From patchwork Tue Oct 20 11:03:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 101380 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4898.1792494248458060135 for ; Tue, 20 Oct 2026 04:04:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=OrYzhkYa; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3a4b9732d5aso2828363a91.3 for ; Tue, 20 Oct 2026 04:04:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792494248; x=1793099048; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=T5dlxhYWULY7TJ5uvh5yd2JOP2ZczBQ8SgMUQQkEb/M=; b=OrYzhkYaHts6jCEQ5jtQzdtLuJxhi2oGmjH61CCdvuK5IASO2Jk8L7aBhmCUxiZ1Q0 qU2zM8OyKFSyOKhX7ncWTLB805lD2llYtWXcDxvAQBXbYC+9nc8THoD486bFgBV2/jzU CVZXqjbUYNQspdwiolb50//AEc59BIDE3kegde2R3iXiyQ4BrYm8WfRXqU8DCuwhkRAj m/4fMRHY4okgebgKxyYZPbnOBHHlsYDJw2ULd751Nfm0gow3E3cqpf1N1reCN2YG5rue bmzZYsK9hO6SU3bzS9azrmgwLliUbp/h8e2AtbIeHRhlexrH0/4OeJYLI0/s4I+28Kv0 NwJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792494248; x=1793099048; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=T5dlxhYWULY7TJ5uvh5yd2JOP2ZczBQ8SgMUQQkEb/M=; b=mofoIwUUDVuPYGio5DC+jsaUL9+sFgoEaxqATnzr10W+Df8Gsa3efq+K+BzCB2ziHF u6CJtArth2yVGQUzZFxnUo8vMLlsmp6xb50/NBp23ZT1vq4r6/CkK9ABcYlJ+Ezt4LYX NrgH6IpOm3fBiiCg79TvNn5TmAtXolw1HVkAhpx+66ZlWZj5HQjW+2j127cOa8s++Yk1 q4wj2iwSJX3im0f1jML5O7Kuu8Z4b0dVo0jIIErCJNAtDUm6CkerioQrxx7CkyaPzGkK HX6sdm1IoWRDYc4jDe/9bShhjz+3LaWd4UFGkOqxOTePeLUmS2NfSUn5E4gzoVB+yyKr 8B+A== X-Gm-Message-State: AFq9FYJ11GEzCjYS5jM5fyw8DI24Whw6KZe23bb7cGtSYVdVjqWI0XSB BFykGiQjL80slYWFyWsXu5TSntyUyKVDikWbPpiNOCc4jdIIOQAxd1vdVKM59w== X-Gm-Gg: AYBFou1NGIfQS5Es0SGTk0ksVCaxKPO2rWiV5k/0DVKTMe2qs6pFngnPPZ5dZS+ybQB BbYjmscvzp5uRw1CL+FOI6tt2MjTvhx8RUKx6iiavi4YMbpn5hEowFP+sUKiibv5OXQSKJGPH/9 IWx9Rmob49t18aiaht8iYX+8bY4GzOztpBYgUrCmlvvLsZ9xYzvWcUvTF6ZMWYPNDU/pXQCCqrr 2V3OaAN2c+PHgRqaHqr0lotm6XBLQmh4KdeO9/m6kPinN4LFeAvO1ZwlSp9635WWbnUj6BQACiU 91J+hw8soO/EuNxfR4eMjVD242UV9vgoD4iZI6x/SyBcNjNTOm7YgwLsFHs3jArZmUhN8XsVzro UHan6836OgvUcEJrAfpwR+Uptk96xV1uY5kSIOPZhSnommlqp5O4uPsppq4I0UqRLsHQAzqvIaj JdgOmN+nmQnWITPkQpQt++SC62kOtjoosuicUMptDDBVjgf6gl7Ertoi/IxHJsZtODFTm6rDl4n /D/foydMgA/qfFHlLNrDfoQOWvzawi8EuaarLRxnr92PkBA7w== X-Received: by 2002:a17:90b:390e:b0:3ac:ba49:2fed with SMTP id 98e67ed59e1d1-3acef5f1d7bmr10327906a91.58.1792494247550; Tue, 20 Oct 2026 04:04:07 -0700 (PDT) Return-Path: Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ad60f2c785sm3046683a91.7.2026.10.20.04.04.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 04:04:07 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 1/4] libvncserver: patch CVE-2026-44988 Date: Wed, 21 Oct 2026 00:03:54 +1300 Message-ID: <20261020110357.1995120-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 11:04:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131155 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-44988 Signed-off-by: Ankur Tyagi --- .../libvncserver/CVE-2026-44988.patch | 71 +++++++++++++++++++ .../libvncserver/libvncserver_0.9.15.bb | 1 + 2 files changed, 72 insertions(+) create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch new file mode 100644 index 0000000000..e26abc9db7 --- /dev/null +++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch @@ -0,0 +1,71 @@ +From db5779f2bec717f577fb66321b3b079ff156da95 Mon Sep 17 00:00:00 2001 +From: Kang Hee chan <24s101h0659@sonline20.sen.go.kr> +Date: Wed, 6 May 2026 21:48:54 +0900 +Subject: [PATCH] libvncclient: fix Tight gradient decoding overflow + +(cherry picked from commit 5b270544b85233668b98161323297d418a8f5fd1) + +CVE: CVE-2026-44988 +Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1] +Signed-off-by: Ankur Tyagi +--- + include/rfb/rfbclient.h | 3 ++- + src/libvncclient/tight.c | 10 +++++++--- + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/include/rfb/rfbclient.h b/include/rfb/rfbclient.h +index a974ff5f..666dcb90 100644 +--- a/include/rfb/rfbclient.h ++++ b/include/rfb/rfbclient.h +@@ -314,10 +314,11 @@ typedef struct _rfbClient { + rfbBool zlibStreamActive[4]; + + /* Filter stuff. Should be initialized by filter initialization code. */ ++#define TIGHT_GRADIENT_MAX_WIDTH 2048 + rfbBool cutZeros; + int rectWidth, rectColors; + char tightPalette[256*4]; +- uint8_t tightPrevRow[2048*3*sizeof(uint16_t)]; ++ uint8_t tightPrevRow[TIGHT_GRADIENT_MAX_WIDTH*3*sizeof(uint16_t)]; + + #ifdef LIBVNCSERVER_HAVE_LIBJPEG + /** JPEG decoder state (obsolete-- do not use). */ +diff --git a/src/libvncclient/tight.c b/src/libvncclient/tight.c +index 57a3715b..dad5514f 100644 +--- a/src/libvncclient/tight.c ++++ b/src/libvncclient/tight.c +@@ -229,6 +229,11 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh) + bitsPixel = InitFilterPaletteBPP(client, rw, rh); + break; + case rfbTightFilterGradient: ++ if (rw > TIGHT_GRADIENT_MAX_WIDTH) { ++ rfbClientLog("Tight Gradient rectangle width %d exceeds maximum %d.\n", ++ rw, TIGHT_GRADIENT_MAX_WIDTH); ++ return FALSE; ++ } + filterFn = FilterGradientBPP; + bitsPixel = InitFilterGradientBPP(client, rw, rh); + break; +@@ -430,7 +435,7 @@ FilterGradient24 (rfbClient* client, int srcx, int srcy, int numRows) + CARDBPP *dst = + (CARDBPP *)&client->frameBuffer[(srcy * client->width + srcx) * BPP / 8]; + int x, y, c; +- uint8_t thisRow[2048*3]; ++ uint8_t thisRow[TIGHT_GRADIENT_MAX_WIDTH*3]; + uint8_t pix[3]; + int est[3]; + +@@ -473,7 +478,7 @@ FilterGradientBPP (rfbClient* client, int srcx, int srcy, int numRows) + int x, y, c; + CARDBPP *src = (CARDBPP *)client->buffer; + uint16_t *thatRow = (uint16_t *)client->tightPrevRow; +- uint16_t thisRow[2048*3]; ++ uint16_t thisRow[TIGHT_GRADIENT_MAX_WIDTH*3]; + uint16_t pix[3]; + uint16_t max[3]; + int shift[3]; +@@ -705,4 +710,3 @@ ReadCompactLen (rfbClient* client) + /* LIBVNCSERVER_HAVE_LIBZ and LIBVNCSERVER_HAVE_LIBJPEG */ + #endif + #endif +- diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb index 77612e1626..47e42cd094 100644 --- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb +++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb @@ -46,6 +46,7 @@ inherit cmake pkgconfig SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag=LibVNCServer-${PV} \ file://0001-CMake-require-at-least-CMake-3.5.patch \ + file://CVE-2026-44988.patch \ " SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3" From patchwork Tue Oct 20 11:03:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 101381 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4899.1792494250653269779 for ; Tue, 20 Oct 2026 04:04:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=XWD6g/Fj; spf=pass (domain: gmail.com, ip: 209.85.215.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cc1bc88a20eso2001561a12.3 for ; Tue, 20 Oct 2026 04:04:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792494250; x=1793099050; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=I7IcKFN+mRbxB0Jt7GDfhFlCKIprJx/reEIRujSdvTg=; b=XWD6g/Fjy4T7JzxAfnqVGM8J+a4VWmZmpMKm4Imir1k7Kr28C9G5h46/Nl548lPDKT w3xyKRBmGXlgoXuXFtLcyofIBVowCikI96mVJBNd9e+jcrUE/zXP21t87u5r2xDXhTii tMO2CSWe7mxdjG0lQC7HLomyGHvdbaCXGVpkLKSYGNb+UKUt0YJ8rSuHX/oQ/89OGo5w uNv/T3ecvIiuzaQ1XiF/LfF8VqQ35J879fto5Xebi5jkd71vQXJa0b+5GEH8x5X7ttgz JGIx41FS2gsxZTN2PPaDJJFyvbmCe1bIjv1wQm38qJ5pUr3L66LCghHckDnAvLrS8zUS nbQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792494250; x=1793099050; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=I7IcKFN+mRbxB0Jt7GDfhFlCKIprJx/reEIRujSdvTg=; b=cEHx49SNNd/uILrhH3z4aXbhbuTLjfO4ZF/Ay7VibB2vpHGcDN+RtvdnJWL1cU/GIR M7kHgE+l8ZbQBa+1pKbh++WMC/oosBjDL12D1ArkFdiZNIOGD/kMFeI5TBEryeHS3Yg+ 2Fwp4yqRyL/av0SsW11xIQLy3ijxIsuMZQkYZDtQucrY23vGXzMlxXSwCt/MufiBWT/F C4UIwOi8FOarSDaK9tHN1gCe7YocWzqQCWIr+VdoTHmURIYnsNcIIbTyZhMREF2rkZn2 xRZ4oZPy2lOXtAtFIXQ8tFXfFYYdAtIapiwbLJxMhJXFoAsKYhH5RsL9SIHuPYLQ4Z+T irZA== X-Gm-Message-State: AFq9FYIiSt0lA/JRma5TnLUVT5cmfYs2jzagAuDJOXk2uJN8kYyNrMcM lMXtgTEYL6F95XTkI5AjjuiUIjKYZftz/4HghB9+cj8rT6rLTLD8VSAX6SSPpg== X-Gm-Gg: AYBFou1JhSy59iCklSgWRmssEruWgvh6H4Ur1Yzl2f7eCHK3mAubJGNynppP5wz/IcY /hZ0ycrMa7zu74CuwFi+Eq+nDUduXrFMAGJWqXrYgAHTxDYvzHuftniYdkbXWM++tGKXGSSkdom nJnUi+2SCEO2A+ZVNRAcHUhMj2YA0d9V7Y2yeSP81hWUOtpvQ0lnbmemJh/qgzfJTK9DmPUI13P qfHwpYNCksETkq2PyQTEZwNvTMlDX3CbmvDZts0tztCTfRfzpTChMJylkJHgDD31kDBMfUMKqKB difkFGdbMtasKsUDpFDf5KGlG/Mz9XPlGAPg6uTqi7y1CK28JiaGVE4LcS8mCs2ibykkUvL+Wvw dtXJ8HYG9gFLQCzBLXhwIlSRygLM+yUMiacuIONPW+A3DZ9Op8Od9pzY5pLWjyCEtYagfZNZVaw 1FXMJ+/6XAMKjATQJEDa500CT6ZoUXkpwQiXD641rglYko8c5K6fIPyuMMz92RJmeWXQDQTl5iv meyRSgey0NCKjM+VcL3TxVb9XtHlRhXNqSSVSv0HcrLLXU1TnrGcdDx/xJttXknbm86QGvNyBhw 5mbAD1JCumXI3fAzhPJ+Kj+pReGxWczae75V0cWBopON4d2X36YG X-Received: by 2002:a17:90b:3b8e:b0:3ac:a7ee:6766 with SMTP id 98e67ed59e1d1-3acef0e4f2cmr8750392a91.36.1792494249697; Tue, 20 Oct 2026 04:04:09 -0700 (PDT) Return-Path: Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ad60f2c785sm3046683a91.7.2026.10.20.04.04.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 04:04:09 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 2/4] libvncserver: patch CVE-2026-32854 Date: Wed, 21 Oct 2026 00:03:55 +1300 Message-ID: <20261020110357.1995120-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261020110357.1995120-1-ankur.tyagi85@gmail.com> References: <20261020110357.1995120-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 11:04:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131156 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-32854 Signed-off-by: Ankur Tyagi --- .../libvncserver/CVE-2026-32854.patch | 66 +++++++++++++++++++ .../libvncserver/libvncserver_0.9.15.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch new file mode 100644 index 0000000000..85adf3eba2 --- /dev/null +++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch @@ -0,0 +1,66 @@ +From bf01ccc67bc8181568af2d1f6e1f6f6888b51bde Mon Sep 17 00:00:00 2001 +From: Kazuma Matsumoto <269371721+y637F9QQ2x@users.noreply.github.com> +Date: Thu, 19 Mar 2026 17:42:00 +0900 +Subject: [PATCH] libvncserver: fix NULL pointer dereferences in httpd proxy + handlers + +httpProcessInput() passes the return value of strchr() to atoi() +and strncmp() without checking for NULL. If a CONNECT request +contains no colon, or a GET request contains no slash, strchr() +returns NULL, leading to a segmentation fault. + +Add NULL checks before using the strchr() return values. + +(cherry picked from commit dc78dee51a7e270e537a541a17befdf2073f5314) + +CVE: CVE-2026-32854 +Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314] +Signed-off-by: Ankur Tyagi +--- + src/libvncserver/httpd.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/src/libvncserver/httpd.c b/src/libvncserver/httpd.c +index 2186ae54..604e5bf9 100644 +--- a/src/libvncserver/httpd.c ++++ b/src/libvncserver/httpd.c +@@ -337,10 +337,11 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen) + + + /* Process the request. */ +- if(rfbScreen->httpEnableProxyConnect) { ++if(rfbScreen->httpEnableProxyConnect) { + const static char* PROXY_OK_STR = "HTTP/1.0 200 OK\r\nContent-Type: octet-stream\r\nPragma: no-cache\r\n\r\n"; + if(!strncmp(buf, "CONNECT ", 8)) { +- if(atoi(strchr(buf, ':')+1)!=rfbScreen->port) { ++ char *colon = strchr(buf, ':'); ++ if(colon == NULL || atoi(colon+1)!=rfbScreen->port) { + rfbErr("httpd: CONNECT format invalid.\n"); + rfbWriteExact(&cl,INVALID_REQUEST_STR, strlen(INVALID_REQUEST_STR)); + httpCloseSock(rfbScreen); +@@ -353,14 +354,17 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen) + rfbScreen->httpSock = RFB_INVALID_SOCKET; + return; + } +- if (!strncmp(buf, "GET ",4) && !strncmp(strchr(buf,'/'),"/proxied.connection HTTP/1.", 27)) { +- /* proxy connection */ +- rfbLog("httpd: client asked for /proxied.connection\n"); +- rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR)); +- rfbNewClientConnection(rfbScreen,rfbScreen->httpSock); +- rfbScreen->httpSock = RFB_INVALID_SOCKET; +- return; +- } ++ if (!strncmp(buf, "GET ",4)) { ++ char *slash = strchr(buf, '/'); ++ if (slash != NULL && !strncmp(slash,"/proxied.connection HTTP/1.", 27)) { ++ /* proxy connection */ ++ rfbLog("httpd: client asked for /proxied.connection\n"); ++ rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR)); ++ rfbNewClientConnection(rfbScreen,rfbScreen->httpSock); ++ rfbScreen->httpSock = RFB_INVALID_SOCKET; ++ return; ++ } ++ } + } + + if (strncmp(buf, "GET ", 4)) { diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb index 47e42cd094..9fbec58c72 100644 --- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb +++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb @@ -47,6 +47,7 @@ inherit cmake pkgconfig SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag=LibVNCServer-${PV} \ file://0001-CMake-require-at-least-CMake-3.5.patch \ file://CVE-2026-44988.patch \ + file://CVE-2026-32854.patch \ " SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3" From patchwork Tue Oct 20 11:03:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 101382 Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4900.1792494252530288845 for ; Tue, 20 Oct 2026 04:04:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=dbR5/7mL; spf=pass (domain: gmail.com, ip: 209.85.215.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-cd623dfe420so2270580a12.0 for ; Tue, 20 Oct 2026 04:04:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792494252; x=1793099052; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=quuckHUW88M0c3FHYx6XxuCwr9T1qdVWzn407ExGYz4=; b=dbR5/7mLmLF42SkydcVZESOrJYidmCSJ6XKKiHpTdhVm7WV2KYk0Luq+r80ysM/SjS mzw4AXH8i+ZD0Y1YLdPEYgY2wbX89CKLlFk0JHUcPlqjiMeR3h+qxfTcrpmNS4BTk5tK LgJWmiMhMkpcJcf4nplwan+vJeX39nr+zojoT9Zfo3fnboy8jc4aifRbLPsNNp2zHzFY ZrKr5xM+dE6r7pBl7JTJa1hsb1Uyq17na5oeXAMB9q2oCXnyjubZEvEoRMH/Lvebpu6M PY/bOMQHBiHc42lI2/xA6qX8bKLJydlO+zO3eXwhJWLucv9AlZZp2xDXUcJkuNhCwycR uPTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792494252; x=1793099052; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=quuckHUW88M0c3FHYx6XxuCwr9T1qdVWzn407ExGYz4=; b=e2sthoux3+veYut1E+++2x6gy5Ukj5L9QUbajyOseMBaqCbUERyzvzsywAHHRoFg51 AdDHSrCgAjWxFx9mWl4FRaDKjL36KOkAOmnzUXoH2y93yNjNXA7MokbdRlaurwubJg7R Wy12siM2coPzPq9FtbaZd0tr8Qqme3siTIcuJ0GQArOhLPAL2v1A8bWcVdfSWUs7kfPQ Xb3d39mHxfg+x6gZ6ax8foWOK20cdylCxsY5wuuSNJNsFnjb7GjHjXy33oSdzJXNCnB6 SVRTHcRginVAumh8uNbFMnEFYN0COq1TwdosnvbR/OiS5iqh91HfYO0BtdMPXyifiBad oUhg== X-Gm-Message-State: AFq9FYJw1jUbr7FN2BMIuwBu7nsGXSnoP/7NXFH05IRZaaLx4YwYgYB/ W2fsfzqwQpVgs0mSzj7+3LJlZ8U44k8/9pLlLU8cxOcGxeCay4HTtCncls9UEQ== X-Gm-Gg: AYBFou0N/qqOtYPyUtKphaaYtlChk+e4rlhHMWUiKahYA7K4bcsdQnUWnuZLqrTT63j TUmDtP5cjdcwhT8omv68exrSIfQ2PGMFBPZa20qi05jY2ftMIxJ6Ger5mOMyIC4T3IE96kVGJcB a5iDoP12li4EfudDV4Q9MTl+CqG93GDZUTFiPXiXqhiY7zb5QgxMSdFPdZDPgnG4r8qEp4JehWx J4A1PyXEUL9xCLdN4OZjTKHc/kLODgo/SdVr3Ou+mD6PJapPPuDDpCP57plqAQFBvGOpImobcAY ouBgGEBSHf5RHUKKav5vk3QLwIh+Agtyqh8x1yw3f+VeGzFzlDFplBFp9WUcBggaWhSo6h5mrK5 MmXptoXb0qi9G5fiqabW0/OQDS558EZ6C33YWUQEZDLboo7R+7iCKi/4BUaeDEUKf36d2rZ0WMt qtgMCvS6DspYFLmO6EVdVHVuvuryrImzfbp16VkTgaZzhoAE9myFT4AqzdEFa12XdANdKuJLB0o 5QwCim74RTd9dJKa9mRl1MtB216A9RzvpQffraovkzb/0VnDCGUcScZR7QXgskJpnsiuU59tSaR I6HF+ERWTJAsMhUrNkjWn/Tq47q8wZE= X-Received: by 2002:a17:90b:2646:b0:3ab:9c73:12a with SMTP id 98e67ed59e1d1-3acee277998mr8480194a91.2.1792494251765; Tue, 20 Oct 2026 04:04:11 -0700 (PDT) Return-Path: Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ad60f2c785sm3046683a91.7.2026.10.20.04.04.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 04:04:11 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 3/4] libvncserver: patch CVE-2026-32853 Date: Wed, 21 Oct 2026 00:03:56 +1300 Message-ID: <20261020110357.1995120-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261020110357.1995120-1-ankur.tyagi85@gmail.com> References: <20261020110357.1995120-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 11:04:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131157 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-32853 Signed-off-by: Ankur Tyagi --- .../libvncserver/CVE-2026-32853.patch | 76 +++++++++++++++++++ .../libvncserver/libvncserver_0.9.15.bb | 1 + 2 files changed, 77 insertions(+) create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch new file mode 100644 index 0000000000..23d6a3df1f --- /dev/null +++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch @@ -0,0 +1,76 @@ +From 4d5c0ea960e4a22cd8b8fb3c6e18b5a1b1797783 Mon Sep 17 00:00:00 2001 +From: Kazuma Matsumoto <269371721+y637F9QQ2x@users.noreply.github.com> +Date: Sun, 22 Mar 2026 20:35:49 +0100 +Subject: [PATCH] libvncclient: add bounds checks to UltraZip subrectangle + parsing + +HandleUltraZipBPP() iterates over sub-rectangles using numCacheRects +(derived from the attacker-controlled rect.r.x) without validating +that the pointer stays within the decompressed data buffer. A malicious +server can set a large numCacheRects value, causing heap out-of-bounds +reads via the memcpy calls in the parsing loop. + +Add bounds checks before reading the 12-byte subrect header and before +advancing the pointer by the raw pixel data size. Use uint64_t for the +raw data size calculation to prevent integer overflow on 32-bit platforms. + +(cherry picked from commit 009008e2f4d5a54dd71f422070df3af7b3dbc931) + +CVE: CVE-2026-32853 +Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931] +Signed-off-by: Ankur Tyagi +--- + src/libvncclient/ultra.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/src/libvncclient/ultra.c b/src/libvncclient/ultra.c +index 1d3aaba6..5633b8cb 100644 +--- a/src/libvncclient/ultra.c ++++ b/src/libvncclient/ultra.c +@@ -126,6 +126,7 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh) + int toRead=0; + int inflateResult=0; + unsigned char *ptr=NULL; ++ unsigned char *ptr_end=NULL; + lzo_uint uncompressedBytes = ry + (rw * 65535); + unsigned int numCacheRects = rx; + +@@ -194,11 +195,18 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh) + + /* Put the uncompressed contents of the update on the screen. */ + ptr = (unsigned char *)client->raw_buffer; ++ ptr_end = ptr + uncompressedBytes; + for (i=0; i ptr_end) { ++ rfbClientLog("UltraZip: subrect %d header exceeds decompressed data bounds\n", i); ++ return FALSE; ++ } ++ + memcpy((char *)&sx, ptr, 2); ptr += 2; + memcpy((char *)&sy, ptr, 2); ptr += 2; + memcpy((char *)&sw, ptr, 2); ptr += 2; +@@ -213,8 +221,13 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh) + + if (se == rfbEncodingRaw) + { ++ uint64_t rawBytes = (uint64_t)sw * sh * (BPP / 8); ++ if (rawBytes > (size_t)(ptr_end - ptr)) { ++ rfbClientLog("UltraZip: subrect %d raw data exceeds decompressed data bounds\n", i); ++ return FALSE; ++ } + client->GotBitmap(client, (unsigned char *)ptr, sx, sy, sw, sh); +- ptr += ((sw * sh) * (BPP / 8)); ++ ptr += (size_t)rawBytes; + } + } + +@@ -222,3 +235,4 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh) + } + + #undef CARDBPP ++ diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb index 9fbec58c72..e2f995947f 100644 --- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb +++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb @@ -48,6 +48,7 @@ SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag file://0001-CMake-require-at-least-CMake-3.5.patch \ file://CVE-2026-44988.patch \ file://CVE-2026-32854.patch \ + file://CVE-2026-32853.patch \ " SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3" From patchwork Tue Oct 20 11:03:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 101379 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4902.1792494254817517730 for ; Tue, 20 Oct 2026 04:04:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Yn+48HEw; spf=pass (domain: gmail.com, ip: 209.85.216.47, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-3ace1f3897cso1779826a91.0 for ; Tue, 20 Oct 2026 04:04:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792494254; x=1793099054; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bMZWrUxPiD/DZ3eOTZX4K9oNsIWXpZlaHqLpM/3qtvg=; b=Yn+48HEwi3zQ9M8o2BtcYvo3gCTsq8b45JglDNHkDhyzknMYwR7tPvnz6iRSuEGyA0 rDMIOAKO+SAa9FVanFuGcV8Kn9sv8/iJgXyoXkKufs4SHzR24P1OL01aLZDofWenMsL1 GIvvk57tFHcxepj02e9xkk338NUobhBXMZxdDoZ+/QG6RU5l6t/BMEMSAJyEl2bYWzfa DFZAAfErjRSBSMZkdxkhquDLJRQAtSNQvw757Bz5C6KmT22ilnuiKY3mb0gijyqv1iKd UN9dHPTud/zB/OMXF0n6SMNy21Z3KTTopuPqzTrHAE8AeACI5RWlhROwrHu7v+x5qEKG /uag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792494254; x=1793099054; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bMZWrUxPiD/DZ3eOTZX4K9oNsIWXpZlaHqLpM/3qtvg=; b=iHNoemQFZS3tnf1EBYOdam9WH8GjENgIvo3X+0o5NteVr/ykdqCfsdXqPtz2IwBd9K A2qjHRRdPZ26OiqFOiSOqW8zqPHlsJpT8BScTfmTDJVN9LtH9o25GROoTMyZsHTJumkM JLs/L3dqSZmUI8c4KhHfC4T4inAsS5EI4zUKYf+mgnRDhXb9ZdZ0zJWBlG7rpdS41VcP S6qWp+WqI/ZDfaJb8C4CgIT7SqLMCM1QpQYliY9mfGs4PCCfCJaUBnxrHtXwRjQn+AWT TOKWxJk3ro8Mk8938S+F5/BgliJSqolakSfVtHGZs3NONok58KQHNvE0BRfL2GlJJIEm sEyg== X-Gm-Message-State: AFq9FYIP0Lt9p/o8Z2nTvwan7ITgTHr5Z4M5lXxALmUGCL4XsN5agOoD gFu2aI51Yg132Q8y5rdMdzTROf6CIX4pancBXCAsOpD3SqBpSWSPx+1KCbZhyg== X-Gm-Gg: AYBFou13k28xm4gBxUU9nTFXFRMrG51nmX3YCEApEf7WAGMlzOgSaWR/DiESTLwY4lX fUaauexw8tCVuO/YiSqUO9iP2xanIixn4tp8GdjrsEu/x4KGJX1fukWmqSXiFtIW1U3NxrW9ySj eW0wh4V7qCHJt4dGxqZJ85UTdbTKjC4WEmo7aoVGcur9uO8y+2QpiVVteE3HumbGGiaZhVuFkpP CcHgBNN7r/6mG1Pg1MM0ZZWUELMLYBdWzBIGKuxXeiFQGyYp10x0RJq/5eiol/J5lwCctlAlO5g Za0RR0vNrvEt535mVg55COW5FFE+YG2txGMAOZ0q6TGk2UyN2ejS0JrqqvpCF6fg5K1yIeoBqzw ChwCs4kMYNuqJS6WxpSSm0o4rM3uTY/1szt6+pvmSgUBIbkBUyB6zcs1xNINDR79DCvPfw46fSQ RIV+pCgOcE+xqB9Lyq4ekS+xNC4QyzvN1Ov+5ZfSrMDPTcNpEhQiRCa31JKxC9Csr9AM904DICi nKNtkCpHpl+wA8SyTOc3pVeKct4SrmNkz+kgds= X-Received: by 2002:a17:90b:4c4c:b0:3ac:a491:3cf8 with SMTP id 98e67ed59e1d1-3acef52ae1emr9165540a91.43.1792494254095; Tue, 20 Oct 2026 04:04:14 -0700 (PDT) Return-Path: Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ad60f2c785sm3046683a91.7.2026.10.20.04.04.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 04:04:13 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 4/4] libvncserver: patch CVE-2026-50538 Date: Wed, 21 Oct 2026 00:03:57 +1300 Message-ID: <20261020110357.1995120-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261020110357.1995120-1-ankur.tyagi85@gmail.com> References: <20261020110357.1995120-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 11:04:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131158 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-50538 Signed-off-by: Ankur Tyagi --- .../libvncserver/CVE-2026-50538.patch | 49 +++++++++++++++++++ .../libvncserver/libvncserver_0.9.15.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch new file mode 100644 index 0000000000..da01736323 --- /dev/null +++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch @@ -0,0 +1,49 @@ +From e824e7d8ea71feccb81aeb34771eb83e052c3fe2 Mon Sep 17 00:00:00 2001 +From: "Bas.Levering" <45083161+Bazskillz@users.noreply.github.com> +Date: Fri, 29 May 2026 09:08:28 +0200 +Subject: [PATCH] Merge commit from fork + +HandleTightBPP's basic-compression loop wrote each batch of decompressed +rows straight into client->frameBuffer (via FilterCopy/Palette/Gradient) +and only compared the running total against the rectangle height rh after +the loop. A malicious or man-in-the-middle server can send a zlib stream +that decompresses to more rows than rh, so the writes run past the end of +the framebuffer allocation: an attacker-controlled heap out-of-bounds +write reachable in a default build (Tight is advertised when built with +libz+libjpeg), pre-authentication, from one FramebufferUpdate. + +Clamp numRows to the remaining height before calling filterFn, matching +the existing house style (trle.c and the Tight JPEG path already clamp to +the rectangle height). + +Co-authored-by: Bas Levering +(cherry picked from commit 540332be3e0acc566fa64da6f1b4680c72c724dd) + +CVE: CVE-2026-50538 +Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/540332be3e0acc566fa64da6f1b4680c72c724dd] +Signed-off-by: Ankur Tyagi +--- + src/libvncclient/tight.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/src/libvncclient/tight.c b/src/libvncclient/tight.c +index dad5514f..3ee0d5e0 100644 +--- a/src/libvncclient/tight.c ++++ b/src/libvncclient/tight.c +@@ -341,6 +341,16 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh) + + numRows = (bufferSize - zs->avail_out) / rowSize; + ++ /* The decompressed stream is server-controlled and may yield more rows ++ than the rectangle's declared height. filterFn() writes directly into ++ client->frameBuffer, so clamp here before writing to avoid running past ++ the framebuffer (heap out-of-bounds write). The post-loop ++ "rowsProcessed != rh" check happens too late. */ ++ if (numRows > rh - rowsProcessed) { ++ rfbClientLog("Tight: too many scan lines after decompression.\n"); ++ return FALSE; ++ } ++ + filterFn(client, rx, ry+rowsProcessed, numRows); + + extraBytes = bufferSize - zs->avail_out - numRows * rowSize; diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb index e2f995947f..ff7327c6cf 100644 --- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb +++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb @@ -49,6 +49,7 @@ SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag file://CVE-2026-44988.patch \ file://CVE-2026-32854.patch \ file://CVE-2026-32853.patch \ + file://CVE-2026-50538.patch \ " SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"