From patchwork Wed Nov 4 08:58:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 102867 Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5130.1793782723910745238 for ; Wed, 04 Nov 2026 00:58:43 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=eD0DOqhT; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-cc502d509c0so167198a12.2 for ; Wed, 04 Nov 2026 00:58:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793782723; x=1794387523; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Guy0I91qw3sIoaWNcLghzUXAkO+zYUptDzp1uacYV30=; b=eD0DOqhTG3ukvnc8SP7pZQ6F7EKinSftKurbRvUSJFffRWfKkiXmcxStUJ3yU9K9dk 5EzG8eJgKrQd+SgPw+fwMahMNo211DA67xphy8oBs90Uysjs6FWv46DWXmunHgqLOUSh Y0bSivbiD73Qk/427u9IqLP6j1yWA7jYcls4DMqjfSRrTE587NVB/wlTzkG5tGif9nW0 LSkafeL1s+kqxOqCsWNym5CRdAfWHp1qnVZcF9zfu2rkpVyz4YyWnoGze3pLItCSDXg+ tC5jIbvf9dDEc59pPGm46sqFweI/uR/hGk5IplQPHQG8t26jJv6YYKTNth+UqTl3i2Xn sO3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793782723; x=1794387523; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Guy0I91qw3sIoaWNcLghzUXAkO+zYUptDzp1uacYV30=; b=WPSHtZWuPvODSweNhJBBUe+TW8sZOqTvYVpCSCkIAZ5cND5m8oR4beYzm6Lu/rn9Qx CXyRq54TfgiNjFAJPM/sPGWHEe9QVUhhtz5L5znuQcB95QWQAvamRFAbAzjhbzURtiUS /hxC+WmySNOK0YDypenB7kkh7wgJ5gaXMft6WaMssxluCVdDFoBToLMar2HiViehiUnS aHGHVr0JDrRz/sqV62yWPhwdA8wLHSfJm6oijlc5dfl71JsK99xA4Prx+bFSjDo9uEn2 ifq/30zJiBwc/q6kWRVfTT4/2L+ga+1eacGndw05XVUCF8Am9ivb1oCAfrUPC7Nt9w9y EwwQ== X-Gm-Message-State: APuU4Z9OfX636Yt09yVIn77iiLZh1jZ/r+Cq1EE2scKvGqRYZE1TdufR ++fbbgGVoZ1F2xgVD9O5OJmrM1XhBf7Li2yZEdnelE+W35Uy7e1Dq/kMab1QqA== X-Gm-Gg: AYBFou1h010FtvMU/NI9IttBTxkIhu2Kx1y0Ikv5q6fNep02jkWe/9g01XCVRJTwKhJ 9SSVF8FxTi8oFOaGVVZpr5NOczjM8+qdf1Kr/FO2hNix1V8+Uju4NfCezkNAjfXtr1IJBTpsC2V 2/NVEpPFVt1u36qGPUIg7ab/gJMMOkDf2ZGQ2Sxv3F4hg9wG4O87MZL4Z/d8tdY/50OZ06LTiuH kqrdj9qqoSVFQ0taoe5mGlx61ox50GVpkKXfTOE8wiHUpDXWmnKOBcj2Q5ZDl5uiwtcNAXVK4W3 5OA/FE/AVmhmUVxlek+bbxt6LhTDO3wnr9lET4uPuBQYsjA2MFTDrPc440/xu5Ld/It5qRcNJCX PUlvzwiwDy0ZH2wvCzTWw4vcZxYo+h/JKgIbV6ch/Gl07NZuF1d9wTS/pctscjwyyrG+l6mZePl d+ajToIzWnMmCDARpueEjbSJO/EdUIDcG7lI+tOCzYWvgIfyaosWlv+HXqgoPET1DneUBS/nKyQ vwEoiWt/mXP/81jvSfzP6ACIHkr3GGIi4gCOMgKPo/UFy8yeZoL34YJ2WWzmJA6NmLp4fj95QWK JetjT/w/UQOb2f0HMrDIPpG/LIsB+xNC4bv6HyN7BcstfqUfhRbstQ9Qc6mB3w== X-Received: by 2002:a17:90b:17cd:b0:3ac:9e5e:d195 with SMTP id 98e67ed59e1d1-3ae89851212mr12224565a91.61.1793782723089; Wed, 04 Nov 2026 00:58:43 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3b093d481a3sm3139981a91.1.2026.11.04.00.58.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 00:58:42 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 1/4] assimp: patch CVE-2026-117608 Date: Wed, 4 Nov 2026 21:58:31 +1300 Message-ID: <20261104085834.1877643-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 08:58:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131835 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-117608 Signed-off-by: Ankur Tyagi --- .../assimp/assimp/CVE-2026-117608.patch | 62 +++++++++++++++++++ meta-oe/recipes-graphics/assimp/assimp_git.bb | 4 +- 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-graphics/assimp/assimp/CVE-2026-117608.patch diff --git a/meta-oe/recipes-graphics/assimp/assimp/CVE-2026-117608.patch b/meta-oe/recipes-graphics/assimp/assimp/CVE-2026-117608.patch new file mode 100644 index 0000000000..2a388cb147 --- /dev/null +++ b/meta-oe/recipes-graphics/assimp/assimp/CVE-2026-117608.patch @@ -0,0 +1,62 @@ +From 9b9c149237ff7bf7f71db8eba7b6cc707e00e0bc Mon Sep 17 00:00:00 2001 +From: venkatchalla06 <111296179+venkatchalla06@users.noreply.github.com> +Date: Sun, 25 Oct 2026 19:48:47 +0530 +Subject: [PATCH] MD2: compute the frame-table bounds check in 64-bit (integer + overflow) (#6963) + +The header validation rejects out-of-file offsets with + offsetFrames + numFrames * frameSize >= fileSize +but numFrames is an attacker-controlled uint32 and frameSize is an unsigned +int that grows with numVertices (another uint32 field), so the product is a +32-bit multiply that can wrap. The AI_MAX_ALLOC guards above bound numFrames +only against sizeof(MD2::Frame) (~44 bytes, ceiling ~48M), while frameSize can +be far larger (e.g. numVertices=1014 -> 4096), so numFrames ~= 2^20 already +wraps numFrames*frameSize to a small value and the check passes. The frame +vertices are then read out of bounds (heap OOB read / info leak). + +Compute frameSize and the four offset+count*size checks in 64-bit so the +products cannot wrap. Reachable from Assimp::Importer::ReadFile() on a crafted +.md2 (MD2 is default-enabled). Confirmed with AddressSanitizer +(heap-buffer-overflow READ in InternReadFile); valid .md2 files +(dolphin/horse/flag/faerie) still load unchanged. + +Co-authored-by: Claude Opus 4.8 +Co-authored-by: Kim Kulling +(cherry picked from commit 7dbc85d9218fae017d4fad70269e7569f7b0c870) + +CVE: CVE-2026-117608 +Upstream-Status: Backport [https://github.com/assimp/assimp/commit/7dbc85d9218fae017d4fad70269e7569f7b0c870] +Signed-off-by: Ankur Tyagi +--- + code/AssetLib/MD2/MD2Loader.cpp | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/code/AssetLib/MD2/MD2Loader.cpp b/code/AssetLib/MD2/MD2Loader.cpp +index f7101560d..adce318f8 100644 +--- a/code/AssetLib/MD2/MD2Loader.cpp ++++ b/code/AssetLib/MD2/MD2Loader.cpp +@@ -171,13 +171,17 @@ void MD2Importer::ValidateHeader( ) + } + + // -1 because Frame already contains one +- unsigned int frameSize = sizeof (MD2::Frame) + (m_pcHeader->numVertices - 1) * sizeof(MD2::Vertex); +- +- if (m_pcHeader->offsetSkins + m_pcHeader->numSkins * sizeof (MD2::Skin) >= fileSize || +- m_pcHeader->offsetTexCoords + m_pcHeader->numTexCoords * sizeof (MD2::TexCoord) >= fileSize || +- m_pcHeader->offsetTriangles + m_pcHeader->numTriangles * sizeof (MD2::Triangle) >= fileSize || +- m_pcHeader->offsetFrames + m_pcHeader->numFrames * frameSize >= fileSize || +- m_pcHeader->offsetEnd > fileSize) ++ // Compute in 64-bit: numVertices/numFrames are attacker-controlled uint32 header ++ // fields, so numFrames * frameSize (frameSize itself grows with numVertices) overflows ++ // a 32-bit product and can wrap past the file-size check below. The AI_MAX_ALLOC guards ++ // above only bound each count against sizeof(element), not against this product. ++ const uint64_t frameSize = (uint64_t)sizeof(MD2::Frame) + (uint64_t)(m_pcHeader->numVertices - 1) * sizeof(MD2::Vertex); ++ ++ if ((uint64_t)m_pcHeader->offsetSkins + (uint64_t)m_pcHeader->numSkins * sizeof(MD2::Skin) >= fileSize || ++ (uint64_t)m_pcHeader->offsetTexCoords + (uint64_t)m_pcHeader->numTexCoords * sizeof(MD2::TexCoord) >= fileSize || ++ (uint64_t)m_pcHeader->offsetTriangles + (uint64_t)m_pcHeader->numTriangles * sizeof(MD2::Triangle) >= fileSize || ++ (uint64_t)m_pcHeader->offsetFrames + (uint64_t)m_pcHeader->numFrames * frameSize >= fileSize || ++ m_pcHeader->offsetEnd > fileSize) + { + throw DeadlyImportError("Invalid MD2 header: Some offsets are outside the file"); + } diff --git a/meta-oe/recipes-graphics/assimp/assimp_git.bb b/meta-oe/recipes-graphics/assimp/assimp_git.bb index 561ef50508..5fd56f719d 100644 --- a/meta-oe/recipes-graphics/assimp/assimp_git.bb +++ b/meta-oe/recipes-graphics/assimp/assimp_git.bb @@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=f2d38c9e0d63058b051065fb7b1102a8" DEPENDS = "zlib" -SRC_URI = "git://github.com/assimp/assimp.git;protocol=https;branch=master" +SRC_URI = "git://github.com/assimp/assimp.git;protocol=https;branch=master \ + file://CVE-2026-117608.patch \ +" SRCREV = "fe1965b3e73f7c241265e8e5b3015764936a6ce5" From patchwork Wed Nov 4 08:58:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 102868 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5131.1793782725855966596 for ; Wed, 04 Nov 2026 00:58:45 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=wIhPxSPf; spf=pass (domain: gmail.com, ip: 209.85.215.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cc4aa0246b7so225004a12.3 for ; Wed, 04 Nov 2026 00:58:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793782725; x=1794387525; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IJE9+Tm2KQ3aXQWBYP6o9BO+bZM4qzqKnZR5fljxIuU=; b=wIhPxSPfOdosrjwPBvf9zmQzwL1bkDeIyq+uhEfOyRHSZoD+6VmqMgekcFscJ9/SQx nlp5JCp+dU3VxRp5CXPEbNHBlGQucMjYC276J4Eqg6g02EaA/xU1K262QJurDs+bbkrz r+rafIT3wo/hs+qSKfbd4dSMO/js8opEJ0uhOJG/f6/hi9uF6bk9ZAOk+0oFWepX8DjO 9eXMO9iPCI0x9THKLefBXJZtMvRSvDjceQgd2fXcpjJGIbkCKlb/oP3WfMezRuhaG3sZ ZUVxkylZufy9qI/c1ooNm+XxXO3M2C/QrHljn75p/ydfXPsVnLUZLUJAwY6RkJ6oMF8p YJQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793782725; x=1794387525; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=IJE9+Tm2KQ3aXQWBYP6o9BO+bZM4qzqKnZR5fljxIuU=; b=tsVZQIyOancOYGISvDSg3uExvhcADsWd6bV2sAI81evRywOKyZVomiExrSf3qVOS0i 1VN63UwS0aKLReGULYhLn3M+nHepVg3/wwb5i+wFpi1/pvoHSFe4ELzcrMRmpuNiV2uE fBRBmZ3KNDd8XjBL6xVJE8zxBYXy6BuTKidzbElNSttRE+MmHZglABk1rRsZYYHsX0g0 Vl5TqweOt/rLWhO2ces7DRGruJc0mqz6pGnDDkWKWxoVmiagGErjh/4cVnaKXH+4vKoD Pr7bzzK1GUBGU8NnplCys1vepF0JhHCMLUGq/FSFOikqWWMl6+e6qFRy7IkXaESR6izA tHHw== X-Gm-Message-State: APuU4Z+wMNjsJR0708JWA6woKjZRyl5ORbEjdi+U/X9ePhysTBI28CTq 49uPmKmIK99ArD7+Ds2pxitZpNAArSWmyB9ew9WhX6I8UaFdHuo0vPszIKu0pA== X-Gm-Gg: AYBFou3tdQCQVwa8B1ghr8kaP7AQvMVO4GJwDAs5/xra3FtwBijvQr6aSfn1KCNfm4I RHyniQ2Vmnvhf52DvmPpDYBJMQJ/2G2CE4z4ntLiOwJ5wmU3EPcqFhmwalbGwMBS9a51nvO2Pd9 dJQSlPi+L0DWboh1ECM3dw53bP+0723VCbQ8yH8KQmjNeVmXEKCUWFNLO0L0I0iJ41CARtb0e0M /0oxXZ7hHeiDPiN+Mm4yR+NN002HVe0XEYnP50PJPsove/snt32JiCFs2w7IaU7QALxFa4emQDy QquQl9arUby2ZSEKIIcO730Sn5CH7tSOlDlEHZ1KV12t+Yof1Gkn4uD6nzac8pJKcZ07TbNKb1F /SQofgAj4dow38XuoM6AorWGfnS8nbEIQd+5mz++uAYJhgWBItp9NAqVNDR7evBwtaXXSBqLIVI wT80SqfLdME9ySBNuiqjNnldVYRNsYrdGB8Tzh6dgt1EOsC2YhcX7Zadrbk2hIJLT4WOO47MiRY G9Uxg2RxdT3O8p4FeeceUfRhFJlw3rDLAsz+AvsXjPNkhbCaMM2yJ4YCa1xiZUKBK6FO5j20gOw /2Ahfn72LpBSdxMElLKyN0zrNi83wBdVIECoKAI+Xpoc+Yd+CO6fgmh/T9wfvA== X-Received: by 2002:a17:90b:4c52:b0:3b0:a4d1:6d7a with SMTP id 98e67ed59e1d1-3b0a4d1700dmr88420a91.31.1793782725207; Wed, 04 Nov 2026 00:58:45 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3b093d481a3sm3139981a91.1.2026.11.04.00.58.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 00:58:44 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 2/4] flatcc: patch CVE-2026-116733 Date: Wed, 4 Nov 2026 21:58:32 +1300 Message-ID: <20261104085834.1877643-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261104085834.1877643-1-ankur.tyagi85@gmail.com> References: <20261104085834.1877643-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 08:58:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131836 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-116733 Signed-off-by: Ankur Tyagi --- .../flatcc/flatcc/CVE-2026-116733.patch | 30 +++++++++++++++++++ .../recipes-devtools/flatcc/flatcc_0.6.4.bb | 4 ++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-116733.patch diff --git a/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-116733.patch b/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-116733.patch new file mode 100644 index 0000000000..86272984f7 --- /dev/null +++ b/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-116733.patch @@ -0,0 +1,30 @@ +From 8fcc19366aa081068d2c845084a3ffd907c88129 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Mikkel=20Fahn=C3=B8e=20J=C3=B8rgensen?= +Date: Thu, 22 Oct 2026 18:59:04 +0200 +Subject: [PATCH] Guard against adversarial buffer overrun in JSON parser + +(cherry picked from commit 356792dc155a9e685acdfe0ec1e209bdadcb4ab9) + +CVE: CVE-2026-116733 +Upstream-Status: Backport [https://github.com/dvidelabs/flatcc/commit/356792dc155a9e685acdfe0ec1e209bdadcb4ab9] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/runtime/json_parser.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/runtime/json_parser.c b/src/runtime/json_parser.c +index 4472af2..f9bc9fa 100644 +--- a/src/runtime/json_parser.c ++++ b/src/runtime/json_parser.c +@@ -538,7 +538,7 @@ static const char *__flatcc_json_parser_number(flatcc_json_parser_t *ctx, const + if (buf != end) { + if (*buf == '.') { + ++buf; +- if (*buf < '0' || *buf > '9') { ++ if (buf == end || *buf < '0' || *buf > '9') { + return flatcc_json_parser_set_error(ctx, buf, end, flatcc_json_parser_error_invalid_numeric); + } + ++buf; diff --git a/meta-oe/recipes-devtools/flatcc/flatcc_0.6.4.bb b/meta-oe/recipes-devtools/flatcc/flatcc_0.6.4.bb index 059f888eed..9defbfac04 100644 --- a/meta-oe/recipes-devtools/flatcc/flatcc_0.6.4.bb +++ b/meta-oe/recipes-devtools/flatcc/flatcc_0.6.4.bb @@ -6,7 +6,9 @@ SECTION = "devel/lib" LICENSE = "Apache-2.0" LIC_FILES_CHKSUM = "file://LICENSE;md5=b3d8fb7158bf7e2600ba3191428dc4ef" -SRC_URI = "git://github.com/dvidelabs/flatcc.git;protocol=https;branch=master;tag=v${PV}" +SRC_URI = "git://github.com/dvidelabs/flatcc.git;protocol=https;branch=master;tag=v${PV} \ + file://CVE-2026-116733.patch \ +" SRCREV = "fec0275c0d0c5b6f495ab48d51fcde521d72b5fc" inherit cmake From patchwork Wed Nov 4 08:58:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 102869 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5170.1793782728342376382 for ; Wed, 04 Nov 2026 00:58:48 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=AyMiGRIj; spf=pass (domain: gmail.com, ip: 209.85.215.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cd6acc50b8dso185149a12.3 for ; Wed, 04 Nov 2026 00:58:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793782728; x=1794387528; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QGVcId33t5eJZuJaKQ2SCEhOJlmexKzUz6k2mZ/kLGw=; b=AyMiGRIjjZ85ycpYxJOADi1A5/w2YM3tEfSBGjsxBu2yGTtINFKmqLevUTLAfPfnNo 7VxlGYVWutGu64ZNm2AYjR5sNiFPH+sqAmLKLEXTanW42qmmpw0cgiT7FcT6jAF1mQ4L aMmQie5qGaW65QZCdENYsWCHlkIzBe/B7k/WBpG37o0f8jHCWW54JomZLqs8wVamVF3D 2vxJjxZ58Rh1C89O+Pt/RiheGpHanh8+/xYeRHakOdmf9B4Ps4HvTLDji1PJl2PQ2y2Y AVVTgJ7qHWyf6NpWGSQ/VtzXNA/8OXg2sJLkaONovX+BJAf5WzSeM+GN/P9Kk3WqFYdO fCig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793782728; x=1794387528; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=QGVcId33t5eJZuJaKQ2SCEhOJlmexKzUz6k2mZ/kLGw=; b=u2JFXX+kT8wzqh/xV/jbnDc7Hn5/FksnfAWEJsAfSNkz57WStROHd+jfznJlni1BMN jgG5SlZfdx5zbi5AuKFZkG3GMW9ChftT4FLg6UJFyv8bWhgjxPzyo4Vr3AWMdDn1bbSc wJMCOuWLwiXENu20X2PH+TJUKdfcxEcBpN6YEkl+ern1i6mRJMH7r4XzebNzXuQVQpVR Zzgb4GgPmo9ni/9qnYOt7aWboQprobqm5FW46B+/HD3HhwBsja/ut9eykG5mTdCmxzyd hae/+WYooo9599SGBzGiSv76T6KqxVHpvwR2NM8bSzZsWHsDWNb0KEfaIA0/iZNQHbCB 0nVw== X-Gm-Message-State: APuU4Z9W7cRCpN2nAXbpO6/Um/QnsU+2+4v4rmm2qeu6/VSnbliprsSB ieQ8Y10XFho6N7+v4ZkIhLbXPkp204kdrwB/Gw+BeURwHeERYOPvhgL9Ki6sZw== X-Gm-Gg: AYBFou1yKywYI4gBCdbXaghQm2sXQGxLnVop0AvptPpAOpoCv+XOvKGno+KRDwmUABy KtZ9JLx5rvd9g55jo1x2/95OpS/ZeSw3EKXPqVBUIzLgM7LDm09RdFa09lzw0mCS8QfVHFdu2Fa iPofqRyP1ibbE/PinLHkg7lK+7uI2cMGaybXFJJ6E72bfqJAo2ybT5Uf/7tI+ZcjcYKRNx4swO7 +ceD/Ax1IWNz8hp37IGIEOFEFUaVH6CZKUMTfYPJduh0BDWrrzpxKCrhaBjQ4GJSToZcxWJnv31 xhpl5PnQtG4/+/4d0KpgdQsDWx25p+nWkSwX/2VIUiyqYXndWFNz7mlvZgUPeHZtGQcitFj1HPo udjc0Cye5maL2Fn0PyBZjQ8+As4xwMD7FW8/taKE0cT/2hJKTsLENlJqmVrM0pIodfA9jcuda4M aFYq4RgmrZSjVw4QynzaQ3GkSqweIM/9uyfbri8MKSxTAxI+U4bOeIDutdEc6VWej4kjEyyvQ79 pDl6Z7un7g8wdzIADi7vLiTJr9nwj6+fKN2eqExS1tnDiMrIcb/SGQKW6JbfLLA0D5XsJ1JyHYE 7T9B5Y4Y3L3hlT/wSI/MhlDsUiFEk9bqEOQjmMx3TlKqytrKq52bmQaDOsLldA== X-Received: by 2002:a17:90b:1e42:b0:3a0:7261:d58e with SMTP id 98e67ed59e1d1-3ae896f8250mr13902108a91.22.1793782727446; Wed, 04 Nov 2026 00:58:47 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3b093d481a3sm3139981a91.1.2026.11.04.00.58.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 00:58:47 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 3/4] flatcc: patch CVE-2026-116734 Date: Wed, 4 Nov 2026 21:58:33 +1300 Message-ID: <20261104085834.1877643-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261104085834.1877643-1-ankur.tyagi85@gmail.com> References: <20261104085834.1877643-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 08:58:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131837 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-116734 Signed-off-by: Ankur Tyagi --- .../flatcc/flatcc/CVE-2026-116734.patch | 30 +++++++++++++++++++ .../recipes-devtools/flatcc/flatcc_0.6.4.bb | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-116734.patch diff --git a/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-116734.patch b/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-116734.patch new file mode 100644 index 0000000000..a9e5b59d39 --- /dev/null +++ b/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-116734.patch @@ -0,0 +1,30 @@ +From 0bdd50b31bfaabaef9cd92c1a3da7413fc091684 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Mikkel=20Fahn=C3=B8e=20J=C3=B8rgensen?= +Date: Thu, 22 Oct 2026 19:38:52 +0200 +Subject: [PATCH] Fix incorrect overflow guard in verifier + +(cherry picked from commit 0df9c097a19badc8bd22d93af8fd47bd291e5d9f) + +CVE: CVE-2026-116734 +Upstream-Status: Backport [https://github.com/dvidelabs/flatcc/commit/0df9c097a19badc8bd22d93af8fd47bd291e5d9f] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/runtime/verifier.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/runtime/verifier.c b/src/runtime/verifier.c +index e2d1bb6..19243c1 100644 +--- a/src/runtime/verifier.c ++++ b/src/runtime/verifier.c +@@ -127,7 +127,7 @@ static inline int check_header(uoffset_t end, uoffset_t base, uoffset_t offset) + { + uoffset_t k = base + offset; + +- if (uoffset_size <= voffset_size && k + offset_size < k) { ++ if (k + offset_size < k) { + return 0; + } + diff --git a/meta-oe/recipes-devtools/flatcc/flatcc_0.6.4.bb b/meta-oe/recipes-devtools/flatcc/flatcc_0.6.4.bb index 9defbfac04..330aeccc16 100644 --- a/meta-oe/recipes-devtools/flatcc/flatcc_0.6.4.bb +++ b/meta-oe/recipes-devtools/flatcc/flatcc_0.6.4.bb @@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=b3d8fb7158bf7e2600ba3191428dc4ef" SRC_URI = "git://github.com/dvidelabs/flatcc.git;protocol=https;branch=master;tag=v${PV} \ file://CVE-2026-116733.patch \ + file://CVE-2026-116734.patch \ " SRCREV = "fec0275c0d0c5b6f495ab48d51fcde521d72b5fc" From patchwork Wed Nov 4 08:58:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 102872 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5171.1793782730411175392 for ; Wed, 04 Nov 2026 00:58:50 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Kbk1hG7l; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3b07db03f41so325164a91.2 for ; Wed, 04 Nov 2026 00:58:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793782730; x=1794387530; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6CQMGDBBUx9y1Hw9WcmVXq9pFRko7pyUGxZKghOYO9Y=; b=Kbk1hG7lR/sdcEyQrIvIZaZNCpfDnlEUYgW37xbbwFgIdIBWiY8bemWSxTAQ7jIB8n 8riXTKpdPuZwcvZHwpZ76R5F1iPdQ4qLifIODppdsY5rRWJP3r4G9iGsgJvcmtRoA9KF rbyV1pb06dtcrBJ+E471Jl56wV7G8n0FttArJJmbPCxrcx1VbQuQg1VcPFgBYu7bOMQ5 QMLO/PufC0ggVJlyq/MrP+62SZ/2SkDWkZX9vM6vCeulfDpcIIO/SdvxGTKlFelSL5nW LsQLyk0VXUSUJWlY7y0qseMBcRZHy+CpYOhxA/M75C1s8g58x7Hrm94GQeUd+PgWZmJR XomQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793782730; x=1794387530; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=6CQMGDBBUx9y1Hw9WcmVXq9pFRko7pyUGxZKghOYO9Y=; b=ZcSYK3i/ibuuP4depfpyaTruhZdr8Dppgekq4FlVP17/pzold3917PH1MBMAwQZYfv 5HlzACIvVID0knkHTmWYYIIiU/LmTGNTpuWSZhJ+uIelD/LXifJNcO9+Mi0Pymip1BIc bS9nggYsSxyt6ycjmowAyh+dTk3fe0EJirM3GOoCOcz5Ov+wKQs8GkJDL8gU2EtRwDKS g7ghMmgjWnmKPh1fLnGb8idzSjd9Lb5dW3OFMluJ2LwvAVIvTbc7wSEUv/eRbAcF1QNu 1Dyx7rn/hPBXebAMCDh9A8MN/fkHPioSPNUzdz1p4HPGeRnopWV1X6AOGgAJl2Wn8Hn/ RC2Q== X-Gm-Message-State: APuU4Z9D+Lw/U6deQ84TLuLvZtBz3tNoTn61Z+DqQ5cPqikeQ5oACc9S VZ9k+5jUg15g53AWfp0/qe8afdk/6L5SIwpr+oc30+cPPJqTnWAt3rZ/ZbLqBQ== X-Gm-Gg: AYBFou2kW+ICiu7W1TtHwVZux7TH+ykNKFTjFaSlhbt6eTvc0tIoTfp4qIfogKjucEL VC0Ra3hr/Jr4R358uWpdEKYX7Xg/IQGT7kRye3BekWj7zfS/CwJUe9ZgYKxkTYXNekRAtXX2kgS WofMeM3db1kC5tLO7F79Rp5fucou8OLSPTuk1CHDrOIK1Fs3Nb5jfpWxoS3Z0ywn94i/pwn0yI8 yqPdveTArMw5cpgZc7P/QH+YOCBLV5EzwunYrTSSKn9ClPzkOd0qdkC+M/ghSQ8IL3jzXLFKJEn XBwfLakFXJh5GO5g8YLWEbU4sYgY4dvaUovve8ktY0JZL2JihAPW/4GTIcExs57oQe34kq/9EG/ KlBlkgZ80bVjunnQJCd/RmCeGRBOO09SXw/l4qATRdHhEGprGhklFtkBRci79yw9rMEcmRwoEBF Ia0FxsZHXNHfFmiTBl7H95+odILNZa0GdJUqAtyQ0Y6taBlbDSRhvTsvx6c806jHV2ck9K8xkiR dw+QpZ1Wpk3WtKQFjCVEgI8TnPwBY/t4iVvk74de7kXm9soTbSR3sIaLMTab7lSlTBhpEXHceZh Mc/+Vg8TWaVb0Y9lQBdAtrDN9JkvaY+pvfseBG2nj3lliBb6qz4QR5QU9dOCLk78 X-Received: by 2002:a17:90a:f307:b0:3ae:9944:3bf0 with SMTP id 98e67ed59e1d1-3ae99443c7bmr8538732a91.34.1793782729659; Wed, 04 Nov 2026 00:58:49 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3b093d481a3sm3139981a91.1.2026.11.04.00.58.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 00:58:49 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][blacksail][PATCH 4/4] ndpi: patch CVE-2026-116744 Date: Wed, 4 Nov 2026 21:58:34 +1300 Message-ID: <20261104085834.1877643-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261104085834.1877643-1-ankur.tyagi85@gmail.com> References: <20261104085834.1877643-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 08:58:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131838 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-116744 Signed-off-by: Ankur Tyagi --- .../ntopng/files/CVE-2026-116744.patch | 33 +++++++++++++++++++ .../recipes-support/ntopng/ndpi_5.0.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-116744.patch diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-116744.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-116744.patch new file mode 100644 index 0000000000..5794963ada --- /dev/null +++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-116744.patch @@ -0,0 +1,33 @@ +From 00706d4da0b7a1f9eff61e5835a0a1cc22c9c7e1 Mon Sep 17 00:00:00 2001 +From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> +Date: Mon, 26 Oct 2026 17:35:39 +0100 +Subject: [PATCH] softEther: fix out-of-bounds read (#3298) + +Close: #3291 + +Reported by HaiND (Nguyen Dinh Hai), Post and Telecommunication +Institute of Technology, github.com/Haind03 + +(cherry picked from commit ca9d819151606377ac53305583fe819748c69be2) + +CVE: CVE-2026-116744 +Upstream-Status: Backport [https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2] +Signed-off-by: Ankur Tyagi +--- + src/lib/protocols/softether.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/lib/protocols/softether.c b/src/lib/protocols/softether.c +index 379e743f7..c6f5d131e 100644 +--- a/src/lib/protocols/softether.c ++++ b/src/lib/protocols/softether.c +@@ -200,7 +200,8 @@ static int dissect_softether_host_fqdn(struct ndpi_flow_struct *flow, + payload += value_siz; + payload_len -= value_siz; + +- if(strncmp(val1.value.ptr.value_str, "host_name", value_siz) == 0) ++ if(val1.value_size > 0 && ++ strncmp(val1.value.ptr.value_str, "host_name", value_siz) == 0) + got_hostname = 1; + + for (; tuple_count > 0; --tuple_count) { diff --git a/meta-networking/recipes-support/ntopng/ndpi_5.0.bb b/meta-networking/recipes-support/ntopng/ndpi_5.0.bb index 6eadf8ba62..80890b1f27 100644 --- a/meta-networking/recipes-support/ntopng/ndpi_5.0.bb +++ b/meta-networking/recipes-support/ntopng/ndpi_5.0.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b52f2d57d10c4f7ee67a7eb9615d5d24" SRCREV = "375f99ef9fb4999d778b57bbeece171b3fa9fba6" SRC_URI = "git://github.com/ntop/nDPI.git;branch=5.0-stable;protocol=https;tag=${PV} \ file://0001-configure-Stop-embedding-pwd-at-configure-time.patch \ + file://CVE-2026-116744.patch \ " inherit autotools pkgconfig