0); // training: TS_DISABLED ++ w.PutU8(0); // needs_to_backprop ++ w.PutU32(0); // network_flags ++ w.PutU32(static_cast(ni)); ++ w.PutU32(static_cast(no)); ++ w.PutU32(0); // num_weights ++ w.PutU32(0); // name (empty string) ++ w.PutS32(na); ++ for (int g = 0; g < 4; ++g) { ++ PutGateMatrix(&w, gate_dim1[g], gate_dim2[g]); ++ } ++ return w.data(); ++} ++ ++// Builds the input a standalone LSTM layer would receive: one row of ++// the given width with ni features. ++NetworkIO MakeInput(int ni, int width) { ++ StrideMap stride_map; ++ stride_map.SetStride({{1, width}}); ++ NetworkIO input; ++ input.ResizeToMap(false, stride_map, ni); ++ return input; ++} ++ ++// Runs Forward on the loaded network; on unpatched code the out-of- ++// bounds access this regression test guards against fires here. ++void RunForward(Network *net, int ni, int width) { ++ NetworkIO input = MakeInput(ni, width); ++ NetworkScratch scratch; ++ NetworkIO output; ++ net->Forward(false, input, nullptr, &scratch, &output); ++ delete net; ++} ++ ++// na_ must equal ni_ + nf_ + ns_ for a 1-D LSTM; here na_=2 but the ++// CI matrix makes ns_=64, so the layer must be rejected. On unpatched ++// code Forward writes 64 floats at offset ni_=1 into a source_ buffer ++// sized for na_=2 (heap out-of-bounds write). ++TEST(LstmLayerTest, RejectsInconsistentNa) { ++ const int32_t dim1[4] = {64, 64, 64, 64}; ++ const int32_t dim2[4] = {3, 3, 3, 3}; ++ std::vector bytes = MakeLstmNetwork(1, 1, 2, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent na_ was accepted"; ++} ++ ++// All gate matrices must have dim1 == ns_; here the GI matrix has ++// dim1=9 while ns_=5. On unpatched code the GI gate dot product writes ++// 9 results into a temp line sized for 5 (heap out-of-bounds write). ++TEST(LstmLayerTest, RejectsGateDim1Mismatch) { ++ const int32_t dim1[4] = {5, 9, 5, 5}; ++ const int32_t dim2[4] = {7, 7, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent gate dim1 was accepted"; ++} ++ ++// All gate matrices must have dim2 == na_ + 1; here the GI matrix has ++// dim2=9 while na_=6. On unpatched code the GI gate dot product reads ++// 8 inputs from a buffer sized for 6 (heap out-of-bounds read). ++TEST(LstmLayerTest, RejectsGateDim2Mismatch) { ++ const int32_t dim1[4] = {5, 5, 5, 5}; ++ const int32_t dim2[4] = {7, 9, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent gate dim2 was accepted"; ++} ++ ++// A fully consistent 1-D LSTM layer must still be accepted and usable. ++TEST(LstmLayerTest, AcceptsConsistentLayer) { ++ const int32_t dim1[4] = {5, 5, 5, 5}; ++ const int32_t dim2[4] = {7, 7, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ ASSERT_NE(net, nullptr); ++ RunForward(net, 1, 2); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index bed16f9806..24c8312552 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -9,6 +9,7 @@ SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ file://CVE-2026-88052.patch \ file://CVE-2026-88048.patch \ + file://CVE-2026-88049.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 04:40:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100546 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79E21CC6B09 for ; Tue, 13 Oct 2026 04:41:01 +0000 (UTC) Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.359.1791866451493299334 for ; Mon, 12 Oct 2026 21:40:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=lfJRWFtY; spf=pass (domain: gmail.com, ip: 209.85.215.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-cd5d2dafeccso893619a12.2 for ; Mon, 12 Oct 2026 21:40:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866451; x=1792471251; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3R3PIVwduR84cNu++N7KgpS36Y6qS/pdF5Wj1ZB5rm8=; b=lfJRWFtYbxmWBIkiq9JI6zgKTDqmIrD8wgdMhmHHVL4lY9z+8PYypDNfdPaw57hvNr hfpK1GjNfK9z8fgViCks4EqRVTuKPOZRsU3kCwlNEKMwZPVXJ+JfBa6ka45H4mjRgofx 8LqPwhg2HJk7nRXiszSie7ZhweBcw6vkSYoTBINcIVk1uyaB/enKJE0bqxWsscwpbR51 f5XyJe/+HFFX0F7++QyJTPQFq0lEG8xE7ivthnLvqoScKNk2dfnfDZE/Jx7pwQR0ugbf waYYrwqDmuugOp5bgBfP9qP8NcsDLoFwsesIdaQVfZFhvm6HZ2kJpfijEdq766K2k4P3 pIoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866451; x=1792471251; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=3R3PIVwduR84cNu++N7KgpS36Y6qS/pdF5Wj1ZB5rm8=; b=FmOUmSGph0btzat9i9UWqG9GZJeRjhg8QI5B+ildYna/HrIL5o1gyYgKW+rVY5moeB eWY97mziT4uTZAj92PR3IBlmZaz7gH2D9M02uuISCpx1Q066QURXmRoWCo8995n854JF 4YGb1LhKk84JIz+Fy0UeLXWh758OI4f3imB1awmLfG6AN8QYJZDZvZp+veqdpbw6w1Cc nWQ/JhDNiAW8m57hbGbmXxoMVseOhmypvzL92V60HRbcMQU9pd2IQl6wuqc9EF7DIKrG npjlmlGoT+gQp8TbnvvKiRi5iazspEAJFOdHMlmkKKVSIWSRS00+ZLT/EO503w4FSOk8 zRZA== X-Gm-Message-State: AFq9FYIAj3n5nxDZsL5lnrPXamWlwyAViu8o/sz7qmVXwB1kZooGvhad hBIxjuNb2gWcdqaVTKMoseTg4mUdfzAo/vaTf4t/lgHscyxdkOKrIg/E9DwFBg== X-Gm-Gg: AYBFou1SYEyMMXvCvbteFF1e2vsylWj4ZPUgrGrqxHjW3zpY3qwjurstrGkjznDux1E iKKQxct6IYX/ysnfOcM5RVvR3Rq1rGIyMMNge4hrd7wYmrWPi+Fkg9NOTr6gkN+Kqcnf9uFbpTk xk18I8fuu/AXXA2jz+MUBtq+utBWKBVwOgQl3EQAQcC/kNKLUacmMZc2+jFe4ZHFvYmEPjwAeo4 Cl+eMa1nyJRVxjS5LOa0MnwKQ3fAB38EVJPe2YKTVFY/YKEF2AAnHqahNoEl8iGMpvVYx+Ndue7 R4/7rJ6MclDmPTxdnco+QhuFp14+qY+51AsZ+h5K2Hv4MQnnIe5OXY/QxP3tL+jWq6yfCtoWhPx 5yVcN94m2HKw2smgHJr/I+KBsAmH/nST5GdvzIKffS2NofDQ0qumaq9T0bKRBc68lkSZM3yHV46 h0NDcbYyJXdzlxB2JCW9MA05GZmdaoHaiXFLHkhB31ynr7SG6p82uwbXDOAYdlK/XsB3WEm5rnr Dtvw51QxDQLJODI+iuqyFnDbymBGH9x/vRdIYgz3g== X-Received: by 2002:a17:90b:4d02:b0:3ab:8a06:1b0c with SMTP id 98e67ed59e1d1-3ab8a061d3fmr6037724a91.36.1791866450565; Mon, 12 Oct 2026 21:40:50 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:50 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 12/16] tesseract: patch CVE-2026-88050 Date: Tue, 13 Oct 2026 17:40:02 +1300 Message-ID: <20261013044006.834868-12-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:41:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130826 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88050 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4aab0847c2e6b786437d140dd3c589e6773b9224) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88050.patch | 209 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 210 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch new file mode 100644 index 0000000000..21fa5e9a67 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch @@ -0,0 +1,209 @@ +From 5426c23fe7fe32b62bd5694f68f71772f273c821 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 16:56:51 +0200 +Subject: [PATCH] Reject recoder code values outside the sane range at load + +RecodedCharID::DeSerialize (hardened by 82727cc to check length_ +only) still read the individual code values as raw signed int32. +UnicharCompress::ComputeCodeRange computes code_range_ as 1 plus the +maximum code using a signed > comparison, so a code value of -1 +never raises the maximum and yields code_range_ = 0. SetupDecoder +then resizes is_valid_start_ to 0 and writes is_valid_start_[code(0)] +on the size-0 vector, an out-of-bounds write at a wild wrapped +index (deterministic crash) on LSTMRecognizer load. A code value of +INT32_MAX instead wraps code_range_ negative and makes resize() +throw. + +Key changes: +- unicharcompress.h: validate each deserialized code value to be + within [0, UINT16_MAX), the same arbitrary cap used elsewhere for + .traineddata counts; reject the recoder otherwise. +- unicharcompress.h/.cpp: add defense-in-depth bounds assertions to + IsValidFirstCode and SetupDecoder, matching the style of the + NetworkIO assertions from 2f4d2f4. +- unittest: add recoder_test, which feeds a crafted UnicharCompress + with a -1 code and an INT32_MAX code and expects DeSerialize to + fail (on unpatched code the -1 case dies on the SEGV in + SetupDecoder, the huge case on the uncaught length_error), plus a + positive control that valid codes load and answer + code_range()/IsValidFirstCode() correctly. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit c94a5532ee04db5a4919542832fd94caee5ea58f) + +CVE: CVE-2026-88050 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/c94a5532ee04db5a4919542832fd94caee5ea58f] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccutil/unicharcompress.cpp | 1 + + src/ccutil/unicharcompress.h | 13 ++++- + unittest/recoder_test.cc | 91 ++++++++++++++++++++++++++++++++++ + 4 files changed, 109 insertions(+), 1 deletion(-) + create mode 100644 unittest/recoder_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 4bcc858b..63ca6686 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1202,6 +1202,7 @@ endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += progress_test + check_PROGRAMS += qrsequence_test + check_PROGRAMS += recodebeam_test ++check_PROGRAMS += recoder_test + check_PROGRAMS += rect_test + check_PROGRAMS += resultiterator_test + check_PROGRAMS += scanutils_test +@@ -1435,6 +1436,10 @@ recodebeam_test_SOURCES = unittest/recodebeam_test.cc + recodebeam_test_CPPFLAGS = $(unittest_CPPFLAGS) + recodebeam_test_LDADD = $(TRAINING_LIBS) $(ICU_I18N_LIBS) $(ICU_UC_LIBS) + ++recoder_test_SOURCES = unittest/recoder_test.cc ++recoder_test_CPPFLAGS = $(unittest_CPPFLAGS) ++recoder_test_LDADD = $(TESS_LIBS) ++ + rect_test_SOURCES = unittest/rect_test.cc + rect_test_CPPFLAGS = $(unittest_CPPFLAGS) + rect_test_LDADD = $(TESS_LIBS) +diff --git a/src/ccutil/unicharcompress.cpp b/src/ccutil/unicharcompress.cpp +index f909f76e..b3dd440f 100644 +--- a/src/ccutil/unicharcompress.cpp ++++ b/src/ccutil/unicharcompress.cpp +@@ -400,6 +400,7 @@ void UnicharCompress::SetupDecoder() { + for (unsigned c = 0; c < encoder_.size(); ++c) { + const RecodedCharID &code = encoder_[c]; + decoder_[code] = c; ++ ASSERT_HOST(code(0) >= 0 && code(0) < code_range_); + is_valid_start_[code(0)] = true; + RecodedCharID prefix = code; + uint32_t len = code.length(); +diff --git a/src/ccutil/unicharcompress.h b/src/ccutil/unicharcompress.h +index 9b696d03..6919b7d2 100644 +--- a/src/ccutil/unicharcompress.h ++++ b/src/ccutil/unicharcompress.h +@@ -84,7 +84,17 @@ public: + if (length_ > kMaxCodeLen) { + return false; + } +- return fp->DeSerialize(&code_[0], length_); ++ if (!fp->DeSerialize(&code_[0], length_)) { ++ return false; ++ } ++ // Code values index arrays sized from the maximum code; reject values ++ // that are out of the sane range for a recoded alphabet. ++ for (uint32_t i = 0; i < length_; ++i) { ++ if (code_[i] < 0 || code_[i] >= static_cast(UINT16_MAX)) { ++ return false; ++ } ++ } ++ return true; + } + bool operator==(const RecodedCharID &other) const { + if (length_ != other.length_) { +@@ -190,6 +200,7 @@ public: + int DecodeUnichar(const RecodedCharID &code) const; + // Returns true if the given code is a valid start or single code. + bool IsValidFirstCode(int code) const { ++ ASSERT_HOST(code >= 0 && code < code_range_); + return is_valid_start_[code]; + } + // Returns a list of valid non-final next codes for a given prefix code, +diff --git a/unittest/recoder_test.cc b/unittest/recoder_test.cc +new file mode 100644 +index 00000000..48dfa7ea +--- /dev/null ++++ b/unittest/recoder_test.cc +@@ -0,0 +1,91 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: recoder_test.cc ++// Description: Tests that a UnicharCompress (LSTM recoder) with code ++// values outside the sane range is rejected at load. ++// Negative code values leave code_range_ at zero, so ++// SetupDecoder writes is_valid_start_[code(0)] out of ++// bounds on a size-0 vector; huge code values wrap ++// code_range_ and make resize() throw. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "serialis.h" // for TFile ++#include "unicharcompress.h" ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// A serialized UnicharCompress with one length-1 RecodedCharID per ++// given code value (self-normalizing). ++std::vector MakeRecoder(const std::vector &codes) { ++ ByteWriter w; ++ w.PutU32(codes.size()); ++ for (int32_t code : codes) { ++ w.PutU8(1); // self_normalized_ ++ w.PutU32(1); // length_ ++ w.PutS32(code); // code_[0] ++ } ++ return w.data(); ++} ++ ++// A recoder code of -1 keeps code_range_ at 0, so on unpatched code ++// SetupDecoder performs an out-of-bounds write into the size-0 ++// is_valid_start_ vector. ++TEST(RecoderTest, RejectsNegativeCode) { ++ std::vector bytes = MakeRecoder({-1}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ EXPECT_FALSE(recoder.DeSerialize(&fp)); ++} ++ ++// A recoder code of INT32_MAX wraps code_range_ to a negative value, ++// so on unpatched code SetupDecoder's resize() throws. ++TEST(RecoderTest, RejectsHugeCode) { ++ std::vector bytes = MakeRecoder({INT32_MAX}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ EXPECT_FALSE(recoder.DeSerialize(&fp)); ++} ++ ++// A valid recoder must still be accepted and usable. ++TEST(RecoderTest, AcceptsValidCodes) { ++ std::vector bytes = MakeRecoder({0, 1}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ ASSERT_TRUE(recoder.DeSerialize(&fp)); ++ EXPECT_EQ(recoder.code_range(), 2); ++ EXPECT_TRUE(recoder.IsValidFirstCode(0)); ++ EXPECT_TRUE(recoder.IsValidFirstCode(1)); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 24c8312552..6acedcee98 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -10,6 +10,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88052.patch \ file://CVE-2026-88048.patch \ file://CVE-2026-88049.patch \ + file://CVE-2026-88050.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 04:40:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100549 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B142ECC6B0E for ; Tue, 13 Oct 2026 04:41:01 +0000 (UTC) Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.361.1791866453950577374 for ; Mon, 12 Oct 2026 21:40:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=gnBiaEmm; spf=pass (domain: gmail.com, ip: 209.85.215.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-ca766c1c9ccso765774a12.0 for ; Mon, 12 Oct 2026 21:40:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866453; x=1792471253; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=W2azljDXcg9TEmoasMdOM7wxqWIT/xnZVzzgM+sCy6w=; b=gnBiaEmmfnbCKDWaEDonxHMt2aPn/Vh6HJbvo3lqWju1/2+QdNGh5lffRLj1fhK1Ss RFVSGTnUifl5Fn4Pd5oAfZijrOgRM6yixjtIfYe9oIz3DJ34DcclqmKmicWlal9TBX/w 79Z+C2rBcJ2F6rQU50ZPp12d28ORAzCYR67B0N0YC8btQwihX9rFlyqR5O7g4YRLapU1 ukRwUiqzOa4F6FsGOUHprGuGGkRVTaLXm0+RSlY5l27iDIUHkB1FGGnf12UGsGtsFcFf zQ3V8tmFtMexUOk09msDdOOfCRxzj0alKqYMutBcXyZXHABh7EuSW7SiegfVG0OOjXa9 SAwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866453; x=1792471253; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=W2azljDXcg9TEmoasMdOM7wxqWIT/xnZVzzgM+sCy6w=; b=ptE7dOYvXZm45DLpZDmAwDthkEyIGHqa18YAIpzW6VSq8XjB3aBqDGX+ZKJigcAuop WudbL+LpVu3TQb4abTJ1smS74sUDt1zLnfigRxCJ5l7QPQoPJIBNFAT0vxbeLhn0Knlc EpDndJVeSfAvOjCCu6+e2JdpPoPQ/UXFe3DfcyZFxdVQgTBriKKCUTmQ6nXkZyXoVUMS do6MIgP8qruXEdYPKuH0GLoC9WUqz/+XNOKHI9HKX0ychshbODE3xDO31zCzUkfUPMOV 4xGh7zeP73UMYCRX5KBN2C6g+I9ckTTR4S7r3JcSLsOyoTfVdkmAldJGVov4GPc8vf+q C67g== X-Gm-Message-State: AFq9FYK7+dpPvafXy4N5AwiUcwwNbLsCYerzFhygkzgWuWx0iIKpFz9S UQGqbEOgbSX0zKKn6n6wctz3Xa7aruLyX8ZWWFF5Hx+jZuqs+5auhIhh8/xN7g== X-Gm-Gg: AYBFou2stIu+cLa77Qhifgsqm7Q2J3Qc+xPYHNBoKsAMt1ehyGBrlWsRwkVDD5/Hiub RBZdEpSvc46X1ztrZKmI6MT+tGyFREG8/qfb2a2Q7PCabn2hBWDy4J3quF52/+4zN3PoCLT/jXa P2bS2ODH00AVoCrokAxYp9gFaOD1Nih5ROMO8feSImqjYqpw9LUt67X5K/v+uBgWvKuZozCeUPi n/qFN6ciLj6ua+Gfk0Zrr99H8snZ0559RQeWoMOvdPWX4ikDnAPQBQ2gCoxFd33VMxEzyaLtaOy tIM7UxTP+P1ziR+m0zf0oD1/u5byi8HsMkIc8T9eS2P/EkDPFskH/kbiraMnMxGEQS32XuvrHMs GrW7MMJwuBk0jmjYjrtEAZpP4WnBhGPxW2VBPeHjPVoQS8W/pAfI4oTAH1kyTEmnLV/NWr47QL4 jlGSU2EzYBMXrPAJClzHrOe+uUeScvX/x7mTUiQKVOSxyYDsW8Abya/10UB9AQXNzRt7mxHRAE2 Qh21GLmpZQn2wi87H3G7HQc7hj+uSWsjsJkeazQ26e9d7oIng== X-Received: by 2002:a17:90b:164b:b0:3a4:e735:b39d with SMTP id 98e67ed59e1d1-3ab3b0375e8mr8486138a91.64.1791866453119; Mon, 12 Oct 2026 21:40:53 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:52 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 13/16] tesseract: patch CVE-2026-88047 Date: Tue, 13 Oct 2026 17:40:03 +1300 Message-ID: <20261013044006.834868-13-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:41:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130827 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88047 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit b8fa7aac9168b6ebfdcc2ea3493c332f0db69491) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88047.patch | 225 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 226 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch new file mode 100644 index 0000000000..780f686e61 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch @@ -0,0 +1,225 @@ +From e974684acbe3aeb6bc6192b06a048537c345b713 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Mon, 24 Aug 2026 13:39:22 +0200 +Subject: [PATCH] Limit unichar extraction in ReadNormProtos to the buffer size + +Classify::ReadNormProtos parsed each normproto line with +`stream >> unichar >> NumProtos` into a char unichar[2 * UNICHAR_LEN + 1] +stack buffer, but char* extraction from an istream has no length limit +(the stream width was never set). A crafted TESSDATA_NORMPROTO component +in a .traineddata file whose first proto-line token exceeds 60 +characters (the 100-byte line buffer allows up to 99) overflows the +stack buffer during legacy engine initialization (CWE-121). + +Toolchain note: Apple's libc++ provides a C++20 array overload of +operator>>(basic_istream&, char(&)[N]) that implicitly bounds the +extraction to the array size, so builds against that standard library +are incidentally protected. Standard libraries without that overload +(e.g. libstdc++) still take the unbounded char* overload, so the +explicit width limit below makes the behavior defined on all +toolchains. + +Key changes: +- normmatch.cpp: read the unichar token with + std::setw(2 * UNICHAR_LEN + 1); char* extraction takes at most + width - 1 characters, which fits the buffer exactly. Overlong + tokens are truncated and the line is rejected like any other + unparseable line. +- unittest: add normproto_test covering a 99-character token (the + maximum a 100-byte line can hold), a token of exactly 2 * + UNICHAR_LEN characters, and a well-formed component. A minimal + reproduction of the unbounded extraction crashes an ASan build + with a stack-buffer-overflow. + +Reported-by: Tristan Madani +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 1bda5079b1c8a7e25f523486837426903d29ce84) + +CVE: CVE-2026-88047 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/classify/normmatch.cpp | 6 +- + unittest/CMakeLists.txt | 1 + + unittest/normproto_test.cc | 111 +++++++++++++++++++++++++++++++++++++ + 4 files changed, 122 insertions(+), 1 deletion(-) + create mode 100644 unittest/normproto_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 63ca6686..cc748455 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1184,6 +1184,7 @@ check_PROGRAMS += mastertrainer_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += matrix_test + check_PROGRAMS += networkio_test ++check_PROGRAMS += normproto_test + if ENABLE_TRAINING + check_PROGRAMS += normstrngs_test + endif # ENABLE_TRAINING +@@ -1388,6 +1389,10 @@ networkio_test_SOURCES = unittest/networkio_test.cc + networkio_test_CPPFLAGS = $(unittest_CPPFLAGS) + networkio_test_LDADD = $(TESS_LIBS) + ++normproto_test_SOURCES = unittest/normproto_test.cc ++normproto_test_CPPFLAGS = $(unittest_CPPFLAGS) ++normproto_test_LDADD = $(TESS_LIBS) ++ + normstrngs_test_SOURCES = unittest/normstrngs_test.cc + normstrngs_test_CPPFLAGS = $(unittest_CPPFLAGS) + normstrngs_test_LDADD = $(TRAINING_LIBS) $(ICU_I18N_LIBS) $(ICU_UC_LIBS) +diff --git a/src/classify/normmatch.cpp b/src/classify/normmatch.cpp +index d5bd7e6a..1ce7c928 100644 +--- a/src/classify/normmatch.cpp ++++ b/src/classify/normmatch.cpp +@@ -28,6 +28,7 @@ + + #include + #include ++#include // for std::setw + #include // for std::istringstream + + namespace tesseract { +@@ -190,7 +191,10 @@ NORM_PROTOS *Classify::ReadNormProtos(TFile *fp) { + while (fp->FGets(line, kMaxLineSize) != nullptr) { + std::istringstream stream(line); + stream.imbue(std::locale::classic()); +- stream >> unichar >> NumProtos; ++ // unichar holds at most 2 * UNICHAR_LEN characters; the width limit ++ // (width - 1 characters for char* extraction) keeps the extraction ++ // from overflowing the buffer on overlong lines. ++ stream >> std::setw(2 * UNICHAR_LEN + 1) >> unichar >> NumProtos; + if (stream.fail()) { + continue; + } +diff --git a/unittest/CMakeLists.txt b/unittest/CMakeLists.txt +index a660c9b1..4c677a60 100644 +--- a/unittest/CMakeLists.txt ++++ b/unittest/CMakeLists.txt +@@ -59,6 +59,7 @@ set(LEGACY_TESTS + indexmapbidi_test.cc + intfeaturemap_test.cc + mastertrainer_test.cc ++ normproto_test.cc + osd_test.cc + params_model_test.cc + shapetable_test.cc +diff --git a/unittest/normproto_test.cc b/unittest/normproto_test.cc +new file mode 100644 +index 00000000..574b2f3d +--- /dev/null ++++ b/unittest/normproto_test.cc +@@ -0,0 +1,111 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: normproto_test.cc ++// Description: Tests that Classify::ReadNormProtos handles a normproto ++// line whose first (unichar) token exceeds the ++// unichar[2 * UNICHAR_LEN + 1] stack buffer. The ++// istream extraction has no intrinsic length limit, so a ++// crafted NORMPROTO component in a .traineddata file ++// could overflow the stack buffer during legacy engine ++// initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "classify.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Minimal unicharset (space and 'a'). ++const char kMinUnicharset[] = ++ "2\n" ++ "NULL 1 0,255,0,255,0,0,0,0,0,0 Latin 2 0 2\n" ++ "a 1 0,255,0,255,0,0,0,0,0,0 Latin 2 0 2\n"; ++ ++// Builds a normproto component: a sample-size line (5), five parameter ++// description lines, then the given raw proto lines. ++std::vector MakeNormproto(const std::string &lines) { ++ std::string data = "5\n"; ++ for (int i = 0; i < 5; ++i) { ++ data += "e e 0 1\n"; ++ } ++ data += lines; ++ return std::vector(data.begin(), data.end()); ++} ++ ++class NormprotoTest : public testing::Test { ++protected: ++ void SetUp() override { ++ tmpl_ = "/tmp/tess_normproto_test_XXXXXX"; ++ char *dir = mkdtemp(tmpl_.data()); ++ ASSERT_NE(dir, nullptr); ++ dir_ = dir; ++ std::string uc_path = dir_ + "/eng.unicharset"; ++ FILE *f = fopen(uc_path.c_str(), "w"); ++ ASSERT_NE(f, nullptr); ++ ASSERT_EQ(fwrite(kMinUnicharset, 1, sizeof(kMinUnicharset) - 1, f), ++ sizeof(kMinUnicharset) - 1); ++ fclose(f); ++ // Load the minimal unicharset into the classifier's inherited ++ // unicharset member. ++ ASSERT_TRUE(classifier_.unicharset.load_from_file(uc_path.c_str())); ++ } ++ void TearDown() override { ++ std::remove((dir_ + "/eng.unicharset").c_str()); ++ rmdir(dir_.c_str()); ++ } ++ std::string dir_; ++ std::string tmpl_; ++ Classify classifier_; ++}; ++ ++// A 99-character first token (the maximum FGets can return) overflows ++// unichar[2 * UNICHAR_LEN + 1] on unpatched code; the width-limited ++// extraction must reject the line instead. ++TEST_F(NormprotoTest, ToleratesOverlongUnicharToken) { ++ std::vector bytes = MakeNormproto(std::string(99, 'A') + "\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++// A token of exactly 2 * UNICHAR_LEN characters is the maximum legitimate ++// size; it must not be truncated or rejected by the width limit. ++TEST_F(NormprotoTest, ToleratesMaxLenUnicharToken) { ++ std::vector bytes = MakeNormproto(std::string(2 * UNICHAR_LEN, 'A') + " 0\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++// A well-formed normproto component must still parse. ++TEST_F(NormprotoTest, ReadsValidNormprotos) { ++ std::vector bytes = MakeNormproto("a 0\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 6acedcee98..25d357d903 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -11,6 +11,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88048.patch \ file://CVE-2026-88049.patch \ file://CVE-2026-88050.patch \ + file://CVE-2026-88047.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 04:40:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100548 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83B6FCC6B03 for ; Tue, 13 Oct 2026 04:41:01 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.362.1791866456593304576 for ; Mon, 12 Oct 2026 21:40:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=e1QV/MQS; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3ab752f6244so2035543a91.2 for ; Mon, 12 Oct 2026 21:40:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866456; x=1792471256; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4LFV5BDa5k3G5pVC9Yn1kpg0hPNqgW+fbIO2Z4XRXf0=; b=e1QV/MQSA5nPLUhkKDO+6epPdtiJNqqzaTHOUwaRMjj27k96aQpz2a/5/cWfAVzQ7q 29yeTz3QnLpHPLdGftg13QDW3TAI/v/gYfZfZRslFQrmYVfUE3SuBize1jS/C76yUXtW x76fX19r0KHyvj8u+MPxGyXl0svw7imtPYFmUWZcinAdY0lAZQ3mnNwK3+uxNaMvlGiY GPrmjex/Zy3H0ev8oCg/OuOt944Pf7Lk/ryv8NWi/QuXa1H49Og5cN6L158Gm3d/8bVe 9krJh3FaJwM7LnLNQm/xK1ZQP7hdX0oPuJgntb0RUoYfSmz62oCGiObiIqpqBqOgLQBl UFOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866456; x=1792471256; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=4LFV5BDa5k3G5pVC9Yn1kpg0hPNqgW+fbIO2Z4XRXf0=; b=IU5X2gfJt8z+oZRd0wSe20gAg2xwpdYb9VhiY7itCzNtzz3Us1LgUbe+YiPmBGoeGa YHb2+QXzDJKTQuoHqj3HdE/YzDw57S7FXnvA0X+ia2HEYlQ6SCO5ctg2nzpuN0u3OexN TCqs4pH+bR5rMiC3WM00xiCYh1RWL+Sqdxhk/MylWPTlZim1TYx7QIEDp3Hdhs0sfyZO gJGfHn5wXAeZnbs7vUxlho/LxwZGteb07qvh3p1ZnPu++/IJrh6HfmqAQ3kDJSJoQlD8 klIE0Z/9Op+bk6Vd9a06Jk337RrPFwK+RxgT0h/OUURKDLiTJcF97dWWDDW6iJkd502v DkhA== X-Gm-Message-State: AFq9FYIn2Fp3qDGHgZkDIziBxzGNEKWGoFY+M4KUrEiyEOYvX1xzOw3X ObDaVUJJRevjU/Lpzwwl88dFp1XouFsy0qRgu4AbYCuqFKaHR1nnOjb0Eso55g== X-Gm-Gg: AYBFou3TkJUdi2XGRdtmx514169tzkhmoNzR0xA/RZ/oQMZXVrV36BDthAECwhTVKfz JGzzkxFudk8KY3R/XwGafBJxCJj4l+sBBsFPtWa1LxCYkv9GdvRg/cNs8coBuRgnTqwjeEBl+si NHh3F3GzWmPN5c4gQrwTtsGHoX+fMEmdUpjh0TASKUM68mntMp3GdVE84/tW0cQCrAZIKZvcn4V 5P9UvTD9WDHUI661Ja457SQfLjUDZqkbYm/ee12sCwijYx49yUyizUa68ukA4NikMys3khJmA+U Iv6dMqGauBcvCzT0RMFa8FPLCovMZ4YEtBXm1/9tgdjPskLOIUyffQVJ4t7I7zum612Kre9nLvV dm6wlDW3nMBSxe9Wnj0MtckGbioYJoNVNfjZmJ2BL9Hc+NA4rF6rfyQJWDuhUNfBSNjC9JGGujp yvT1/Svf4r41LXVtJFv6D9prW0WcJtQAwm3mTyyjF/UzhZuHP2YfOsEgFPbhABnVLU/aqWLyIfD qCXcAxiWYU/C1MnbvSEFJlhpVkH731nsqfF9Ay4ON+hbd9qIazd X-Received: by 2002:a17:90b:2885:b0:3a7:b260:9ccc with SMTP id 98e67ed59e1d1-3ab3af73996mr9315163a91.65.1791866455606; Mon, 12 Oct 2026 21:40:55 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:55 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 14/16] tesseract: patch CVE-2026-88051 Date: Tue, 13 Oct 2026 17:40:04 +1300 Message-ID: <20261013044006.834868-14-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:41:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130828 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88051 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 727354dae2ee3075ad388bcfe22156ab1ea6fcf5) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88051.patch | 184 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 185 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch new file mode 100644 index 0000000000..1956d49672 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch @@ -0,0 +1,184 @@ +From 79bf602b0cd5216c125f86eaf3c768daae256930 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 20:29:37 +0200 +Subject: [PATCH] Validate vector counts in GenericVector::read + +The callback form of GenericVector::read read two independent int32 +fields from the file: reserved sized the allocation via reserve(), +while size_used_ drove the element loop. Neither was capped and no +size_used_ <= reserved invariant was checked, so a crafted +.traineddata (e.g. the fontinfo table of a version >= 4 inttemp +component) performed a heap out-of-bounds write during legacy +engine initialization. + +Key changes: +- genericvector.h: reject negative or over-limit reserved + (matching the 50000000 cap of the DeSerialize overloads) and + reject size_used_ < 0 or size_used_ > reserved before entering + the read loop. Legit files always satisfy size_used_ <= reserved, + as write() persists size_reserved_ first. +- unittest: add genericvector_test covering size_used_ beyond + reserved (on unpatched code the ASan build dies on a + heap-buffer-overflow in the read loop), negative counts, and a + consistent vector that must still load. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 56e09ca12e751623fe796ce1554ce704bffd2ef0) + +CVE: CVE-2026-88051 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccutil/genericvector.h | 10 ++++ + unittest/genericvector_test.cc | 91 ++++++++++++++++++++++++++++++++++ + 3 files changed, 106 insertions(+) + create mode 100644 unittest/genericvector_test.cc + +diff --git a/Makefile.am b/Makefile.am +index cc748455..c67f0f63 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1159,6 +1159,7 @@ check_PROGRAMS += equationdetect_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += fileio_test + check_PROGRAMS += fullyconnected_test ++check_PROGRAMS += genericvector_test + check_PROGRAMS += heap_test + check_PROGRAMS += imagedata_test + if !DISABLED_LEGACY_ENGINE +@@ -1298,6 +1299,10 @@ fullyconnected_test_SOURCES = unittest/fullyconnected_test.cc + fullyconnected_test_CPPFLAGS = $(unittest_CPPFLAGS) + fullyconnected_test_LDADD = $(TESS_LIBS) + ++genericvector_test_SOURCES = unittest/genericvector_test.cc ++genericvector_test_CPPFLAGS = $(unittest_CPPFLAGS) ++genericvector_test_LDADD = $(TESS_LIBS) ++ + heap_test_SOURCES = unittest/heap_test.cc + heap_test_CPPFLAGS = $(unittest_CPPFLAGS) + heap_test_LDADD = $(TESS_LIBS) +diff --git a/src/ccutil/genericvector.h b/src/ccutil/genericvector.h +index 4a5bbe12..cbe1e203 100644 +--- a/src/ccutil/genericvector.h ++++ b/src/ccutil/genericvector.h +@@ -654,10 +654,20 @@ bool GenericVector::read(TFile *f, const std::function &c + if (f->FReadEndian(&reserved, sizeof(reserved), 1) != 1) { + return false; + } ++ // Arbitrarily limit the number of elements to protect against bad data. ++ const uint32_t limit = 50000000; ++ if (reserved < 0 || static_cast(reserved) > limit) { ++ return false; ++ } + reserve(reserved); + if (f->FReadEndian(&size_used_, sizeof(size_used_), 1) != 1) { + return false; + } ++ // size_used_ is an independent file field; without this check the reads ++ // below land past the end of the buffer sized from reserved. ++ if (size_used_ < 0 || size_used_ > reserved) { ++ return false; ++ } + if (cb != nullptr) { + for (int i = 0; i < size_used_; ++i) { + if (!cb(f, data_ + i)) { +diff --git a/unittest/genericvector_test.cc b/unittest/genericvector_test.cc +new file mode 100644 +index 00000000..269b00f0 +--- /dev/null ++++ b/unittest/genericvector_test.cc +@@ -0,0 +1,91 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: genericvector_test.cc ++// Description: Tests that the callback form of GenericVector::read ++// rejects vectors whose size_used_ exceeds reserved (or ++// whose counts are negative). reserved sizes the buffer ++// while size_used_ is an independent file field driving ++// the element loop, so a crafted .traineddata (e.g. the ++// fontinfo table of a version >= 4 inttemp component) ++// performs a heap out-of-bounds write during legacy ++// engine initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "genericvector.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutS32(int32_t v) { ++ uint32_t u = static_cast(v); ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((u >> (8 * i)) & 0xFF)); ++ } ++ } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// A serialized vector header (reserved, size_used_) followed by the ++// given number of int32 elements. ++std::vector MakeVector(int32_t reserved, int32_t size_used, int32_t num_elements) { ++ ByteWriter w; ++ w.PutS32(reserved); ++ w.PutS32(size_used); ++ for (int32_t i = 0; i < num_elements; ++i) { ++ w.PutS32(i); ++ } ++ return w.data(); ++} ++ ++// reserved=4 but size_used_=0x10000: on unpatched code the callback ++// loop writes 65536 ints past the 4-int buffer (heap out-of-bounds ++// write). ++TEST(GenericVectorTest, RejectsSizeUsedBeyondReserved) { ++ std::vector bytes = MakeVector(4, 0x10000, 0x10000); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ EXPECT_FALSE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++} ++ ++// Negative counts must be rejected; on unpatched code the read ++// "succeeds" and leaves size_used_ negative. ++TEST(GenericVectorTest, RejectsNegativeCounts) { ++ std::vector bytes = MakeVector(-1, -1, 0); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ EXPECT_FALSE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++} ++ ++// A consistent vector must still be accepted. ++TEST(GenericVectorTest, AcceptsConsistentVector) { ++ std::vector bytes = MakeVector(4, 2, 2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ ASSERT_TRUE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++ EXPECT_EQ(v.size(), 2); ++ EXPECT_EQ(v[0], 0); ++ EXPECT_EQ(v[1], 1); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 25d357d903..be6ec1e463 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88049.patch \ file://CVE-2026-88050.patch \ file://CVE-2026-88047.patch \ + file://CVE-2026-88051.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 04:40:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100547 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75DB5CA9ED0 for ; Tue, 13 Oct 2026 04:41:01 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.369.1791866459460059610 for ; Mon, 12 Oct 2026 21:40:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=RMKRWwIM; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-cd60c5da24cso705205a12.0 for ; Mon, 12 Oct 2026 21:40:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866459; x=1792471259; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Ug9eKCO58Y4VLl98m5Gdv4zQb9sK2CAyt5HE5vVxfgI=; b=RMKRWwIMrCxSyg64I2V5X6R+XsvAvAohovxCszm/C4ffRXzNzobwnOwOM5GrgHoh7K QWUQ+v2FUtAf2z53TbVEEYhkEgiRk58bYfdONCJ58J5BLz/Z6c7FvTu2gpyPtsbmu3h+ efrFq+QmwuPZKjuS0UAUAEVwvxs8M0B7H+H9Wp4boW4fL8vuBCJxe/pASfAXKy3tj0oE FxUdzgGtwQS98+rKJDccL9hXcZKE/v3NNAJI0Cu8dXAfVgIoFgq3r72B9jc2BeDYDe8a DqpBXIkaW5UyQQf6s672h8GTHF+3BJ4WTzxHunRU8CsrYviYORsVX66FaQlhSXWUmg1u Q/PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866459; x=1792471259; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Ug9eKCO58Y4VLl98m5Gdv4zQb9sK2CAyt5HE5vVxfgI=; b=WZ7ZFzWpEE/2M/qV90Y906Pt5xnN/JVARB54NLZ2OByBL6HC/e6csTch3hWVRZQtXu 3jKLwszwabaAhGHcVHMS7oi89+5WQvZM7iVOyaM/AaIG5ggAheTQU2RWgdNU/dpVFPoP y5ZWpA6tIIrAPl+LVON/mru+4CGPDtbEQtsZcnzZNDYdT3A2M2MABtH9NrZU7TlMT6Yt ROXPUnpDiFjeBbo/8enkF0x5XCI1VldlfRkY9fuAJVEa/7+/tPjY76GPgKYCo0N9qDKA FskTIxnoOjs2xCwpcoSev3i5E7alGifV54yKuqL6aqZwZ409J10e9n93Ppe+I7AO7m+r aXSQ== X-Gm-Message-State: AFq9FYIuGmctRNCwtQw24EpzqrdxdGw3TxPbl1VwID1255cGdCDcpiT2 O6iTMOHCMhtASWYmrh6IpLBf9lKdbggBPls9pisjAJoUpngMR1ITa+BbuhbHPg== X-Gm-Gg: AYBFou2jJ3yr03B72eXw49GiNxoMXj3fs1Z+cHDgFFqPE18HZNp/KyY+LbLDGk2XR/N XaYDm8OfOKMNZW89ZLF/rWScMdsKLDajuJdD0Ezovd5HwFFDL5OFtONf8gBShAaXWEtU7weKKjC +RxIMZZ7VvAGQnYdOT7QHYZ+3m4GqOai+n7xcJpd/BlzASnLHYANm/fydcZQp/N4JilfHFKVu6T yIplziU26NIE6FW8hS5DnnZ0HOzJV72ifA6zrewBENXf8WhvT3PXoj36rvaSbta5kVf4TXSRxLb +OXJ1heAesLyNyVefDnzPXBiEqdXfG6SR0enRc54zbbdDxIfOrhyHtz0ACX/1Uyu2wQ3DXHYF1S 6K2H23Y8yM/yxYC8PYLxLL//nl1MWzNk+X71oCQt1chy4Ao9Vy6Vztdc4nWWF3ZtGzuWZbndNVN yWqFCZIGF+6y1EQwfUaeliKVuAzAEwnLquLwyvDxV4R1o6VbNmzS4ohYPBZhBASEiZJkSlvJ7Xu zSzArSvaakD9dW7G575jg3e7LGTwZaTkR0aZ5o= X-Received: by 2002:a17:90b:1e41:b0:3a8:9b79:e6ea with SMTP id 98e67ed59e1d1-3ab3a96ffd7mr9951577a91.59.1791866458536; Mon, 12 Oct 2026 21:40:58 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:40:58 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 15/16] tesseract: patch CVE-2026-88054 Date: Tue, 13 Oct 2026 17:40:05 +1300 Message-ID: <20261013044006.834868-15-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:41:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130829 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88054 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4c00053135fb03b6043c960dc96a839b675f7eec) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88054.patch | 274 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 275 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch new file mode 100644 index 0000000000..32e70c0f6f --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch @@ -0,0 +1,274 @@ +From 83bbac0975f52a5171776fddcc800a2aaa5206a3 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 14:38:55 +0200 +Subject: [PATCH] Reject empty network stacks in LSTM .traineddata + deserialization + +Plumbing::DeSerialize read the network stack size from the untrusted +TESSDATA_LSTM component and only rejected size > 10000. A crafted +.traineddata with a top-level Series/Parallel/Reversed layer with an +empty stack survived load; LSTMRecognizer initialization then called +network_->CacheXScaleFactor(network_->XScaleFactor()), which +dereferences stack_[0] on the empty vector: +- Series: Series::CacheXScaleFactor (series.cpp) +- Parallel/Reversed: inherited Plumbing::XScaleFactor +The virtual call through the wild pointer crashed the process at +initialization (deterministic denial of service). + +Key changes: +- plumbing.cpp: reject size == 0 for all plumbing types, and + size < 2 for NT_SERIES (Series::Forward requires two or more + networks and always aborts on one). +- tessedit.cpp: fail the language load gracefully when the LSTM model + cannot be loaded, instead of aborting via ASSERT_HOST, so + TessBaseAPI::Init returns -1 on corrupt traineddata. +- unittest: add plumbing_test, which builds a minimal traineddata + with empty/undersized LSTM plumbing stacks and expects a graceful + init failure. On unpatched code the tests die on the original + SEGV in Series::CacheXScaleFactor / Plumbing::XScaleFactor. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 552771236b0d80cbdb0c7dd856120fa21a4672e5) + +CVE: CVE-2026-88054 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/552771236b0d80cbdb0c7dd856120fa21a4672e5] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccmain/tessedit.cpp | 7 +- + src/lstm/plumbing.cpp | 6 ++ + unittest/plumbing_test.cc | 165 ++++++++++++++++++++++++++++++++++++++ + 4 files changed, 182 insertions(+), 1 deletion(-) + create mode 100644 unittest/plumbing_test.cc + +diff --git a/Makefile.am b/Makefile.am +index c67f0f63..a6ee0931 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1198,6 +1198,7 @@ if ENABLE_TRAINING + check_PROGRAMS += pango_font_info_test + endif # ENABLE_TRAINING + check_PROGRAMS += paragraphs_test ++check_PROGRAMS += plumbing_test + if !DISABLED_LEGACY_ENGINE + check_PROGRAMS += params_model_test + endif # !DISABLED_LEGACY_ENGINE +@@ -1427,6 +1428,10 @@ paragraphs_test_SOURCES = unittest/paragraphs_test.cc + paragraphs_test_CPPFLAGS = $(unittest_CPPFLAGS) + paragraphs_test_LDADD = $(TESS_LIBS) + ++plumbing_test_SOURCES = unittest/plumbing_test.cc ++plumbing_test_CPPFLAGS = $(unittest_CPPFLAGS) ++plumbing_test_LDADD = $(TESS_LIBS) ++ + if !DISABLED_LEGACY_ENGINE + params_model_test_SOURCES = unittest/params_model_test.cc + params_model_test_CPPFLAGS = $(unittest_CPPFLAGS) +diff --git a/src/ccmain/tessedit.cpp b/src/ccmain/tessedit.cpp +index 7ec89bd9..722ed09b 100644 +--- a/src/ccmain/tessedit.cpp ++++ b/src/ccmain/tessedit.cpp +@@ -169,7 +169,12 @@ bool Tesseract::init_tesseract_lang_data(const std::string &language, OcrEngineM + #endif // ndef DISABLED_LEGACY_ENGINE + if (mgr->IsComponentAvailable(TESSDATA_LSTM)) { + lstm_recognizer_ = new LSTMRecognizer(language_data_path_prefix.c_str()); +- ASSERT_HOST(lstm_recognizer_->Load(this->params(), lstm_use_matrix ? language : "", mgr)); ++ if (!lstm_recognizer_->Load(this->params(), lstm_use_matrix ? language : "", mgr)) { ++ delete lstm_recognizer_; ++ lstm_recognizer_ = nullptr; ++ tprintf("Error: Failed to load the LSTM model from %s\n", tessdata_path.c_str()); ++ return false; ++ } + } else { + #ifdef DISABLED_LEGACY_ENGINE + // The legacy engine is compiled out, so we cannot fall back to it. +diff --git a/src/lstm/plumbing.cpp b/src/lstm/plumbing.cpp +index f0133148..15cf3d62 100644 +--- a/src/lstm/plumbing.cpp ++++ b/src/lstm/plumbing.cpp +@@ -226,6 +226,12 @@ bool Plumbing::DeSerialize(TFile *fp) { + if (size > 10000) { + return false; + } ++ // Reject empty stacks: XScaleFactor, CacheXScaleFactor and other methods ++ // unconditionally dereference stack_[0] during network initialization. ++ // A Series needs at least two networks (see Series::Forward). ++ if (size == 0 || (type() == NT_SERIES && size == 1)) { ++ return false; ++ } + for (uint32_t i = 0; i < size; ++i) { + Network *network = CreateFromFile(fp); + if (network == nullptr) { +diff --git a/unittest/plumbing_test.cc b/unittest/plumbing_test.cc +new file mode 100644 +index 00000000..27486f86 +--- /dev/null ++++ b/unittest/plumbing_test.cc +@@ -0,0 +1,165 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: plumbing_test.cc ++// Description: Tests that a corrupt TESSDATA_LSTM component in a ++// .traineddata file is rejected without crashing. A ++// plumbing layer (Series/Parallel/Reversed) with an ++// empty or undersized network stack would make ++// XScaleFactor/CacheXScaleFactor dereference stack_[0] ++// during engine initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include ++ ++#include "network.h" // for NetworkType ++#include "tessdatamanager.h" // for TessdataManager, TESSDATA_LSTM ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Minimal unicharset with the special codes (space, Joined, Broken) that ++// UNICHARSET::load_from_file expects, as embedded in the TESSDATA_LSTM ++// component by LSTMRecognizer::Serialize. ++const char kMinUnicharset[] = ++ "3\n" ++ "NULL 0 NULL 0\n" ++ "Joined 7 0,69,188,255,486,1218,0,30,486,1188 Latin 26 0 98 Joined\n" ++ "|Broken|0|1 f 0,69,186,255,892,2138,0,80,892,2058 Common 84 10 84 |Broken|0|1\n"; ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ void PutString(const char *s) { ++ PutU32(static_cast(std::strlen(s))); ++ data_.insert(data_.end(), s, s + std::strlen(s)); ++ } ++ void PutRaw(const char *s) { data_.insert(data_.end(), s, s + std::strlen(s)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// Serialized network header as written by Network::Serialize: ++// int8 type, int8 training, int8 needs_to_backprop, int32 network_flags, ++// int32 ni, int32 no, int32 num_weights, string name. ++void AppendNetworkHeader(ByteWriter *w, NetworkType type) { ++ w->PutU8(static_cast(type)); ++ w->PutU8(0); // training: TS_DISABLED ++ w->PutU8(0); // needs_to_backprop ++ w->PutU32(0); // network_flags ++ w->PutU32(0); // ni ++ w->PutU32(0); // no ++ w->PutU32(0); // num_weights ++ w->PutString(""); // name ++} ++ ++// A minimal valid child network (NT_INPUT with a 1x1x1x1 shape). ++void AppendInputChild(ByteWriter *w) { ++ AppendNetworkHeader(w, NT_INPUT); ++ w->PutS32(1); // batch ++ w->PutS32(1); // height ++ w->PutS32(1); // width ++ w->PutS32(1); // depth ++ w->PutS32(0); // loss type ++} ++ ++// Builds a TESSDATA_LSTM component whose top-level network is a plumbing ++// layer of the given type with the given (corrupt) stack size, followed by ++// the remaining fields of LSTMRecognizer::DeSerialize. ++std::vector MakeLstmComponent(NetworkType type, uint32_t stack_size) { ++ ByteWriter w; ++ AppendNetworkHeader(&w, type); ++ w.PutU32(stack_size); // Plumbing::DeSerialize reads this as uint32 ++ for (uint32_t i = 0; i < stack_size; ++i) { ++ AppendInputChild(&w); ++ } ++ w.PutRaw(kMinUnicharset); // unicharset (raw text, no recoder/unicharset components) ++ w.PutString(""); // network_str_ ++ w.PutS32(0); // training_flags_ ++ w.PutS32(0); // training_iteration_ ++ w.PutS32(0); // sample_iteration_ ++ w.PutS32(0); // null_char_ ++ w.PutU32(0); // adam_beta_ (float 0.0) ++ w.PutU32(0); // learning_rate_ (float 0.0) ++ w.PutU32(0); // momentum_ (float 0.0) ++ return w.data(); ++} ++ ++// Writes a traineddata file with the given (corrupt) LSTM component to ++// dir/eng.traineddata. ++bool WriteCorruptTraineddata(const std::string &dir, const std::vector &lstm) { ++ TessdataManager mgr; ++ mgr.OverwriteEntry(TESSDATA_LSTM, lstm.data(), static_cast(lstm.size())); ++ return mgr.SaveFile((dir + "/eng.traineddata").c_str(), nullptr); ++} ++ ++class PlumbingTest : public testing::Test { ++protected: ++ void SetUp() override { ++ tmpl_ = "/tmp/tess_plumbing_test_XXXXXX"; ++ char *dir = mkdtemp(tmpl_.data()); ++ ASSERT_NE(dir, nullptr); ++ dir_ = dir; ++ } ++ void TearDown() override { ++ std::remove((dir_ + "/eng.traineddata").c_str()); ++ rmdir(dir_.c_str()); ++ } ++ // Expects the LSTM engine to reject the corrupted traineddata ++ // gracefully (init failure) instead of crashing. ++ void ExpectInitFails(const std::vector &lstm) { ++ ASSERT_TRUE(WriteCorruptTraineddata(dir_, lstm)); ++ tesseract::TessBaseAPI api; ++ EXPECT_EQ(api.Init(dir_.c_str(), "eng", tesseract::OEM_LSTM_ONLY), -1); ++ } ++ std::string dir_; ++ std::string tmpl_; ++}; ++ ++// Empty NT_SERIES stack: Series::CacheXScaleFactor would dereference ++// stack_[0] on the empty vector during initialization. ++TEST_F(PlumbingTest, RejectsEmptySeriesStack) { ++ ExpectInitFails(MakeLstmComponent(NT_SERIES, 0)); ++} ++ ++// Empty NT_PARALLEL stack: Plumbing::XScaleFactor would dereference ++// stack_[0] on the empty vector during initialization. ++TEST_F(PlumbingTest, RejectsEmptyParallelStack) { ++ ExpectInitFails(MakeLstmComponent(NT_PARALLEL, 0)); ++} ++ ++// Empty NT_XREVERSED stack: same crash as the parallel case. ++TEST_F(PlumbingTest, RejectsEmptyReversedStack) { ++ ExpectInitFails(MakeLstmComponent(NT_XREVERSED, 0)); ++} ++ ++// A Series with a single network: Series::Forward requires at least two ++// networks, so such a model can never work. ++TEST_F(PlumbingTest, RejectsSingleNetworkSeries) { ++ ExpectInitFails(MakeLstmComponent(NT_SERIES, 1)); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index be6ec1e463..c96aca1dde 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -13,6 +13,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88050.patch \ file://CVE-2026-88047.patch \ file://CVE-2026-88051.patch \ + file://CVE-2026-88054.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 04:40:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100550 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3C5FCC6B03 for ; Tue, 13 Oct 2026 04:41:11 +0000 (UTC) Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.363.1791866461873207993 for ; Mon, 12 Oct 2026 21:41:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=VXuhVHFi; spf=pass (domain: gmail.com, ip: 209.85.215.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-cc4b1f7e8f4so1364232a12.1 for ; Mon, 12 Oct 2026 21:41:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791866461; x=1792471261; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JI5SPv4Mgvuqc1EQWVSgRUqv2OsgGWNzaQr9ubcQptE=; b=VXuhVHFi3Latu7a3TqKOXINH59iRRX6LxdCEauIIx7Q2osCah2xVB5tLZwqqERxH3Y 2FZqaGzx5hlzi1fA1+GH7pPexdeot4dKChAhK3s2JomBN7I67JSD4LkMq+eIxIFhmb/x cBYGeOUNPV/M2TDElOzaQTltilHOlan6DvGCp22SyY4lclqBf31ESKNCrpk2IKJ9tRcL tpaSXcdKTfujymB6MMn66PkmaBtiuxUcrx1gpkMwmh/NRQ4QZcHHQXCd6UyFgjG62PCu eaOmu/14yfACvC88J0E4I/YdzdESWBmPdXuE0laayhECqkI2VtrGrKJw47pgBvt3ikq+ 4z2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791866461; x=1792471261; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=JI5SPv4Mgvuqc1EQWVSgRUqv2OsgGWNzaQr9ubcQptE=; b=G+JIOafexJjlop51Mx1HbQf9d2+fkVTgl1S1m3hmqHgQdJaQhU+BVRqEmuRJTaAPJM FT5HBvGjVaI0+S1sw5AGo+yGWhWclnEYM8plGfgPx/WDz8TqZuMJ+3OmiCzdnKJ4tcLt SBtZ8UTuaWWoRy2Zqz8QKsa25x3bZTEeqRIvL8f71oDl+S14elWZUOehLzQPuUAKbKAN jD9qn8CQm0MJiP+UijTSDvwTHXCzf6POJoqAKgeR5Cw/HaFdXp7b/xgK2RrIZH5xcrF1 d4i/eaF70iuoySXEr+NUqCsAoCpDioumwvSV9JaPjostL7ZFs7bkJ7CWbTJudl5dgHO3 w5SA== X-Gm-Message-State: AFq9FYK5rAvoNrzkRodfRQF2lPFXBSuuQV0AjaTzBW8wMKQuxGP8gnyD cZBWv3qOHnToS/lCEa/tKexXsZfqRg4NRYGCHjXKrqGNlJUeK8od/mBVoGdLJQ== X-Gm-Gg: AYBFou1uZKEF+fm1OmXncqA6p91gLK0w003A2l85Uj2MbZNe1a+cDnXe/QqZE1ctMrq fRfitqyCStkOh7Bl8QWiL9SKQGLTjnKlHdR3VUEFLIJtk14RfyRRJt1/3AiG4IIIm5Jn2u1l72M VJ0MWDiKWpgUy6R5K8O0hQ35ti336IVdDqPUXZZozHQmdPaSKkVD/+SctIgs1UTLdLv+2lJrvHP 0ijSdGABPGdsli/Moy6knZCjMHbhtaPT4vbZsRhoG0zb5dusoAm/TS4neQRefwEbKPFv7AFEWjM bUio1zJ2yJxLwy+lAMli8huAKN+IXdq1C9nDfPfU5ZBwukUZQmbMWypyhMSZ8nhptFaexPR1gaT 0jJyE7Z8hxG/9YhQ0eFKTwb6bv+IuyrudPbP6ItEtzl8bVVczNU6qj3h8lH/AAiLsleG8UiQFU8 4hMem3/0Id+tCvUyvwlFLFQQy/z36WNRX/NqCs27xL1l9qV7/5vH3tgiZAWJq+WscgYUqgkLedE g05/c9lazNeJ/2u4oh1+wwhzm+T9xFSVExxcSE= X-Received: by 2002:a17:90b:4b92:b0:3a4:a525:56fe with SMTP id 98e67ed59e1d1-3ab3a359f94mr9722071a91.5.1791866461210; Mon, 12 Oct 2026 21:41:01 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3386ba90sm11672757a91.1.2026.10.12.21.40.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 21:41:00 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 16/16] gpsd: patch CVE-2026-60122 Date: Tue, 13 Oct 2026 17:40:06 +1300 Message-ID: <20261013044006.834868-16-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013044006.834868-1-ankur.tyagi85@gmail.com> References: <20261013044006.834868-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 04:41:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130830 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-60122 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit da527bb6ba21025da9ff5eafc758156d659f6c9f) Signed-off-by: Ankur Tyagi --- .../gpsd/gpsd/CVE-2026-60122.patch | 45 +++++++++++++++++++ .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch new file mode 100644 index 0000000000..da8fa5f4d2 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch @@ -0,0 +1,45 @@ +From 50bf98d0240b94bbec6ce06be33cdaf99e2f6214 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Mon, 20 Jul 2026 20:12:16 -0700 +Subject: [PATCH] clients/gpsprof.py.in: ensure sats.used is boolean. Issue + 406 + +Prevfent command injection by sates.used. Force to boolean. + +(cherry picked from commit 5a9c44a42136b9bb98d460a8a716e9fd344a8d93) + +CVE: CVE-2026-60122 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index e91367ee3..07123d417 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -334,8 +334,11 @@ class spaceplot(plotter): + # get sat used count + sats_used = 0 + for sat in self.session.satellites: +- if sat.used: ++ if sat.used is True: + sats_used += 1 ++ else: ++ # ensure it is boolean. ++ sat.used = False + + if 'altHAE' not in self.session.data: + self.session.data['altHAE'] = gps.NaN +@@ -783,6 +786,10 @@ class polarplot(plotter): + used += 1 + if 'polarunused' == self.name: + continue ++ else: ++ # ensure it is boolean. ++ sat['used'] = False; ++ + if (('polarused' == self.name and + sat['used'] is False)): + continue diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb index 52d86503a1..2bb70aca46 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb @@ -11,6 +11,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ file://CVE-2026-58459-1.patch \ file://CVE-2026-58459-2.patch \ file://CVE-2026-58459-3.patch \ + file://CVE-2026-60122.patch \ file://gpsd.init \ " SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649"