From patchwork Thu Nov 5 21:22:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103179 Received: from mail-dy1-f169.google.com (mail-dy1-f169.google.com [74.125.82.169]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6739.1793913777898969606 for ; Thu, 05 Nov 2026 13:22:57 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=rbXqBKTz; spf=pass (domain: gmail.com, ip: 74.125.82.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f169.google.com with SMTP id 5a478bee46e88-35c76e9614aso3199353eec.0 for ; Thu, 05 Nov 2026 13:22:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913777; x=1794518577; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=fGoQ2bPSak92QUcbRku98Tqp6kcC5KJJA3Xm7GvAi3w=; b=rbXqBKTzySpvKDQtIXGsSxijmuYcTGmgSMuwI+9BmqDOu/6wkqB5ClOF+tkI9cmAgw oTapHna5m6AZ/PLQfCO9FJWa+/iyRTjB1GitL9b5Q+anQgGW+16gFZomFON3wKbtZksS DX55lxv/QN3BXnJjbH5DbOg7UqBdkkCkpYRZ5850vu2hlQ+9+18GNSj+jlwDjhxHf5jK vNP8W4mst8tRbtOkicHog4NlefCS1IILF3cGlz1VWYrtxRbsxlHEXM7UeQrdZhPcuVrc 68kU7gzNzuln1t38UTYVGh/FzDwWCRx1s+H+SUW2fphRf2X5RcVfG20cD3nVkr5FNaqV 6W/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913777; x=1794518577; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fGoQ2bPSak92QUcbRku98Tqp6kcC5KJJA3Xm7GvAi3w=; b=JEQVUV010st3pVCnx/BtO/++1wpM/lBUttBHyFktKXHRVI6ti5i7T8TARHHEf43cGH 8i8zT5DXjKZp3yQFUgNdaGZCFR/qdrrKk5q9mj7bsS8PIoknPms2WSb5DgPhI6pWqNeu yl3iWdRwL+YCosTgXKhVSBUTEiV+bi7rWBygldQpmN0tYyaXhnI7xv0cTj+EAT3ZbF5K 8UzwD4PwSrYuime/sQZV+4twmDGduVQwc/P7UQa84v0r3cNzadL5cgUmd0C2uP0SHPK+ NvJnb+MzlrR0LS1IAJsfKedLrr45JIMXwnQLONXePNWkpjpI9cKc5JYzs0OAIYi41trv fnug== X-Gm-Message-State: APuU4Z/FXEUWkWBtfnfzOMewsCkycVtenw4jhSmLAd0HeqWjac5JoJgv F4e65TVeeo6/Xz7FKD42hZgpYgL4EuCzkJ5JHfUEfmK/ZVtZjYGELrJtdEXztQ== X-Gm-Gg: AYBFou3EcNp/KMYwgiVXmUU8gnIlJp0nk5KDYhZHmNZrwPiky8nFIjZAM7xc/SihS7L YyBHYSLBXSlihBRNuw06cRgICGZ1Fw/r/pCrSULxzvDnCuORutA732gx1VI7379f2eEm79Qm7hv L9h4wCXmIQHsTEYIIrqU81GFz5VcOsA8sFTtY2tEtYJGbOU1vqwjToWuGr0N4WcuWIBUUqPzHs9 TbluBLAzSQY1XJTi0WV5rcE3mAOtjRbjyHcuU39iWZellIwHyfoHTYgTPWDREN27bC3tjgjvzCF ZYI05Ja77gZomtUhJ55pOet+QF/poc/hz+777bcuEajBYkLNHdra790c3223m3TfakBVamkbfDy XK7/XgWIbMWP6mxhNTwHFWCwfZ5S3A/bjVpJ8Q3OqXcaZ/cAdrAWdNjpG4OB9ALXv4kA8Tu569G oNmBDHzwPpzZaw0tX4HO84LHWNUfi4WJUfrIQX1tfDqyRuD+VvSLzVJuMQxPF3sxNi5F7B+UozM hiEyq8nbOpIg5pHLgfqZnWOp+NZJ8003XjftVejLIOwzGmC4YhgQQsR1ui/AgzPzvCmPF6T5eQJ xH6Vq80ti9+4P/KOAf6OBQQjohsxKjoivuIgzHELyCiHUg/Z3Z5Xi1KfGgl2rA== X-Received: by 2002:a05:7301:4283:b0:351:68e8:4646 with SMTP id 5a478bee46e88-36f770085f3mr395355eec.37.1793913776712; Thu, 05 Nov 2026 13:22:56 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.22.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:22:56 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 1/14] hdf5: patch CVE-2026-19026, CVE-2026-19027 and CVE-2026-19028 Date: Fri, 6 Nov 2026 10:22:37 +1300 Message-ID: <20261105212250.490188-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131938 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-19026 https://nvd.nist.gov/vuln/detail/cve-2026-19027 https://nvd.nist.gov/vuln/detail/cve-2026-19028 Signed-off-by: Ankur Tyagi --- ...-19026-CVE-2026-19027-CVE-2026-19028.patch | 579 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 580 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch new file mode 100644 index 0000000000..8187612342 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch @@ -0,0 +1,579 @@ +From 8623863e172662af94d30842e1f735219b682852 Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Fri, 25 Sep 2026 17:15:06 -0500 +Subject: [PATCH] Fix CVE issues related to Nbit/Fletcher32 decode paths + (#6497) + +* Fix h5ls SIGSEGVs in Nbit and Fletcher32 filter decode paths + +This PR fixes three related issues which could cause crashes when +crafted files were provided to h5ls. As it happens, all three are reachable from +any reader via H5Z_pipeline() during a chunked H5Dread(), so the root issues +affect the library itself. + +1. Nbit NULL/short parameter array (#6489, "Null_Pointer") + + H5Z__filter_nbit() dereferenced cd_values[0] before validating the + parameter array. A file storing the filter with zero client-data + values produced cd_values=NULL / cd_nelmts=0 and a NULL dereference. + + Fix is to reject a NULL cd_values or a cd_nelmts < 5 (the header at indices + 0..4 is always read) before any access. + +2. Nbit compressed-input buffer over-read (#6489, "Heap_Corruption_1") + + The H5Z__nbit_decompress* family walked the compressed input via + index *j with no bound against the input size, and nbytes was never + even passed in. Malformed parameters (e.g. d_nelmts=67108876 over a + 31-byte chunk) drove *j past the end, reading out of bounds in + H5Z__nbit_decompress_one_byte(). + + Fix is thread the input size through the whole decompress call chain, + convert the void helpers (_one_byte, _one_nooptype, _one_atomic) + to return herr_t, and bounds-check *j against buffer_size before every + buffer[*j] read, propagating a filter error up the stack. + +3. Fletcher32 checksum length underflow (#6490, "Heap_Corruption_2") + + The read path computed `src_nbytes = nbytes - FLETCHER_LEN` with no + lower-bound check. A corrupt 0-byte chunk underflowed src_nbytes to + SIZE_MAX-3, which was passed straight to H5_checksum_fletcher32(), + causing an out-of-bounds read. + + Fix is to reject nbytes +Co-authored-by: H. Joe Lee + +CVE: CVE-2026-19026 CVE-2026-19027 CVE-2026-19028 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/a3cf1ea82cc7a66e50029a688121e1b105a7ce88] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Zfletcher32.c | 8 ++ + src/H5Znbit.c | 211 +++++++++++++++++++++++++++++++++----------- + 2 files changed, 166 insertions(+), 53 deletions(-) + +diff --git a/src/H5Zfletcher32.c b/src/H5Zfletcher32.c +index c3ec5f7ccb0..b89724ad0a3 100644 +--- a/src/H5Zfletcher32.c ++++ b/src/H5Zfletcher32.c +@@ -62,6 +62,14 @@ H5Z__filter_fletcher32(unsigned flags, size_t H5_ATTR_UNUSED cd_nelmts, + assert(sizeof(uint32_t) >= 4); + + if (flags & H5Z_FLAG_REVERSE) { /* Read */ ++ /* A Fletcher32-filtered buffer must contain at least the trailing ++ * checksum. Reject anything smaller to avoid a size_t underflow ++ * when computing the data length. ++ */ ++ if (nbytes < FLETCHER_LEN) ++ HGOTO_ERROR(H5E_STORAGE, H5E_OVERFLOW, 0, ++ "fletcher32 filter input buffer too small to contain checksum"); ++ + /* Do checksum if it's enabled for read; otherwise skip it + * to save performance. */ + if (!(flags & H5Z_FLAG_SKIP_EDC)) { +diff --git a/src/H5Znbit.c b/src/H5Znbit.c +index fed86a1a3bd..ce8c726370a 100644 +--- a/src/H5Znbit.c ++++ b/src/H5Znbit.c +@@ -51,26 +51,29 @@ static herr_t H5Z__set_parms_compound(const H5T_t *type, unsigned *cd_values_ind + bool *need_not_compress); + + static void H5Z__nbit_next_byte(size_t *j, size_t *buf_len); +-static void H5Z__nbit_decompress_one_byte(unsigned char *data, size_t data_offset, unsigned k, ++static herr_t H5Z__nbit_decompress_one_byte(unsigned char *data, size_t data_offset, unsigned k, + unsigned begin_i, unsigned end_i, const unsigned char *buffer, +- size_t *j, size_t *buf_len, const parms_atomic *p, +- size_t datatype_len); ++ size_t buffer_size, size_t *j, size_t *buf_len, ++ const parms_atomic *p, size_t datatype_len); + static void H5Z__nbit_compress_one_byte(const unsigned char *data, size_t data_offset, unsigned k, + unsigned begin_i, unsigned end_i, unsigned char *buffer, size_t *j, + size_t *buf_len, const parms_atomic *p, size_t datatype_len); +-static void H5Z__nbit_decompress_one_nooptype(unsigned char *data, size_t data_offset, +- const unsigned char *buffer, size_t *j, size_t *buf_len, +- unsigned size); +-static void H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigned char *buffer, +- size_t *j, size_t *buf_len, const parms_atomic *p); ++static herr_t H5Z__nbit_decompress_one_nooptype(unsigned char *data, size_t data_offset, ++ const unsigned char *buffer, size_t buffer_size, size_t *j, ++ size_t *buf_len, unsigned size); ++static herr_t H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigned char *buffer, ++ size_t buffer_size, size_t *j, size_t *buf_len, ++ const parms_atomic *p); + static herr_t H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned char *buffer, +- size_t *j, size_t *buf_len, const unsigned parms[], ++ size_t buffer_size, size_t *j, size_t *buf_len, ++ const unsigned parms[], size_t parms_nelmts, + unsigned *parms_index); + static herr_t H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, +- unsigned char *buffer, size_t *j, size_t *buf_len, +- const unsigned parms[], unsigned *parms_index); ++ unsigned char *buffer, size_t buffer_size, size_t *j, ++ size_t *buf_len, const unsigned parms[], size_t parms_nelmts, ++ unsigned *parms_index); + static herr_t H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer, +- const unsigned parms[]); ++ size_t buffer_size, const unsigned parms[], size_t parms_nelmts); + static void H5Z__nbit_compress_one_nooptype(const unsigned char *data, size_t data_offset, + unsigned char *buffer, size_t *j, size_t *buf_len, unsigned size); + static void H5Z__nbit_compress_one_array(unsigned char *data, size_t data_offset, unsigned char *buffer, +@@ -100,8 +103,15 @@ H5Z_class2_t H5Z_NBIT[1] = {{ + #define H5Z_NBIT_COMPOUND 3 /* Compound datatype class */ + #define H5Z_NBIT_NOOPTYPE 4 /* Other datatype class: nbit does no compression */ + #define H5Z_NBIT_MAX_NPARMS 4096 /* Max number of parameters for filter */ +-#define H5Z_NBIT_ORDER_LE 0 /* Little endian for datatype byte order */ +-#define H5Z_NBIT_ORDER_BE 1 /* Big endian for datatype byte order */ ++ ++/* Whether the parameter list holds N more values starting at IDX. The ++ * datatype description that drives the walk through the parameters is held in ++ * those same parameters, so a list that stops short of the datatype it ++ * describes has to be caught at each step rather than measured up front. ++ */ ++#define H5Z_NBIT_PARMS_AVAIL(idx, n, nelmts) (((nelmts) >= (n)) && ((size_t)(idx) <= (nelmts) - (n))) ++#define H5Z_NBIT_ORDER_LE 0 /* Little endian for datatype byte order */ ++#define H5Z_NBIT_ORDER_BE 1 /* Big endian for datatype byte order */ + + /* Local variables */ + +@@ -931,7 +941,16 @@ H5Z__filter_nbit(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + + /* check arguments + * cd_values[0] stores actual number of parameters in cd_values[] ++ * ++ * The filter header always occupies cd_values[0..4] (number of ++ * parameters, no-compression flag, number of elements, datatype class ++ * and datatype size), all of which are read unconditionally below. ++ * Reject a NULL array or one shorter than that to avoid a bad ++ * dereference. + */ ++ if (cd_values == NULL || cd_nelmts < 5) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "invalid nbit parameters"); ++ + if (cd_nelmts != cd_values[0]) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "invalid nbit aggression level"); + +@@ -944,6 +963,18 @@ H5Z__filter_nbit(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + /* copy a filter parameter to d_nelmts */ + d_nelmts = cd_values[2]; + ++ /* cd_values[4] stores the datatype size, which is used together with ++ * d_nelmts to size the (de)compression buffer. A zero size is invalid, ++ * and a d_nelmts * size product that overflows size_t would produce an ++ * undersized allocation and out-of-bounds accesses (this matters on ++ * platforms with a 32-bit size_t). Reject both, as they can only arise ++ * from a corrupted or crafted file. ++ */ ++ if (cd_values[4] == 0) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "invalid nbit datatype size"); ++ if (d_nelmts != 0 && (size_t)cd_values[4] > SIZE_MAX / d_nelmts) ++ HGOTO_ERROR(H5E_ARGS, H5E_OVERFLOW, 0, "nbit (de)compression buffer size overflow"); ++ + /* input; decompress */ + if (flags & H5Z_FLAG_REVERSE) { + size_out = d_nelmts * (size_t)cd_values[4]; /* cd_values[4] stores datatype size */ +@@ -953,7 +984,7 @@ H5Z__filter_nbit(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "memory allocation failed for nbit decompression"); + + /* decompress the buffer */ +- if (H5Z__nbit_decompress(outbuf, d_nelmts, (unsigned char *)*buf, cd_values) < 0) { ++ if (H5Z__nbit_decompress(outbuf, d_nelmts, (unsigned char *)*buf, nbytes, cd_values, cd_nelmts) < 0) { + H5MM_xfree(outbuf); + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, 0, "can't decompress buffer"); + } +@@ -999,15 +1030,19 @@ H5Z__nbit_next_byte(size_t *j, size_t *buf_len) + *buf_len = 8 * sizeof(unsigned char); + } + +-static void ++static herr_t + H5Z__nbit_decompress_one_byte(unsigned char *data, size_t data_offset, unsigned k, unsigned begin_i, +- unsigned end_i, const unsigned char *buffer, size_t *j, size_t *buf_len, +- const parms_atomic *p, size_t datatype_len) ++ unsigned end_i, const unsigned char *buffer, size_t buffer_size, size_t *j, ++ size_t *buf_len, const parms_atomic *p, size_t datatype_len) + { + size_t dat_len; /* dat_len is the number of bits to be copied in each data byte */ + size_t dat_offset; + unsigned char val; /* value to be copied in each data byte */ + ++ /* Ensure the byte to be read is within the bounds of the compressed buffer */ ++ if (*j >= buffer_size) ++ return FAIL; ++ + /* initialize value and bits of unsigned char to be copied */ + val = buffer[*j]; + dat_offset = 0; +@@ -1039,25 +1074,33 @@ H5Z__nbit_decompress_one_byte(unsigned char *data, size_t data_offset, unsigned + dat_len -= *buf_len; + H5Z__nbit_next_byte(j, buf_len); + if (dat_len == 0) +- return; ++ return SUCCEED; + ++ if (*j >= buffer_size) ++ return FAIL; + val = buffer[*j]; + data[data_offset + k] |= (unsigned char)(((unsigned)(val >> (*buf_len - dat_len)) & + (unsigned)(~((unsigned)(~0) << dat_len))) + << dat_offset); + *buf_len -= dat_len; + } ++ ++ return SUCCEED; + } + +-static void ++static herr_t + H5Z__nbit_decompress_one_nooptype(unsigned char *data, size_t data_offset, const unsigned char *buffer, +- size_t *j, size_t *buf_len, unsigned size) ++ size_t buffer_size, size_t *j, size_t *buf_len, unsigned size) + { + unsigned i; /* index */ + size_t dat_len; /* dat_len is the number of bits to be copied in each data byte */ + unsigned char val; /* value to be copied in each data byte */ + + for (i = 0; i < size; i++) { ++ /* Ensure the byte to be read is within the bounds of the compressed buffer */ ++ if (*j >= buffer_size) ++ return FAIL; ++ + /* initialize value and bits of unsigned char to be copied */ + val = buffer[*j]; + dat_len = sizeof(unsigned char) * 8; +@@ -1069,16 +1112,20 @@ H5Z__nbit_decompress_one_nooptype(unsigned char *data, size_t data_offset, const + if (dat_len == 0) + continue; + ++ if (*j >= buffer_size) ++ return FAIL; + val = buffer[*j]; + data[data_offset + i] |= (unsigned char)((unsigned)(val >> (*buf_len - dat_len)) & + (unsigned)(~((unsigned)(~0) << dat_len))); + *buf_len -= dat_len; + } ++ ++ return SUCCEED; + } + +-static void +-H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigned char *buffer, size_t *j, +- size_t *buf_len, const parms_atomic *p) ++static herr_t ++H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigned char *buffer, ++ size_t buffer_size, size_t *j, size_t *buf_len, const parms_atomic *p) + { + /* begin_i: the index of byte having first significant bit + end_i: the index of byte having last significant bit */ +@@ -1097,8 +1144,9 @@ H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigne + end_i = p->offset / 8; + + for (k = (int)begin_i; k >= (int)end_i; k--) +- H5Z__nbit_decompress_one_byte(data, data_offset, (unsigned)k, begin_i, end_i, buffer, j, buf_len, +- p, datatype_len); ++ if (H5Z__nbit_decompress_one_byte(data, data_offset, (unsigned)k, begin_i, end_i, buffer, ++ buffer_size, j, buf_len, p, datatype_len) < 0) ++ return FAIL; + } + else { /* big endian */ + /* Sanity check */ +@@ -1112,14 +1160,18 @@ H5Z__nbit_decompress_one_atomic(unsigned char *data, size_t data_offset, unsigne + end_i = ((unsigned)datatype_len - p->offset) / 8 - 1; + + for (k = (int)begin_i; k <= (int)end_i; k++) +- H5Z__nbit_decompress_one_byte(data, data_offset, (unsigned)k, begin_i, end_i, buffer, j, buf_len, +- p, datatype_len); ++ if (H5Z__nbit_decompress_one_byte(data, data_offset, (unsigned)k, begin_i, end_i, buffer, ++ buffer_size, j, buf_len, p, datatype_len) < 0) ++ return FAIL; + } ++ ++ return SUCCEED; + } + + static herr_t +-H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned char *buffer, size_t *j, +- size_t *buf_len, const unsigned parms[], unsigned *parms_index) ++H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned char *buffer, ++ size_t buffer_size, size_t *j, size_t *buf_len, const unsigned parms[], ++ size_t parms_nelmts, unsigned *parms_index) + { + unsigned i, total_size, base_class, base_size, n, begin_index; + parms_atomic p; +@@ -1127,11 +1179,19 @@ H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned + + FUNC_ENTER_PACKAGE + ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 2, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + total_size = parms[(*parms_index)++]; + base_class = parms[(*parms_index)++]; + + switch (base_class) { + case H5Z_NBIT_ATOMIC: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 4, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + p.size = parms[(*parms_index)++]; + p.order = parms[(*parms_index)++]; + p.precision = parms[(*parms_index)++]; +@@ -1143,37 +1203,54 @@ H5Z__nbit_decompress_one_array(unsigned char *data, size_t data_offset, unsigned + + n = total_size / p.size; + for (i = 0; i < n; i++) +- H5Z__nbit_decompress_one_atomic(data, data_offset + i * (size_t)p.size, buffer, j, buf_len, +- &p); ++ if (H5Z__nbit_decompress_one_atomic(data, data_offset + i * (size_t)p.size, buffer, ++ buffer_size, j, buf_len, &p) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress atomic"); + break; + + case H5Z_NBIT_ARRAY: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 1, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + base_size = parms[*parms_index]; /* read in advance */ + n = total_size / base_size; /* number of base_type elements inside the array datatype */ + begin_index = *parms_index; + for (i = 0; i < n; i++) { +- if (H5Z__nbit_decompress_one_array(data, data_offset + i * (size_t)base_size, buffer, j, +- buf_len, parms, parms_index) < 0) ++ if (H5Z__nbit_decompress_one_array(data, data_offset + i * (size_t)base_size, buffer, ++ buffer_size, j, buf_len, parms, parms_nelmts, ++ parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array"); + *parms_index = begin_index; + } + break; + + case H5Z_NBIT_COMPOUND: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 1, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + base_size = parms[*parms_index]; /* read in advance */ + n = total_size / base_size; /* number of base_type elements inside the array datatype */ + begin_index = *parms_index; + for (i = 0; i < n; i++) { +- if (H5Z__nbit_decompress_one_compound(data, data_offset + i * (size_t)base_size, buffer, j, +- buf_len, parms, parms_index) < 0) ++ if (H5Z__nbit_decompress_one_compound(data, data_offset + i * (size_t)base_size, buffer, ++ buffer_size, j, buf_len, parms, parms_nelmts, ++ parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound"); + *parms_index = begin_index; + } + break; + + case H5Z_NBIT_NOOPTYPE: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 1, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + (*parms_index)++; /* skip size of no-op type */ +- H5Z__nbit_decompress_one_nooptype(data, data_offset, buffer, j, buf_len, total_size); ++ if (H5Z__nbit_decompress_one_nooptype(data, data_offset, buffer, buffer_size, j, buf_len, ++ total_size) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress no-op type"); + break; + + default: +@@ -1185,8 +1262,9 @@ done: + } + + static herr_t +-H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsigned char *buffer, size_t *j, +- size_t *buf_len, const unsigned parms[], unsigned *parms_index) ++H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsigned char *buffer, ++ size_t buffer_size, size_t *j, size_t *buf_len, const unsigned parms[], ++ size_t parms_nelmts, unsigned *parms_index) + { + unsigned i, nmembers, member_offset, member_class, member_size, used_size = 0, prev_used_size, size; + parms_atomic p; +@@ -1194,10 +1272,18 @@ H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsig + + FUNC_ENTER_PACKAGE + ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 2, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + size = parms[(*parms_index)++]; + nmembers = parms[(*parms_index)++]; + + for (i = 0; i < nmembers; i++) { ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 3, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + member_offset = parms[(*parms_index)++]; + member_class = parms[(*parms_index)++]; + +@@ -1213,6 +1299,10 @@ H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsig + HGOTO_ERROR(H5E_PLINE, H5E_BADRANGE, FAIL, "compound member offset overflowed compound size"); + switch (member_class) { + case H5Z_NBIT_ATOMIC: ++ if (!H5Z_NBIT_PARMS_AVAIL(*parms_index, 4, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + p.size = member_size; + /* Advance past member size */ + (*parms_index)++; +@@ -1224,26 +1314,29 @@ H5Z__nbit_decompress_one_compound(unsigned char *data, size_t data_offset, unsig + if (p.precision > p.size * 8 || (p.precision + p.offset) > p.size * 8) + HGOTO_ERROR(H5E_PLINE, H5E_BADTYPE, FAIL, "invalid datatype precision/offset"); + +- H5Z__nbit_decompress_one_atomic(data, data_offset + member_offset, buffer, j, buf_len, &p); ++ if (H5Z__nbit_decompress_one_atomic(data, data_offset + member_offset, buffer, buffer_size, j, ++ buf_len, &p) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress atomic"); + break; + + case H5Z_NBIT_ARRAY: +- if (H5Z__nbit_decompress_one_array(data, data_offset + member_offset, buffer, j, buf_len, +- parms, parms_index) < 0) ++ if (H5Z__nbit_decompress_one_array(data, data_offset + member_offset, buffer, buffer_size, j, ++ buf_len, parms, parms_nelmts, parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array"); + break; + + case H5Z_NBIT_COMPOUND: +- if (H5Z__nbit_decompress_one_compound(data, data_offset + member_offset, buffer, j, buf_len, +- parms, parms_index) < 0) ++ if (H5Z__nbit_decompress_one_compound(data, data_offset + member_offset, buffer, buffer_size, ++ j, buf_len, parms, parms_nelmts, parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound"); + break; + + case H5Z_NBIT_NOOPTYPE: +- /* Advance past member size */ ++ /* Advance past member size (already checked above) */ + (*parms_index)++; +- H5Z__nbit_decompress_one_nooptype(data, data_offset + member_offset, buffer, j, buf_len, +- member_size); ++ if (H5Z__nbit_decompress_one_nooptype(data, data_offset + member_offset, buffer, buffer_size, ++ j, buf_len, member_size) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress no-op type"); + break; + + default: +@@ -1256,7 +1349,8 @@ done: + } + + static herr_t +-H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer, const unsigned parms[]) ++H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buffer, size_t buffer_size, ++ const unsigned parms[], size_t parms_nelmts) + { + /* i: index of data, j: index of buffer, + buf_len: number of bits to be filled in current byte */ +@@ -1269,6 +1363,11 @@ H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buff + + FUNC_ENTER_PACKAGE + ++ /* The datatype class and its size are read before the walk begins */ ++ if (!H5Z_NBIT_PARMS_AVAIL(0, 5, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + /* may not have to initialize to zeros */ + memset(data, 0, d_nelmts * (size_t)parms[4]); + +@@ -1278,6 +1377,10 @@ H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buff + + switch (parms[3]) { + case H5Z_NBIT_ATOMIC: ++ if (!H5Z_NBIT_PARMS_AVAIL(0, 8, parms_nelmts)) ++ HGOTO_ERROR(H5E_PLINE, H5E_OVERFLOW, FAIL, ++ "parameter list is shorter than the datatype it describes"); ++ + p.size = parms[4]; + p.order = parms[5]; + p.precision = parms[6]; +@@ -1288,15 +1391,17 @@ H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buff + HGOTO_ERROR(H5E_PLINE, H5E_BADTYPE, FAIL, "invalid datatype precision/offset"); + + for (i = 0; i < d_nelmts; i++) +- H5Z__nbit_decompress_one_atomic(data, i * (size_t)p.size, buffer, &j, &buf_len, &p); ++ if (H5Z__nbit_decompress_one_atomic(data, i * (size_t)p.size, buffer, buffer_size, &j, ++ &buf_len, &p) < 0) ++ HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress atomic"); + break; + + case H5Z_NBIT_ARRAY: + size = parms[4]; + parms_index = 4; /* set the index before goto function call */ + for (i = 0; i < d_nelmts; i++) { +- if (H5Z__nbit_decompress_one_array(data, i * size, buffer, &j, &buf_len, parms, +- &parms_index) < 0) ++ if (H5Z__nbit_decompress_one_array(data, i * size, buffer, buffer_size, &j, &buf_len, parms, ++ parms_nelmts, &parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress array"); + parms_index = 4; + } +@@ -1306,8 +1411,8 @@ H5Z__nbit_decompress(unsigned char *data, unsigned d_nelmts, unsigned char *buff + size = parms[4]; + parms_index = 4; /* set the index before goto function call */ + for (i = 0; i < d_nelmts; i++) { +- if (H5Z__nbit_decompress_one_compound(data, i * size, buffer, &j, &buf_len, parms, +- &parms_index) < 0) ++ if (H5Z__nbit_decompress_one_compound(data, i * size, buffer, buffer_size, &j, &buf_len, ++ parms, parms_nelmts, &parms_index) < 0) + HGOTO_ERROR(H5E_PLINE, H5E_CANTFILTER, FAIL, "can't decompress compound"); + parms_index = 4; + } diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index cf199375d3..1ec5ad049e 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -22,6 +22,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-17573.patch \ file://CVE-2026-17574.patch \ file://CVE-2026-19025.patch \ + file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 21:22:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103184 Received: from mail-dy1-f179.google.com (mail-dy1-f179.google.com [74.125.82.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6629.1793913779949792875 for ; Thu, 05 Nov 2026 13:22:59 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=MqzLYLLG; spf=pass (domain: gmail.com, ip: 74.125.82.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f179.google.com with SMTP id 5a478bee46e88-36f8cdd30beso128954eec.1 for ; Thu, 05 Nov 2026 13:22:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913779; x=1794518579; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=uKcJChIQQ4BNQL2uTStls8BatYWzKDucFBs2RmD3uPg=; b=MqzLYLLGSncLxdDsTtz35wlDkIaX2vUKwRAsZbnC2OGk45IowobYvByuKRtDDZy9E9 qrMuOmfkYOs75Jv/H2z8SP16d5I1RBD0z0IDJ1AwKBUm9Or6j4rfzl7g2zHdbzIyEiI9 iz83p6F2Tsj294UWNv/5dJjakW1dDf2p6JbcChrHyWwYUq0Ss4ehN/hOAgeZuh5yrj3G NpLPW7nSt8xx7kXL65dSOK+Fe58s9G0tyDUU0nxrXe8cLtJpxpF22f4j3jDZIX1NgpFc ypo+x+s4DvYekkbr3B/cJNRsCZ2aA+ybsR7HyfXeJ2dE95wyVksxDyJlFFY9AtTHToCr IiOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913779; x=1794518579; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=uKcJChIQQ4BNQL2uTStls8BatYWzKDucFBs2RmD3uPg=; b=EHPfnuGeix3cXkAnK3BmdUGfShwMS7bJ0CnrW+tPhteJFCrwnJYxHB6/ZB+63tk4u8 PwY9MNYG5nSqd1ToCQC62q17EvOgQQmZEhjjrCm7nQTEsvua5FIiF0UDTKZAG4uOQ/cN RquyQxRaQzfeoMVAfB2SP9ZlxUclfl+8X5bq3hoIgMp+MSjDiqNFTXiUUUqjQL+Dt3sa EmfnmW82/cuAvLctPSHED77qOkcC2ByMi82jaIe50H/NxknQhbssbUHhpi07uA7avs1W K5c8DlESMI7RmNxNW/upqv+xMUJ301p/BcXTBTQdxwo2v/nLyuGYn5m5t8dY6Y416KLk HTbg== X-Gm-Message-State: APuU4Z8azmj3Q5qj1134ywSqwGn3EQ0CwZOa1/iRAwe/GVoGqE5NsO4e JawEngTCQTA8gBWkShn0AGzCFb9bxjy0Pm4NHA0S9PUAo9i/bsSwiDhWJnuu4w== X-Gm-Gg: AYBFou1WoXO8hu9MV0mykZJwrnOa1IxixI8iG/F/egagRsgzorgzWksw38m+3T8UovF Dcyir3aeja3TMYCNJAISJ6xCAiJe9hOjDHTauXMFBJw2GWTtsfEGhBfjeHNid4TTBBH/IQCeQ5g mQGirC80ghHuKgmiBsMUKNpucPKmfz3kCc+t9ujgmJcH1kl8ikomDnAgrrLiiiUfB4oyjtKZ+TC ekTCdhcFtZGADTLWh73ZgmMq2kVCaizI39n7btCMzm8XRMZbMiQ2tETbL9fCR9RnbveWvm/Eg55 UOqAExxaq4bsW3yQwu/jykFq19NlxB4qlyGCB7vb2WdwfznNBvrdf53CdnZrEExFutliXOQYKgp CmvSUw0KobFDWrz/J5GJfHDBTlLwaE0OK1ba8Ue65dbhk+myUdk5EqAjg3FSs6SolbQsFKHOKsW /fDpDiNa4UFSpqROE/X8KWytC22qKm7IRutzdFY3FV7G+ABEA6LgYPiq00r9T0TAY99qhz1G4tE oWf7lvThMN4b3Wkzgn1MgRfbNCk6J6hVZ/T4YjWdKnmgbIpF7anCMiaAfHPDdtFGeNC1ILamblu PhAbTmLWTgGdbpVc5TR8maQMCk2Y/toHVFYu3J/2/6Nn3LqzP7yZ+RkUlsIJJA== X-Received: by 2002:a05:693c:26c9:b0:369:36c9:5848 with SMTP id 5a478bee46e88-36f76022c16mr494205eec.12.1793913779026; Thu, 05 Nov 2026 13:22:59 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.22.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:22:58 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 2/14] hdf5: patch CVE-2026-19023 and CVE-2026-19024 Date: Fri, 6 Nov 2026 10:22:38 +1300 Message-ID: <20261105212250.490188-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131939 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-19023 https://nvd.nist.gov/vuln/detail/cve-2026-19024 Signed-off-by: Ankur Tyagi --- .../files/CVE-2026-19023-CVE-2026-19024.patch | 176 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 177 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19023-CVE-2026-19024.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19023-CVE-2026-19024.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19023-CVE-2026-19024.patch new file mode 100644 index 0000000000..acf3817ea1 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19023-CVE-2026-19024.patch @@ -0,0 +1,176 @@ +From e7e85949865b771b2b0b73ac1edaf54ce14cd894 Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Wed, 7 Oct 2026 11:03:55 -0500 +Subject: [PATCH] Fix CVEs related to vlen binary output and malformed fill + values in h5dump (#6507) + +* Fix h5dump SIGSEGVs on vlen binary output and malformed fill value + +Fixes two crafted-file crashes in h5dump (GitHub issues #6486 and #6487). +A third report (#6488) is the Fletcher32 checksum-length underflow already +fixed for h5ls in PR #6497, so it is not addressed again here. + +Issue #6486 (tools) - render_bin_output() SIGSEGV with "-b" on a +variable-length string dataset. The H5T_STRING branch reused the local +"size" variable both as the per-element stride and as the string length +returned by strlen(), so after the first element the stride became that +string's length and subsequent elements were read from misaligned +addresses, dereferencing a garbage pointer. This affected any multi-element +vlen-string dataset, not just crafted files. A separate str_len variable is +now used for the write length so "size" stays the datatype stride. As this +is a tools bug, the regression test is a tools test: tools/test/h5dump adds +the tbinvlstr case (binary dump of a vlen-string dataset, file +tbinvlstr.h5, generated by h5dumpgentest.c/gent_binvlstr), which crashes on +develop and passes with the fix. + +Issue #6487 (library) - H5Pget_fill_value() SIGSEGV via H5T_path_find(). +A crafted version-1/2 fill value message can have "fill defined" set with a +negative size field; H5O_fill_old_decode() leaves fill.size negative and +fill.buf/type NULL instead of normalizing to the "undefined" sentinel. +That value is neither 0 nor -1, so H5P_get_fill_value() fell through to +H5T_path_find() with a NULL source type and crashed. H5P_get_fill_value() +now rejects a NULL fill datatype and returns an error, keeping the dataset +itself readable. h5dump's XML fill-value renderer (xml_dump_fill_value) is +also hardened: it checks the buffer allocation and the H5Pget_fill_value() +return value and emits an empty fill value element instead of dereferencing +an unallocated or unretrievable buffer. + +Regression test (library): test/fillval.c test_bad_fill_value() reads a +crafted file (generated by test/gen_bad_fill.c, committed as +test/testfiles/bad_fill_value.h5) and verifies that the dataset data is +still readable while H5Pget_fill_value() fails cleanly instead of crashing. + +Verified: both PoCs exit cleanly with the fix (SIGSEGV without it); the +committed fixtures crash the pre-fix library/tools and pass post-fix; the +fillval suite, the new tbinvlstr h5dump test, and the non-XML h5dump suite +pass. + +Co-Authored-By: Claude Opus 4.8 + +* Update CHANGELOG to list CVEs/GH issues + +* Renumber tbinvlstr.h5 generator macro to FILE114 + +--------- + +Co-authored-by: Claude Opus 4.8 +Co-authored-by: Larry Knox + +CVE: CVE-2026-19023 CVE-2026-19024 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/cfcd7fe7421cc94e0527d043f2d1b271986e7b09] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Pdcpl.c | 7 +++++++ + tools/lib/h5tools.c | 9 ++++++--- + tools/src/h5dump/h5dump_xml.c | 33 ++++++++++++++++++++++++++++----- + 3 files changed, 41 insertions(+), 8 deletions(-) + +diff --git a/src/H5Pdcpl.c b/src/H5Pdcpl.c +index 2317c317f73..a1a33d52c7b 100644 +--- a/src/H5Pdcpl.c ++++ b/src/H5Pdcpl.c +@@ -3207,6 +3207,13 @@ H5P_get_fill_value(H5P_genplist_t *plist, const H5T_t *type, void *value /*out*/ + HGOTO_DONE(SUCCEED); + } /* end if */ + ++ /* ++ * A fill value with a nonzero size must have an associated datatype in ++ * order to be converted to the destination type. ++ */ ++ if (NULL == fill.type) ++ HGOTO_ERROR(H5E_PLIST, H5E_CANTGET, FAIL, "fill value has no datatype"); ++ + /* + * Can we convert between the source and destination datatypes? + */ +diff --git a/tools/lib/h5tools.c b/tools/lib/h5tools.c +index b1a2aa0de4c..3e028504f7c 100644 +--- a/tools/lib/h5tools.c ++++ b/tools/lib/h5tools.c +@@ -1825,24 +1825,27 @@ render_bin_output(FILE *stream, hid_t container, hid_t tid, void *_mem, hsize_t + H5T_str_t pad; + char *s = NULL; + unsigned char tempuchar; ++ size_t str_len; /* # of bytes to write for this element */ + + H5TOOLS_DEBUG("H5T_STRING"); + pad = H5Tget_strpad(tid); + + for (block_index = 0; block_index < block_nelmts; block_index++) { ++ /* Advance by the datatype size */ + mem = ((unsigned char *)_mem) + block_index * size; + + if (H5Tis_variable_str(tid)) { + s = *(char **)((void *)mem); + if (s != NULL) +- size = strlen(s); ++ str_len = strlen(s); + else + H5TOOLS_THROW((-1), "NULL string"); + } + else { +- s = (char *)mem; ++ s = (char *)mem; ++ str_len = size; + } +- for (i = 0; i < size && (s[i] || pad != H5T_STR_NULLTERM); i++) { ++ for (i = 0; i < str_len && (s[i] || pad != H5T_STR_NULLTERM); i++) { + memcpy(&tempuchar, &s[i], sizeof(unsigned char)); + if (1 != fwrite(&tempuchar, sizeof(unsigned char), 1, stream)) + H5TOOLS_THROW((-1), "fwrite failed"); +diff --git a/tools/src/h5dump/h5dump_xml.c b/tools/src/h5dump/h5dump_xml.c +index f1a34870f4a..6f3e00a27df 100644 +--- a/tools/src/h5dump/h5dump_xml.c ++++ b/tools/src/h5dump/h5dump_xml.c +@@ -3534,8 +3534,9 @@ xml_dump_fill_value(hid_t dcpl, hid_t type) + hid_t n_type = H5I_INVALID_HID; + void *buf; + char *name; +- h5tools_str_t buffer; /* string into which to render */ +- h5tools_context_t ctx; /* print context */ ++ herr_t fill_ret = FAIL; /* status of retrieving the fill value */ ++ h5tools_str_t buffer; /* string into which to render */ ++ h5tools_context_t ctx; /* print context */ + h5tool_format_t *outputformat = &xml_dataformat; + h5tool_format_t string_dataformat; + hsize_t curr_pos = 0; /* total data element position */ +@@ -3593,11 +3594,33 @@ xml_dump_fill_value(hid_t dcpl, hid_t type) + n_type = type; + + space = H5Tget_size(n_type); +- buf = malloc((size_t)space); ++ /* Zero-initialize so a partially-filled buffer never contains ++ * uninitialized memory for the rendering code below. */ ++ buf = calloc((size_t)space, 1); ++ ++ /* Retrieve the fill value. This can fail on a corrupted or crafted file ++ * whose fill value has no datatype. Any errors are suppressed and handled ++ * later. */ ++ if (buf != NULL) { ++ H5E_BEGIN_TRY ++ { ++ fill_ret = H5Pget_fill_value(dcpl, n_type, buf); ++ } ++ H5E_END_TRY ++ } + +- H5Pget_fill_value(dcpl, n_type, buf); ++ if (buf == NULL || fill_ret < 0) { ++ /* No usable fill value: emit an empty element rather than ++ * dereferencing an unallocated or unretrievable buffer. */ ++ ctx.need_prefix = true; + +- if (H5Tget_class(n_type) == H5T_REFERENCE) { ++ /* Render the element */ ++ h5tools_str_reset(&buffer); ++ h5tools_str_append(&buffer, "<%sNoData />", xmlnsprefix); ++ h5tools_render_element(rawoutstream, outputformat, &ctx, &buffer, &curr_pos, ++ (size_t)outputformat->line_ncols, (hsize_t)0, (hsize_t)0); ++ } ++ else if (H5Tget_class(n_type) == H5T_REFERENCE) { + const char *path = lookup_ref_path(*(H5R_ref_t *)buf); + + ctx.need_prefix = true; diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 1ec5ad049e..31a56bce3c 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -23,6 +23,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-17574.patch \ file://CVE-2026-19025.patch \ file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ + file://CVE-2026-19023-CVE-2026-19024.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 21:22:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103185 Received: from mail-dl1-f54.google.com (mail-dl1-f54.google.com [74.125.82.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6743.1793913782027256365 for ; Thu, 05 Nov 2026 13:23:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=UCLGbyR5; spf=pass (domain: gmail.com, ip: 74.125.82.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f54.google.com with SMTP id a92af1059eb24-1a3c08d6928so68553c88.0 for ; Thu, 05 Nov 2026 13:23:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913781; x=1794518581; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PA6XKl9SqBXYy9VJi5794gwNgSMxB6x5+2LDcHdpgNQ=; b=UCLGbyR5C2O33Nx0DzQDFtPHjQgUail7KaRnpnDzkFc2yEDXl9pJWCHzrlLbn5Khmu jwLu2Q2dqPzhKzeG89vG7k7htLhSb3p/H9zyE5S+gMn6yUkQ9jwB8w4DOLeWBE1MMXKi zIT6hBDeLwmgchCiEZd9lLI9KmjLQABNP/iNR/qYrqP9c4wgLAhHIOpL8MnDGBNP9gw0 jdBatVd+BoGM4St6ETRUbLh4f5PzMIeF2i+9iGWu4UFPoiOlW/nEyL5peYaTUJmEis0V 4EcqMH4FEKUekb0Przwqe39je18QEYJEFjhDPVTftR+YkFNmhXnriRepU+vPQTlXqAPF dUeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913781; x=1794518581; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=PA6XKl9SqBXYy9VJi5794gwNgSMxB6x5+2LDcHdpgNQ=; b=AX53k9SJcg9gNeXMJC615i5IalF/+e1ofU7GjkKDf82r94miMTKUM5u5PPVIdAqCe9 nGubmiDx2lesM+M1g9oFQA8FBX6XNx10NAa0BRFsGHqA3ifIHLx9OalT6QeAVuS80T2H Tq6zalhPwqkYQuI1LqqDLcgxuLl8q0ip3eL7wKTgNYlBiVmuob04leeu3zAq71xnGy0Q IZGCBiKgmcCT4cTdV17Sm6tUdw7vWEw9eNFkzeYIat+0twsiWVIciWkW4PDCkmx1IGPq 9KFWRNwqB1DJkv+CNqP1hoHoOQPbXS4VQ2+bojJkoXrX3Fw1fsQDqrSTe34ZydvwcVIF wD8Q== X-Gm-Message-State: APuU4Z8CbY/HY6Rt8QGjd1mr5QN3P2DDhN7LuS3LpjwvpA6CcmDOY6x2 Ae2g2UPwLb4r2yI92MS7jXRzco/fEbywgmCdAK86tJbHudYz5fwHzmP2t71Lrw== X-Gm-Gg: AYBFou3ut5hx0ZIpRsKFIqDrVLts5nfFx8E7mSkVsuvncZL1se+e803ENeBISWAB/Y3 x3IUIDMcr7h+L1Is+byBaT3OtZnbKMVGZN3NIbKJ8e2LfLjuh5FcMRu0Pn2B5CtT8QeC0Yn7jYb EBed/qbyihR1SF/3mfD2upJNF0of4AuGMzW32TeV6diPMjY4RkUnSrCa6Dq7A+1U6DpWFGEVA0l HMfucz6iYwH0NybpeXoLQjiz6I+R4DrT0KLqavMoE0/3xhK/FJ33vsLAf9AlOnhjtVHLfRzvBmC JugkRO9mRYqfifxW4OmnjIl4rOuuXAmPWZ4/x5w0OEU4XAp2KhZsNW6WRrK56iAd/Yhhd8lo/lD UhXfhO46qX2oGwPY8vU8nX4veNyNi1IcNsAEONE/RXTUyO6UCm7EjPW+TBExkSOepbpIsHL8N30 1Hfo9w7aqDR1fbQY00oLe6hEf7RJvGofC5d9LJVDb6IjrXq48nHOtyZN5SkQjkiiGxHmYXykDJQ fb807GPrl+m4MrLEMBRBOd+egVHSrVpsmd/8xtN9Pn9XVHtIRrSkoYtRNxVCuR500SbQSZoV+/r a/3ccabHmnmWmIufpbvOUi9tmQhcSHk39ev2FUpNimhaE58G/hWrRrPvlSja4A== X-Received: by 2002:a05:701b:2050:20b0:166:5552:780a with SMTP id a92af1059eb24-1b25d31e5a2mr315437c88.8.1793913781066; Thu, 05 Nov 2026 13:23:01 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.22.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:00 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 3/14] hdf5: patch CVE-2026-120689 Date: Fri, 6 Nov 2026 10:22:39 +1300 Message-ID: <20261105212250.490188-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131940 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120689 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-120689.patch | 60 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch new file mode 100644 index 0000000000..dd9e9374ac --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120689.patch @@ -0,0 +1,60 @@ +From 0472315404dc03d0e89eec4513eb80930f9b176e Mon Sep 17 00:00:00 2001 +From: PGZXB <420254146@qq.com> +Date: Fri, 9 Oct 2026 02:52:55 +0800 +Subject: [PATCH] Fix StackOverflow when calling `H5Gget_info` (#6685) + +Verify B-tree node level when an expected level value is provided + +(cherry picked from commit 5933130b610c7bd6e66fe93c2798b97e3f3188c8) + +CVE: CVE-2026-120689 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/5933130b610c7bd6e66fe93c2798b97e3f3188c8] + +Signed-off-by: Ankur Tyagi +--- + release_docs/CHANGELOG.md | 6 ++++++ + src/H5B.c | 14 ++++++++++++++ + 2 files changed, 20 insertions(+) + +diff --git a/release_docs/CHANGELOG.md b/release_docs/CHANGELOG.md +index c181f174bbb..b5c99cd4b16 100644 +--- a/release_docs/CHANGELOG.md ++++ b/release_docs/CHANGELOG.md +@@ -778,6 +778,12 @@ Added Fortran wrapper `h5fdsubfiling_get_file_mapping_f()` for the subfiling fil + + A malformed HDF5 file could have an attribute with a recorded name length of zero.This would lead to an overflow and an invalid memory access. An integrity check has been added to detect this case and safely stop file decoding. + ++### Fixed a stack overflow when iterating a corrupted B-tree ++ ++ `H5B__iterate_helper()` now verifies that a B-tree node it has just protected has the level the traversal expects, when the expected level is known. The equivalent check in `H5B__cache_deserialize()` only runs when a node is first loaded into the metadata cache, so a corrupted B-tree whose child pointer revisits a node that is already cached (for example, a node that points to itself) could bypass that check and recurse without bound until the stack was exhausted. Such a file is now rejected with an error instead of crashing. This was observed through `H5Gget_info()`. ++ ++ Fixes GitHub issue #6403 ++ + ## Java Library + + ### Renamed the Callbacks.java file to H5Callbacks.java +diff --git a/src/H5B.c b/src/H5B.c +index c9571708b73..4c6b1a55480 100644 +--- a/src/H5B.c ++++ b/src/H5B.c +@@ -1140,6 +1140,20 @@ H5B__iterate_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, int exp_lev + if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG))) + HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, H5_ITER_ERROR, "unable to load B-tree node"); + ++ /* Check for a corrupted B-tree node. If the caller has told us what ++ * level to expect, verify that the node we just protected actually has ++ * that level. This check must be performed here rather than relying ++ * solely on the equivalent check in H5B__cache_deserialize, because ++ * that deserialize callback only runs when a node is first loaded into ++ * the metadata cache. A corrupted B-tree whose child pointer revisits ++ * a node that is already cached (e.g. a node that points to itself) ++ * bypasses the deserialize callback entirely, so without this check the ++ * recursion below would never terminate and would overflow the stack. ++ */ ++ if (exp_level != H5B_UNKNOWN_NODELEVEL && bt->level != (unsigned)exp_level) ++ HGOTO_ERROR(H5E_BTREE, H5E_BADVALUE, H5_ITER_ERROR, ++ "B-tree node level is not as expected, possibly corrupted"); ++ + /* Iterate over node's children */ + for (u = 0; u < bt->nchildren && ret_value == H5_ITER_CONT; u++) { + if (bt->level > 0) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 31a56bce3c..ea2ce9747c 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -24,6 +24,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-19025.patch \ file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ file://CVE-2026-19023-CVE-2026-19024.patch \ + file://CVE-2026-120689.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 21:22:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103180 Received: from mail-dy1-f174.google.com (mail-dy1-f174.google.com [74.125.82.174]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6744.1793913784350826119 for ; Thu, 05 Nov 2026 13:23:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=ET4mjlkm; spf=pass (domain: gmail.com, ip: 74.125.82.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f174.google.com with SMTP id 5a478bee46e88-33fb4680717so194889eec.1 for ; Thu, 05 Nov 2026 13:23:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913784; x=1794518584; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=cFBN/yV+JuT7UL0QSIqaBoMMF21QNZUx4q6n5yIXgsQ=; b=ET4mjlkmrP3RKYcZHoo2CjhZz7zB3gPKgaKKJPjB8U+A+cwy2WIq/RN+qCcZ2WwYOt oZhkOWFKXTfQd8z0k9oRkxEROnwosFbMctFkY7QV6HasAPN2O9VAPwPAXP6MwkE4aDRD uasziLgrm6zWwC+NlIyh2XxhsMvi4vxJkkRZIpVn+WzUAey4hGFBkX1HI+yIit86D4zH yBh4MScJpHRhnDra0TiRGNnpux7rJTzhf0n4ryvmXVvNnAZWgdQqzkzkY1EwHK5GS1Gs 2ngGeJavhpEEK7N3rWOkoqeNpO6D68JkOu5J+GwpnjNPFz7XmdLDPldm3IvZ7EYPERKP cLPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913784; x=1794518584; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=cFBN/yV+JuT7UL0QSIqaBoMMF21QNZUx4q6n5yIXgsQ=; b=pLccYxvAzgp7JbajJTgzXzNo75F3iWIXDqYD9jmvWvqf1aQlY9+rxaXqXEroW091Uj iPYs9l+nwZunWpcBZ20/1JIp5itvf1S6Bmd9DgJoYIu/pG6Awp8sm4BCncZ2dhOJ+/mY e9eE8TdTcC2FswNQfBAddUF/q2oSENRVP2oklRqq0oLOpdTBtqceZ2rLYxfxvo7srfmQ kZ68Th/hwQhLCV/gqTyw3mUCER6U4wOP9XyGiTvPUIrD5PKOrgDa2o8WzWQV2eVUmqVr Xgl2Tarlob3J9ZULPCJErl+U2k0OWfkCeZIPAPKUggPsDRjy8j2YJJbZrv5S1Rhkx5mj uxpg== X-Gm-Message-State: APuU4Z8Vz0mLOBjrn/rnirU3ku2r56YM0ve49GBq4MNaD+/K5Npfb7he R/F1MrhmEPBBkaeNaSZz2zYNhDNAL76Z0NitOHFMmaTiLSDupEaFFQrTC6AEfg== X-Gm-Gg: AYBFou2qMK06BSPQb7b25cbxxoi5Op7mCoYB9tPosNGxz+lfHJC5w08nz89Kt3Xt8hi 6uu8+moiC2g10CGtGu8qHP3DezPehAx20l+ewfBv10826YWTH4hez1YSr+IhVCRF/1zc1mtPhTG JEYBwIrS2NdaDP/2iwEWw55e5e3G6L7Yc2sj9lbUuZbQz8MEX/fuqRtE89sDBIb9PAwCevzPaDf 6xkh7xChthoePSadnZhZD5spdbXEPSopesUknzvaNXz/q6dp/+Rxvgrj26+ylAKJP73hQKQ9eQ5 FWI2uoZ2mBQA4zGkAom3K7l5OHA+5rouq5bUffre0t31pGeSvqc/AhmeI+e833mi//Z34GMwQ6k SySaB24CMd3FxhkFEUBflCZKFi28//05Xxpk8wiPsKjZdPL5+Wu1QQWvH/zhZiA/kCf8FtxrpMe 04oUSSkd8WVzU8wHEJkIxGR2jsEM3axcRmQQRxGbd+LGRJ2dIdrr/d2eF+qPWkqCpBZ1eNu+K/M sGVugiv1WhDKp+UXwJ1P3cc5bOOUypBJymhVFKpZ01fpDbBuFu3qEMuMkg39XJLHs3IFNdgIGuk JGMgAI6aMWyVRp6LxMwcnazMDQD6s3EgudQz4S1kiZOBuWFufo0IL6cJr3KYmFBxzECeiue1TYU 4qaHvGXA= X-Received: by 2002:a05:693c:8103:b0:36a:18a:e00f with SMTP id 5a478bee46e88-36f76a18dbamr600148eec.34.1793913783044; Thu, 05 Nov 2026 13:23:03 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:02 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 4/14] hdf5: patch CVE-2026-120754 and CVE-2026-120755 Date: Fri, 6 Nov 2026 10:22:40 +1300 Message-ID: <20261105212250.490188-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131941 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120754 https://nvd.nist.gov/vuln/detail/cve-2026-120755 Signed-off-by: Ankur Tyagi --- .../CVE-2026-120754-CVE-2026-120755.patch | 172 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 173 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch new file mode 100644 index 0000000000..3f0a8d69d5 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120754-CVE-2026-120755.patch @@ -0,0 +1,172 @@ +From 78672660618de8cca7c804f465886af02a89e79b Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Wed, 21 Oct 2026 13:52:39 -0500 +Subject: [PATCH] Bound filter header reads to the stored chunk length (#6585) + +* bound scaleoffset and fletcher32 reads to the chunk buffer + +* Bound filter header reads to the stored chunk length + +This PR is an expansion of #6579. + +The scaleoffset bounds checks measured against *buf_size, the size of the +chunk buffer, rather than nbytes, the number of bytes the pipeline read from +the file. H5D__chunk_lock() sizes a filtered chunk buffer to MAX(stored size, +unfiltered size) so filters have room to expand into, and fills only the +stored bytes, so the buffer is routinely longer than the data in it. A +truncated chunk therefore passed the header check and decompressed out of the +uninitialized remainder of the allocation, returning unrelated heap contents +as dataset data. Because the reads stay inside the allocation, the address +sanitizer does not see them. + +This PR switches every read-side check in H5Z__filter_scaleoffset() +to bound against nbytes and pass the stored length to +H5Z__scaleoffset_decompress(). + +Similar short-chunk checks are added to szip and fletcher32. + +The direct chunk test has been extended to cover a chunk whose unfiltered size is +larger than the bytes stored for it, and to cover szip. + +* Correct potential invalid pointer usage + +* update CHANGELOG + +* Update CHANGELOG comment + +* Guard scaleoffset output size against multiplication overflow + +--------- + +Co-authored-by: Nayyar +Co-authored-by: Larry Knox + +CVE: CVE-2026-120754 CVE-2026-120755 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/cdb13c4de9c7edbbae180f384e2e610a3b3cf185] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Zfletcher32.c | 13 +++++++------ + src/H5Zscaleoffset.c | 15 +++++++++++---- + src/H5Zszip.c | 18 ++++++++++++++---- + 3 files changed, 32 insertions(+), 14 deletions(-) + +diff --git a/src/H5Zfletcher32.c b/src/H5Zfletcher32.c +index b89724ad0a3..5ef3b04cbcf 100644 +--- a/src/H5Zfletcher32.c ++++ b/src/H5Zfletcher32.c +@@ -62,13 +62,14 @@ H5Z__filter_fletcher32(unsigned flags, size_t H5_ATTR_UNUSED cd_nelmts, + assert(sizeof(uint32_t) >= 4); + + if (flags & H5Z_FLAG_REVERSE) { /* Read */ +- /* A Fletcher32-filtered buffer must contain at least the trailing +- * checksum. Reject anything smaller to avoid a size_t underflow +- * when computing the data length. ++ /* The checksum is stored at the end of the chunk, so anything shorter ++ * than the checksum itself makes the length arithmetic below wrap. A ++ * chunk of exactly FLETCHER_LEN bytes holds no data and would return a ++ * filtered size of zero, which the pipeline reports as a filter failure, ++ * so reject it here where the reason can be stated. + */ +- if (nbytes < FLETCHER_LEN) +- HGOTO_ERROR(H5E_STORAGE, H5E_OVERFLOW, 0, +- "fletcher32 filter input buffer too small to contain checksum"); ++ if (nbytes <= FLETCHER_LEN) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + + /* Do checksum if it's enabled for read; otherwise skip it + * to save performance. */ +diff --git a/src/H5Zscaleoffset.c b/src/H5Zscaleoffset.c +index d39b4f40403..d506e5203a0 100644 +--- a/src/H5Zscaleoffset.c ++++ b/src/H5Zscaleoffset.c +@@ -1205,10 +1205,18 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu + unsigned long long minval_mask = 0; + unsigned minval_size = 0; + +- minbits = 0; +- if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5, (unsigned char *)*buf + *buf_size - 1)) ++ /* Bound every read below by nbytes rather than *buf_size. The caller may ++ * provide a buffer larger than the data it holds, so restrict the read ++ * to the valid nbytes. ++ */ ++ /* The minbits and minval-size fields are the first five bytes of the ++ * stream, so validate that length before deriving an end-of-buffer ++ * pointer from nbytes ++ */ ++ if (nbytes < 5) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + ++ minbits = 0; + for (i = 0; i < 4; i++) { + minbits_mask = ((unsigned char *)*buf)[i]; + minbits_mask <<= i * 8; +@@ -1224,8 +1232,7 @@ H5Z__filter_scaleoffset(unsigned flags, size_t cd_nelmts, const unsigned cd_valu + minval_size = sizeof(unsigned long long) <= ((unsigned char *)*buf)[4] ? sizeof(unsigned long long) + : ((unsigned char *)*buf)[4]; + minval = 0; +- if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size, +- (unsigned char *)*buf + *buf_size - 1)) ++ if (H5_IS_BUFFER_OVERFLOW((unsigned char *)*buf, 5 + minval_size, (unsigned char *)*buf + nbytes - 1)) + HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); + for (i = 0; i < minval_size; i++) { + minval_mask = ((unsigned char *)*buf)[5 + i]; +diff --git a/src/H5Zszip.c b/src/H5Zszip.c +index 9b37035374f..dd6c3619873 100644 +--- a/src/H5Zszip.c ++++ b/src/H5Zszip.c +@@ -28,6 +28,9 @@ + #include "szlib.h" + #endif + ++/* Size of the uncompressed-length header stored in front of the szip stream */ ++#define SZIP_HEADER_LEN 4 ++ + /* Local function prototypes */ + static htri_t H5Z__can_apply_szip(hid_t dcpl_id, hid_t type_id, hid_t space_id); + static herr_t H5Z__set_local_szip(hid_t dcpl_id, hid_t type_id, hid_t space_id); +@@ -284,6 +287,13 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + uint32_t stored_nalloc; /* Number of bytes the compressed block will expand into */ + size_t nalloc; /* Number of bytes the compressed block will expand into */ + ++ /* The uncompressed length is stored in front of the compressed stream, so ++ * a chunk shorter than that header makes the length arithmetic below wrap. ++ * A chunk of exactly SZIP_HEADER_LEN bytes holds no compressed data. ++ */ ++ if (nbytes <= SZIP_HEADER_LEN) ++ HGOTO_ERROR(H5E_ARGS, H5E_BADVALUE, 0, "buffer too short"); ++ + /* Get the size of the uncompressed buffer */ + newbuf = (unsigned char *)(*buf); + UINT32DECODE(newbuf, stored_nalloc); +@@ -295,7 +305,7 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + + /* Decompress the buffer */ + size_out = nalloc; +- if (SZ_BufftoBuffDecompress(outbuf, &size_out, newbuf, nbytes - 4, &sz_param) != SZ_OK) ++ if (SZ_BufftoBuffDecompress(outbuf, &size_out, newbuf, nbytes - SZIP_HEADER_LEN, &sz_param) != SZ_OK) + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "szip_filter: decompression failed"); + assert(size_out == nalloc); + +@@ -313,7 +323,7 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + unsigned char *dst = NULL; /* Temporary pointer to new output buffer */ + + /* Allocate space for the compressed buffer & header (assume data won't get bigger) */ +- if (NULL == (dst = outbuf = (unsigned char *)H5MM_malloc(nbytes + 4))) ++ if (NULL == (dst = outbuf = (unsigned char *)H5MM_malloc(nbytes + SZIP_HEADER_LEN))) + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, 0, "unable to allocate szip destination buffer"); + + /* Encode the uncompressed length */ +@@ -332,8 +342,8 @@ H5Z__filter_szip(unsigned flags, size_t cd_nelmts, const unsigned cd_values[], s + /* Set return values */ + *buf = outbuf; + outbuf = NULL; +- *buf_size = nbytes + 4; +- ret_value = size_out + 4; ++ *buf_size = nbytes + SZIP_HEADER_LEN; ++ ret_value = size_out + SZIP_HEADER_LEN; + } + + done: diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index ea2ce9747c..758baf6e15 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -25,6 +25,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \ file://CVE-2026-19023-CVE-2026-19024.patch \ file://CVE-2026-120689.patch \ + file://CVE-2026-120754-CVE-2026-120755.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 21:22:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103182 Received: from mail-dl1-f50.google.com (mail-dl1-f50.google.com [74.125.82.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6746.1793913785778248883 for ; Thu, 05 Nov 2026 13:23:05 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=WJ7NmqGx; spf=pass (domain: gmail.com, ip: 74.125.82.50, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f50.google.com with SMTP id a92af1059eb24-1a3c08d6928so68655c88.0 for ; Thu, 05 Nov 2026 13:23:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913785; x=1794518585; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Y7e396wcKFlYT+oE3BH+cK1GTDdLcdT5EgsTKjnPvF0=; b=WJ7NmqGxoOhisEGypLz3e8+dwtDuXWUK6S/xGlunAmz62V5g993GjJV9AOC7DrkYhS Ol9CkSInJPwaHt4jrurd3BJoWWi7AzTf42VkdluSuGnYJu7ObjE+MdL4MCBdw/HNFf8D K4kOms8xOxoftK0uo7j2KshQTe0bG0y4JQD7nXflrgzFcEDWjXLdpPiXvCPBw6vjhORc Hmm3o/PdyrlbABNfnExTtc+QJutmStALX0BJxnku3PCrm/A6JP0LPQ3pw8U1jENC3iB7 6cgB/u00AN+UUh96QSlKroMyd2rrV1QPt9VBFbUveYGWgEFD5P6E2W8Cfka2tJeVI0/K 0hQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913785; x=1794518585; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Y7e396wcKFlYT+oE3BH+cK1GTDdLcdT5EgsTKjnPvF0=; b=n1Ym/ARabuNVNNnFvqfgxrcn9C2rZzEmg7NFJGOhJTPvBJ91RqvOkVaSHrYr+k9ZEH +6TuwwtVyWMiUYdUyLr4Ba2L6CBKhjsqigQOMp91V43MamfdrlW3m4gkPpQYmwDvRE4d 9eU6u3q+D0njHdeifvvZENeD4QJaWBTiV8pFR8Wwa0mhjgMf6eBWsNi0XJ4wdvnWLGh7 QHU/tilDH1A1gr3PDUqukWpjuef3VXfPieUbezFytPOq9KHikj5H825sJxa+rfm5DaMp 9h0BLkktv1izyUwBBxbideKWqy3OAiawWGn/MMeVEY5Rb/MOZ2beRLnx0KikWcoT+oT5 SQVw== X-Gm-Message-State: APuU4Z/hAdQNgnPSwTGp2prAz76wIpvYKYxRda7qFxyVcy0O82bWhekR b6WGIL6opuuxOKt+gVtmjgFyn9i1ruZ2/jmSkM+AnzdYiqmVM6SbzMbDdoJRSQ== X-Gm-Gg: AYBFou2WB2vhjPUggXWRqQCAQvdUreH3wKslm3Cmz5xD0UK4nx+f1Y8k3k0sTeKFhbL QNBtbltQ71NP6AujfusKgU69UJvvLOz03jt8NH+78AIXAGvW2bAYt7ecXkBbUbjBRWLV9cr3irz vkG4HN0tdpby/P3vPfUbFK7FzHKgCsA+FMV8hHWmqpkAKLFSlRQv3xnFYKgTl+wgaKgziw/WTpr I5+7KrJpVYGyeYbz8Y3r5zGOs/fUhe9qHp5H7+8DCZBOP3LO1xIESJYGLqcO9uhZoV2K8CAbUdu 1KmYiqrukUYeoDwFQc9sM1aRFfEI/JGgq3banmvrb6FygftS2tRqeT83KIeTqVqSi8bx3Iky5Oh cb5edqsoJOwu0YkubBVH3CGG0WoJPbjD2zhFakYU9p0HftR3CBnirxdPSYpOr9cqDaUe1SXthMv qfrjuxnNZfs2friNLrbgx/sSl61w44vaAvMIxWvYSYyGy+JbgJ9CfAFdPJzdToEXwcm3FaFrnMP xgigmfEoqHdg0Vl4b7QmpFmH540Eu7iNpwNZvEU1rFJzqvStgiDrkbPR+f157B34YC1b81yKdOx lbAPaBx9HE0yefTiSGXL076hGUTyGGiHjU5AeL58thHLpYRPaneYlr6CxChOkIIjc4zFNTUECml ZdujYAfM= X-Received: by 2002:a05:7022:4585:b0:154:fa0b:6df1 with SMTP id a92af1059eb24-1b25d392837mr321612c88.37.1793913784995; Thu, 05 Nov 2026 13:23:04 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:04 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 5/14] hdf5: patch CVE-2026-120756 Date: Fri, 6 Nov 2026 10:22:41 +1300 Message-ID: <20261105212250.490188-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131942 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120756 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-120756.patch | 45 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch new file mode 100644 index 0000000000..28bd658598 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120756.patch @@ -0,0 +1,45 @@ +From 43855883c1ea10a072b7e7cf2dbc5a29ab411a8f Mon Sep 17 00:00:00 2001 +From: Nayyar +Date: Sat, 12 Sep 2026 16:37:49 +0530 +Subject: [PATCH] check object header message size after decoding its header + (#6589) + +(cherry picked from commit 10f1af5528168c5a71a58eba0b486e0677f3aaa3) + +CVE: CVE-2026-120756 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/10f1af5528168c5a71a58eba0b486e0677f3aaa3] + +Dropped changes to the test and CHANGELOG file. +Signed-off-by: Ankur Tyagi +--- + src/H5Ocache.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/src/H5Ocache.c b/src/H5Ocache.c +index 8f0928f290e..9dc6a2e21bb 100644 +--- a/src/H5Ocache.c ++++ b/src/H5Ocache.c +@@ -1270,9 +1270,6 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t + if (mesg_size != H5O_ALIGN_OH(oh, mesg_size)) + HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL, "message not aligned"); + +- if (H5_IS_BUFFER_OVERFLOW(chunk_image, mesg_size, p_end)) +- HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, FAIL, "message size exceeds buffer end"); +- + /* Message flags */ + if (H5_IS_BUFFER_OVERFLOW(chunk_image, 1, p_end)) + HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, FAIL, "ran off end of input buffer while decoding"); +@@ -1305,6 +1302,13 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t + } + } + ++ /* The message body starts after the message header, so its size can ++ * only be checked against the buffer once the whole header has been ++ * decoded ++ */ ++ if (H5_IS_BUFFER_OVERFLOW(chunk_image, mesg_size, p_end)) ++ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, FAIL, "message size exceeds buffer end"); ++ + /* Increment count of null messages */ + if (H5O_NULL_ID == id) + nullcnt++; diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 758baf6e15..2b89c6925b 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -26,6 +26,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-19023-CVE-2026-19024.patch \ file://CVE-2026-120689.patch \ file://CVE-2026-120754-CVE-2026-120755.patch \ + file://CVE-2026-120756.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 21:22:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103181 Received: from mail-dy1-f180.google.com (mail-dy1-f180.google.com [74.125.82.180]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6633.1793913787768174590 for ; Thu, 05 Nov 2026 13:23:07 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=M12HOMTM; spf=pass (domain: gmail.com, ip: 74.125.82.180, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f180.google.com with SMTP id 5a478bee46e88-35c76e9614aso3199542eec.0 for ; Thu, 05 Nov 2026 13:23:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913787; x=1794518587; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VRGkqx275ZALr91aZdE1fHm0mnzExbQ5waabp5PY95Y=; b=M12HOMTMehn7Rss1B2g//1EpSJsuATcfINcSqyTYqJ5vhiSCzSVtZtZIkYVznVYBgj TzI9q88qQ819B4D6ThAbEKvrYjwx7AkDdmyMM/cEX3VuKA4WMnqoQt8I9wkx0sq0q/Gq ud9U8tL9FdqCVAZMaRtFWmVzSIohCxWUJA6G+5XB7nJehrbdtRz5v/eoeruJA8DVzn4B +Wse2IuErohWBwbEa41htYYmPDMjIKK3p76ZP90b/sZg57x8dcXL8svEovHHuRyVjT9c scMTJ3bp0YewMRNKfK680rPq8cToUrYhNvoy5vsG85vea95+XqlFQAn0G5pq0GAGSL8j UMew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913787; x=1794518587; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=VRGkqx275ZALr91aZdE1fHm0mnzExbQ5waabp5PY95Y=; b=AGLiarPSs4itXtgRVPl725gKiVcbbEUn3CLduqWnRKM5/h5TJ4UZFcwzNqjsn5esJM Qrn48izeHDpawGr40V3qnpkGDHFXQsMOU3PRy0xSab6GE/0hAnA5Ib4BdJqoUhCbS4RF pB4e7ym9DK4jOd1CiPf6TpelHhtCW8MU8yX0o2wEUlEFmJMkM7ptkbYB0ykg2f4K6HM8 6r+XhhwgXi7IQxH6KRQqRiBjNVi7bfTftyTmQZufrwFAGbpUNfRLPww0mYJ2x4h1YKnf GPFSVXOov1N8Gbow9yL56ETtwSUYMqkbMJEw8iiyJyhk7byHbnU+yltM9UNx+cq9OQdv 5smw== X-Gm-Message-State: APuU4Z8KqV/9jNe9ctTaTJ9DszZOmid0cGZLg6V6OdB3dpkt2LN/tihp jcND22ofwecm5NgJP7xSQSyDZHIilwvZvkk7a7E6W1UzVzbiG8k/6BxeHrroVg== X-Gm-Gg: AYBFou2cZgarPga8bLR3BkUJMtyP4okwpcxYBmEhiOD1qwNKsQWGsBlOfCqlnRIPhF6 diXtS8hINiFFwA5CqkNn6vMMvMPl/JNnwP4L+QWTJwdZr+7aV/YsTpajn8OTcydR+hZkxxn+TA+ c/Q8XK0JhGYHpQGZfLshbwdJaLFET6FA2LutdYGk2v8CcNqlIhWV8e69yzkm2ofox6QRzpi9E8W QSU/znlllRAHkwW5E7zeg3gdoM9SbzXbhEkMaCqrLmAsGMMRphv0RVytzNVtIxSDcTt9DX2ilYa 03M8NL2A4rg3bcFPb3b3cHDXKJMoCJo/cFn0o/f8H4mUjNaoyd4xBbgkXOaCMQjtPDJ8WUeaY6y HtIGpioNc5LSeCwfnuOVHznFBTv6x/Ss8hQLXjh69BJ+Om//L2weatIc7HkRL2XtFJI6i+E/a0o 2UOVkiRDaP9dvbZ63hnVQrnTnFSsx3N4UblqhKesSZebnwJ1YbXsSGG+RZHFU/Z/vWuONmbVFnJ KQ8sGax3HsZqtMyqwtckI8qQFQIkDxH5vvER3/bSKOzZ/QG+8A/yNiNN1EHAACuSp4Z/M/LLo0+ AYMG6olrhRt/rx8EYX7KYQ2f/3FdxhTynOpw+GDi7wcawXnjB7NGph5FSFC4OA== X-Received: by 2002:a05:7301:1408:b0:36a:75aa:33bc with SMTP id 5a478bee46e88-36f7611b716mr446944eec.24.1793913786923; Thu, 05 Nov 2026 13:23:06 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:06 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 6/14] hdf5: patch CVE-2026-120757 Date: Fri, 6 Nov 2026 10:22:42 +1300 Message-ID: <20261105212250.490188-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131943 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120757 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-120757.patch | 63 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 64 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch new file mode 100644 index 0000000000..886d6d946b --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120757.patch @@ -0,0 +1,63 @@ +From fa4c737d41c1c86638525a290b5576c8966090d0 Mon Sep 17 00:00:00 2001 +From: Nayyar +Date: Thu, 8 Oct 2026 18:57:14 +0530 +Subject: [PATCH] reject malformed external link data in H5L__extern_traverse + (#6708) + +* validate external link data before parsing in traversal + +(cherry picked from commit 8117f4c75fdfb5e759ad73ce62d7ef4584130acd) + +CVE: CVE-2026-120757 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/8117f4c75fdfb5e759ad73ce62d7ef4584130acd] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Lexternal.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/src/H5Lexternal.c b/src/H5Lexternal.c +index 793825d1c3d..5f874d53177 100644 +--- a/src/H5Lexternal.c ++++ b/src/H5Lexternal.c +@@ -93,7 +93,7 @@ static const H5L_class_t H5L_EXTERN_LINK_CLASS[1] = {{ + */ + static hid_t + H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, const void *_udata, +- size_t H5_ATTR_UNUSED udata_size, hid_t lapl_id, hid_t H5_ATTR_UNUSED dxpl_id) ++ size_t udata_size, hid_t lapl_id, hid_t H5_ATTR_UNUSED dxpl_id) + { + H5P_genplist_t *plist; /* Property list pointer */ + H5G_loc_t root_loc; /* Location of root group in external file */ +@@ -121,6 +121,18 @@ H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, cons + /* Sanity checks */ + assert(p); + ++ /* The udata holds a version/flags byte followed by two NULL-terminated ++ * strings (file name and object path). The strings are located below with ++ * strlen(), so validate the buffer against udata_size first: it must have ++ * room for both strings and end on a NULL terminator. A malformed link ++ * from a corrupted file would otherwise read past the udata buffer. This ++ * matches the checks in H5Lunpack_elink_val(). ++ */ ++ if (udata_size <= 2) ++ HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data too small"); ++ if (p[udata_size - 1] != '\0') ++ HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data is not NULL-terminated"); ++ + /* Check external link version & flags */ + if (((*p >> 4) & 0x0F) > H5L_EXT_VERSION) + HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "bad version number for external link"); +@@ -131,7 +143,9 @@ H5L__extern_traverse(const char H5_ATTR_UNUSED *link_name, hid_t cur_group, cons + /* Gather some information from the external link's user data */ + file_name = (const char *)p; + fname_len = strlen(file_name); +- obj_name = (const char *)p + fname_len + 1; ++ if ((fname_len + 1) >= (udata_size - 1)) ++ HGOTO_ERROR(H5E_LINK, H5E_CANTDECODE, H5I_INVALID_HID, "external link data has no object path"); ++ obj_name = (const char *)p + fname_len + 1; + + /* Get the plist structure */ + if (NULL == (plist = H5P_object_verify(lapl_id, H5P_LINK_ACCESS, true))) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 2b89c6925b..8777345a72 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -27,6 +27,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-120689.patch \ file://CVE-2026-120754-CVE-2026-120755.patch \ file://CVE-2026-120756.patch \ + file://CVE-2026-120757.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 21:22:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103183 Received: from mail-dy1-f170.google.com (mail-dy1-f170.google.com [74.125.82.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6747.1793913789777989986 for ; Thu, 05 Nov 2026 13:23:09 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=B80Qxg3L; spf=pass (domain: gmail.com, ip: 74.125.82.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f170.google.com with SMTP id 5a478bee46e88-3535a54bed9so3138232eec.1 for ; Thu, 05 Nov 2026 13:23:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913789; x=1794518589; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XENQbrtMiXWdjIGUxRAln+jArm1NV/qgRCvtOJ+RpG8=; b=B80Qxg3LQj36jpk7/gFNagzRLj0D1b8CRaP4tFfputwZx6P4gIjTqRyyj94FLnniUu TLXDLALvPXhvBMz8Zo9E26rE01hQjHn5AtXlSyI1BsxvQL9iP4xtGtAyzb0LlNV9DN9G j9/ifGsaUpe0pFiubuMBiLhV9f2XK3yiYaIo6p+DDwSOJgqBxqo98F80Pgy641DTBbMC baA/WqpzNCUE0StjYIgM1Q6dGT/iBzTWtCaGXpDwR/PcLpFQ6Ep5hElEADEIvZOHjwuC uARm0CbPVq+r18e4YZLfC0u39yhDCk4GbKrmo4bVFQY2TEfdGvMqAsPRZEIavnjMQ30m L4WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913789; x=1794518589; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=XENQbrtMiXWdjIGUxRAln+jArm1NV/qgRCvtOJ+RpG8=; b=1PHUbhtLEBtADwt7cBhw7hfMbvF5x9OEcIa70kCYdrwlNtHkbL7Yl27iZZLPpW3o9r cYMJcvBzFAKdsREjkc8EMXH7PhZZ5jO7YsQqtk8eCj1VJOG85m1oN0rbHIRTnGcj62Vq HTDJ7toMqhf2aENXcx0TKxXiEjafmKRlP0Tp+UBQN/dKTqxpMj6V725Y0iveI6hQaIAG 3ux0opHfOFFxmLug5q7XvS2Y+WQejLr5M7C61YIqwUUjXwHERgqISIhZUmJVpkgrB4GD 4w6QWB/nJpLM880x2ZwgYVI4327VUs2TmaPcVFxqRdPZpG31Zk4Z+x11OvL+jN7SybNw VZcQ== X-Gm-Message-State: APuU4Z+lWpFSw1bsYc/idIY4jDLpHOA7scAUbgaIOZNMJTWpftBtQ30U GYzWXkDbeRTzayopkIMsPXbfcy/1ez2Ffc7kKbDNRVaDGXVMp6SyB3CegLNsmg== X-Gm-Gg: AYBFou1/u1PchgYH0J8mb+h8DorH5afFHoWD+vU97PXIAK9rOXL0ZcueBBaM9sW2ti7 hG/H4MdTTD2fT/AD9LfRWw/76x53ppSwv7z+uBB92YEnUNpu/GsezOzGzIAKcq66FynGNwjpWFe BkHUmVWSiThS2EwyeCnVnaxFoujEbTJRspLqOEcBqsdcZB0/3Jadem2/Mg4RC8X3Rqx4+TvAj2s /WZfM2H2ejW9NB06tcg0Kes6TJnYCPrnI1Wc+/9gfugHiDO1qNXBf3qdBtM6CroRBNF56PksIOc 4NqrAR2Oxkw4Cq0Ax/MOy3xbm1WgSHPBJu2UJs418kGOE+hFAkXMZKLvWZuOFo5+jS8eege5iu3 J6DqhqoXEBWVMvn0SHc1CAWSfynXFIIqnZ52nZceKTuqcNauzZqB+QFcEqVGu0JOX7BDOnp6v2y UwpjFixy+BuXlSm4kRYssgaiq6mEANXFR3KgNY4kzgrIUFA39IDvuCW5xCuTTN5zCbuuPXSbTdR kNVEB2R667scEVX0Ldd9S9Aegqd94ivLy7D7Dp0lKyF89UBnaI/1AgnuETaTfA1s0LJqEakdGQr vWZ9MaJett9/eh81BH7VGL8us2dFUK4rD37Zw9jw8EjTtOrB3paSHavYBckHHraFqwX/0O8DcqO Otd/Mve4= X-Received: by 2002:a05:7301:791:b0:36d:f46a:87b8 with SMTP id 5a478bee46e88-36f77005ae5mr471176eec.37.1793913788945; Thu, 05 Nov 2026 13:23:08 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:08 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 7/14] hdf5: patch CVE-2026-120758 Date: Fri, 6 Nov 2026 10:22:43 +1300 Message-ID: <20261105212250.490188-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131944 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120758 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-120758.patch | 143 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 144 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-120758.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-120758.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-120758.patch new file mode 100644 index 0000000000..a8fb5f72ff --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-120758.patch @@ -0,0 +1,143 @@ +From 277a6bbfdb8e852b7bbd08ae002907fc559e0194 Mon Sep 17 00:00:00 2001 +From: tbeu +Date: Sat, 3 Oct 2026 07:43:53 +0200 +Subject: [PATCH] Fix NULL pointer dereferences in H5HL_protect and + H5HL_unprotect (#6377) + +* Fix NULL pointer dereferences in H5HL_protect and H5HL_unprotect + +When reading corrupted HDF5 files, H5HL_protect can encounter a heap +where prfx->heap is NULL or heap->dblk_image is NULL. Similarly, +H5HL_unprotect can encounter a heap where heap->prfx or heap->dblk has +been set to NULL by H5HL__prfx_dest during cache eviction of corrupted +entries. In both cases, the code proceeded to dereference NULL pointers, +causing a segfault (found by OSS-Fuzz via matio). + +Replace the assert in H5HL_unprotect with proper NULL checks and +HGOTO_ERROR, and add equivalent guards in H5HL_protect, so corrupted +files are rejected gracefully instead of crashing. + +* Address review: drop speculative H5HL_protect NULL checks, add regression test + changelog + +- Remove the NULL checks in H5HL_protect for prfx->heap and heap->dblk_image. + prfx->heap is set in H5HL__prfx_new and only cleared in H5HL__prfx_dest (which + frees the prefix in the same call), so the check is unreachable and could leak + prfx via the done block. heap->dblk_image is NULL by design whenever the data + block is not contiguous with the prefix, so that check was a false positive. +- Keep the H5HL_unprotect NULL checks for heap->prfx and heap->dblk, which are the + actual fix for the reported crash (OSS-Fuzz 504827191). +- Add a regression test (corrupt_heap_unprotect) in test/lheap.c using the + minimized fuzzer file heap_corrupt_prfx.h5, asserting the corrupted file fails + gracefully instead of crashing in H5HL_unprotect. +- Document the fix in release_docs/CHANGELOG.md. + +* Improve lheap regression test for H5HL_unprotect NULL deref + +Replace the file-based traversal (which does not deterministically reach +the cache-eviction path that nulls heap->prfx) with a white-box check that +protects a local heap, simulates the corrupted/evicted condition by nulling +the heap's prfx/dblk pointers, and verifies H5HL_unprotect() returns an +error instead of dereferencing NULL. Keep a best-effort open/traverse of the +OSS-Fuzz minimized file (issue 504827191) as a smoke test. + +Verified: without the fix the test aborts (H5AC_unpin_entry(NULL)); with the +fix it passes. + +* Improve lheap regression test to consider review comments + +* Fix formatting + +* test: improve lheap regression test for reviewer comments + +- Use H5L_info2_t in visitor (matches H5L_iterate2_t signature) +- Use H5O_info2_t with H5Oget_info_by_name3 +- Replicate matio's exact traversal: H5Literate2 + H5Gopen2/H5Dopen2 + + H5Lvisit2 recursion, H5Aiterate2 attribute reads, skip #refs#/#subsystem# +- Keep white-box deterministic NULL-pointer guard (fuzzer file does not + deterministically crash via public API alone; original crash required + matio fuzzer's specific cache-pressure environment) +- Add CORRUPT_HEAP_TESTFILE define back for white-box test + +* Fix formatting + +* Reject a local heap unprotect when its pinned cache entry is gone + +H5HL_unprotect() now reports an error instead of dereferencing NULL when the +cache entry that H5HL_protect() pinned is no longer linked to the heap, and it +checks for that before decrementing the protect count so a rejected call leaves +the heap unchanged. The regression test as written couldn't fail, since its cleanup +label was after passed and every failure path still returned 0 (success). +It also only ever built single-cache-object heaps, and didn't reach the branch the crash +came from. It now grows a heap into a separate data block to cover both +branches and uses the standard error reporting. + +--------- + +Co-authored-by: Matthew Larson +Co-authored-by: Matt L <124107509+mattjala@users.noreply.github.com> +Co-authored-by: Larry Knox + +CVE: CVE-2026-120758 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/91fc37c3325264e67699408e3a190fe4f329bf85] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5HL.c | 34 +++++++++++++++++++++------------- + 1 file changed, 21 insertions(+), 13 deletions(-) + +diff --git a/src/H5HL.c b/src/H5HL.c +index b55b3690617..838426406a9 100644 +--- a/src/H5HL.c ++++ b/src/H5HL.c +@@ -416,28 +416,36 @@ H5HL_unprotect(H5HL_t *heap) + /* Check arguments */ + assert(heap); + +- /* Decrement # of times heap is protected */ +- heap->prots--; +- + /* Check for last unprotection of heap */ +- if (heap->prots == 0) { +- /* Check for separate heap data block */ ++ if (heap->prots == 1) { ++ void *pin_obj; /* Pointer to local heap object to unpin */ ++ ++ /* Get the object that H5HL_protect() pinned. It is unlinked from the ++ * heap when the cache destroys it, which a damaged file can provoke, ++ * so check for it before the protect count is decremented. ++ */ + if (heap->single_cache_obj) { +- /* Mark local heap prefix as evictable again */ +- if (FAIL == H5AC_unpin_entry(heap->prfx)) +- HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "unable to unpin local heap data block"); ++ if (NULL == heap->prfx) ++ HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "local heap prefix is not in the cache"); ++ ++ pin_obj = heap->prfx; + } + else { +- /* Sanity check */ +- assert(heap->dblk); ++ if (NULL == heap->dblk) ++ HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "local heap data block is not in the cache"); + +- /* Mark local heap data block as evictable again */ + /* (data block still pins prefix) */ +- if (FAIL == H5AC_unpin_entry(heap->dblk)) +- HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "unable to unpin local heap data block"); ++ pin_obj = heap->dblk; + } ++ ++ /* Mark local heap object as evictable again */ ++ if (FAIL == H5AC_unpin_entry(pin_obj)) ++ HGOTO_ERROR(H5E_HEAP, H5E_CANTUNPIN, FAIL, "unable to unpin local heap object"); + } + ++ /* Decrement # of times heap is protected */ ++ heap->prots--; ++ + done: + FUNC_LEAVE_NOAPI(ret_value) + } /* end H5HL_unprotect() */ diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 8777345a72..fe3c6211a3 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -28,6 +28,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-120754-CVE-2026-120755.patch \ file://CVE-2026-120756.patch \ file://CVE-2026-120757.patch \ + file://CVE-2026-120758.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Nov 5 21:22:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103189 Received: from mail-dl1-f49.google.com (mail-dl1-f49.google.com [74.125.82.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6749.1793913791915156241 for ; Thu, 05 Nov 2026 13:23:11 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=UfdQiQtf; spf=pass (domain: gmail.com, ip: 74.125.82.49, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f49.google.com with SMTP id a92af1059eb24-1adbf62dd31so62316c88.0 for ; Thu, 05 Nov 2026 13:23:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913791; x=1794518591; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=diq69kAIacw//G/YXzdwAdhD8qqDVnetdHKiTdqIw5E=; b=UfdQiQtfiGKELlBkmHaYjIF7yUjGYBnw1W0w0++gPWYRviYKHOBuAdf1LebjE86YkF dVQ9fxm37JPNHSa8nfyrwf9yz17AJkCaftJPZe+ziKr+FYYDJ9AAAZoZ6ufqPXFl6lmM LVmQrBaOw8iF1znavy+QGIuhIINlndzy2B+ZNMk0Lt+cjRV5AGxSt/XLDwNVmC2Vb3A9 4sbmwC8b4xBYsirF5agEHAXypF0jEatUL4qEL2RfNPiXsOa0E9SZ07zy18CNjdhDosnK /1S2mRIOO4Y9pBEZq2y3I3H0N4o0QayYx5nPHOETq4g/zgI5aKsJM2+wh7YHF99VNJ2G hFQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913791; x=1794518591; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=diq69kAIacw//G/YXzdwAdhD8qqDVnetdHKiTdqIw5E=; b=Cx0K6+i9ME6i1J1Ckxfmkn6YwsNdJrMfuJfHd7YWplNI2Kxndxw0bBMbBVXmINPj/F eHpP6UKwOhhcC/V5sCVi3aTRRQKHBjPUt5x1Q7saXtN23tqiqnn93E9xuNWaaKPhmk3I 5lDJilM5nyci7y60wqFWIbKDCFS0Gk1+R+DLqS13sxfoH4uvlycKip7XO0JLO2G0YClm cWEFETNUVyhSNIj70iJ56uSFr+KSnf1yKLZuVqj5fKhqpOKlmi+5odv6E9XpAz2MZZgC U+Y/D2f+9GnUepoPL2fDnhHQsLYkXUMB2m3WSf8uFVbYdlu6PH3mm1zuyvhZmp5Denp2 DzEA== X-Gm-Message-State: APuU4Z8xrgavROAAxCjvd7z/KC/sWEgFQO1S9AnstKLhieJ6Cs0Bvexg itTha0Id6BVctjggEw1F76EknBezABH2B4Oe1IOWi26mptDZy+SFZ0WON2RZ8A== X-Gm-Gg: AYBFou1LYOQBrvCZA30X65pT3EaKF5KJ2ihsG4wWJIis3d2IWrSHM3kqTWiM6X9XdcP Jmf83X6C2yHMV3g4htTStDurT2+t4Y2QmB5hcjJVK7lgmK440hbJ9HjJdgOCyteuagydCYqXu3w MvP6NH4P8xDo/OFMlI02HFqO5+R7qJhoqlGxi3sfv8UgyGh1wxQWR1A6egIWa9nQ3xu9hS+qgib bWrAqO2W/qITIBhrfBcEXqM0MeRZ1DGCrI3v582ZQ5bRc1qyqekd4/YWO8nu4uNemnSpvQ7+ytU R3uon3cbuHciDLoOw+e31xEZzrlV3e9MtaRmg+gwn+tCQgmHUSb4d4YMpNBG1/q79T1qiv867Oj WD8w0lk0x8cALkfWNl2ggteA65Zw/eviPH1+uXZK2dowO3z+/gBZHZUBQDl0fySB8h8K7Fd4/tG EYVvTKAn+1sLuKrKZXYh0Q0yGCxsvizJJ0h3+0QLJILm46ijrf8OQCRc6jDAjmwZeAq1kwqkGpA oIsbImwY1iXj3d51g4RgvVq4rAxnzt/vna1U30ZrWneIf2StrvMXeBwOTtjPyGww6v0w1PwoGgh Uzrh94AxS4pxunddQkHy7x7vsLLM31BnUCnsnrGf+dO1tNtItNbRTVueBNqNVQ== X-Received: by 2002:a05:7300:f58b:b0:368:7c9d:1577 with SMTP id 5a478bee46e88-36f75e295e2mr525350eec.20.1793913790890; Thu, 05 Nov 2026 13:23:10 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:10 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 8/14] libgphoto2: patch CVE-2026-120451 Date: Fri, 6 Nov 2026 10:22:44 +1300 Message-ID: <20261105212250.490188-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131945 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120451 Signed-off-by: Ankur Tyagi --- .../gphoto2/libgphoto2/CVE-2026-120451.patch | 43 +++++++++++++++++++ .../gphoto2/libgphoto2_2.5.33.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch new file mode 100644 index 0000000000..bee9033aac --- /dev/null +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch @@ -0,0 +1,43 @@ +From 021b03a90b744321bb237f66b1052fea58e91224 Mon Sep 17 00:00:00 2001 +From: TheProtagonist07 <63047129+TheProtagonist07@users.noreply.github.com> +Date: Wed, 28 Oct 2026 18:51:05 +0530 +Subject: [PATCH] jl2005c: reject an allocation table that does not fit the + buffers + +jl2005c_init() computes alloc_table_size from the entry count reported by +the camera and then reads that many bytes into the 0x4020 byte info[] stack +buffer and copies them into priv->table[0x4000]. For nb_entries >= 1022 both +operations write past the end of their destination. + +Return GP_ERROR_CORRUPTED_DATA if the table would not fit. + +Addresses findings 1 and 2 of #1326. + +(cherry picked from commit 6a3393dd996502457ab965432cf0b2035278825e) + +CVE: CVE-2026-120451 +Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/6a3393dd996502457ab965432cf0b2035278825e] +Signed-off-by: Ankur Tyagi +--- + camlibs/jl2005c/jl2005c.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/camlibs/jl2005c/jl2005c.c b/camlibs/jl2005c/jl2005c.c +index c447a23..12c106a 100644 +--- a/camlibs/jl2005c/jl2005c.c ++++ b/camlibs/jl2005c/jl2005c.c +@@ -144,6 +144,14 @@ restart: + alloc_table_size = priv->nb_entries * 0x10 + 0x30; + if (alloc_table_size%0x200) + alloc_table_size += 0x200 - (alloc_table_size%0x200); ++ /* nb_entries comes from the camera. The table has to fit into the ++ * local info buffer as well as into priv->table. */ ++ if ((size_t)alloc_table_size > sizeof(info) || ++ (size_t)alloc_table_size - 0x30 > sizeof(priv->table)) { ++ GP_DEBUG("alloc_table_size 0x%x is too large for %d entries\n", ++ alloc_table_size, priv->nb_entries); ++ return GP_ERROR_CORRUPTED_DATA; ++ } + /* However, we have already just now downloaded 0x200 bytes, so + * when downloading the rest of the table we correct for that and + * just download whatever remains of the information block. diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb index 04c4786f84..5f1aba6e9c 100644 --- a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb @@ -21,6 +21,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/gphoto/${BP}.tar.xz;name=libgphoto2 \ file://CVE-2026-40339.patch \ file://CVE-2026-40340.patch \ file://CVE-2026-40341.patch \ + file://CVE-2026-120451.patch \ " SRC_URI[libgphoto2.sha256sum] = "28825f767a85544cb58f6e15028f8e53a5bb37a62148b3f1708b524781c3bef2" From patchwork Thu Nov 5 21:22:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103190 Received: from mail-dy1-f171.google.com (mail-dy1-f171.google.com [74.125.82.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6750.1793913793967425188 for ; Thu, 05 Nov 2026 13:23:14 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=jqxb/T+X; spf=pass (domain: gmail.com, ip: 74.125.82.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f171.google.com with SMTP id 5a478bee46e88-36f6295304dso296058eec.1 for ; Thu, 05 Nov 2026 13:23:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913793; x=1794518593; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nKjBxF+AK35h11noZJavVc3x40JkfNJeUKJFg/LWTkI=; b=jqxb/T+XzvbvnT04LoR3AV2U/HOQai/ZljcaC+Fpxjllx916JTCmLkK/ahALrx17NO ahWvjUE1027Te5cw5v9n3P8yNHpcE6nlnReAsBkh4AlAbkvaz3Qs6X8Yu8I0kB2pwWIY tZoY2Meh68QWFIc4Mt5aEl3mcXdwDyC3s8vzaS+EABuzeDmMeejS26p8Ayjpqy/IP9Z/ +CQDBJMNqEMEynbYfBXase8yAsO08iIWSF21eljsh9U5IOokX4fifOWFbbGZV5zI6Q65 VNGccG5CWDY2BvZBJwnbxGMsYrvPz0L86Iz7v/k/3193ed0ATMCECr47e1TJ+FS0ClLH 1U/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913793; x=1794518593; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=nKjBxF+AK35h11noZJavVc3x40JkfNJeUKJFg/LWTkI=; b=p4MSu9sUD8PSbFmepSrU6nRLX0zV1Lo+es0ji/sTchHH4Ju32J5fIVUma1hVht1Zxj enJArSWIEQGP48yyPpvOAkdIutdhe5P1VzjIgeeoDBPyq9g8A68EQXNavCFXJpxoMRC2 JnYm7qQjO4uRGWADwQ+lx8u+N4Qk08QAgr1elen9Gqg4V/u+UE/6YlQRkuK/1TmM7a0f VgkwO74GqFHcCtfTSZmflYloYkIzJMdz0Ixiepg61aVoaapaBHCIXoWqr6FlTobSuWgQ kSb95QBLSS3UGE/jQEtHb4qEwi+nRjGPBGbeOlyERXhmGdeYMk4fdgP89Wzy4ntuyLDN iH/g== X-Gm-Message-State: APuU4Z/SuQAaKV6zYKpF/4pSyy/zC7hZ9h/k+XJWzK6H8A5rMxFw+q/q Uhu1ysly2maCXqisPTdqu645ZmEGqhMjbX76X0TK2QfZ+iSfuWrkx48yfFHoSQ== X-Gm-Gg: AYBFou0F7oDkeYBvXE5RzgQ0CGnJZaFvUkd+0RaZTwPAvE2iO1hS3gst8oc4UvyXKqW 16uMe04+Kao3gg0DYuNNbQVa+F/YeVWMpyCutnsf8OyhDCTaWUNvR4TwT5OqAgm7rwaQwXMmwRN zhTspr4pYVkNAzH6UguBY1+LPR9KaGttkYXkPEBLwiHOclc2qVyPgPpaXz/zn7XdvPor7ipPZXr /kmIqwIAXQ+q8DryBYT5sZdT+C02xPm9OLm+DpmXieuDblrLQC0g+RhjgNviTVNaGSsE66rU8oW fesl9Gdtw8yjzhFoOqmjY4j/riWcbPVoQNfdasq6n18wZ6Zb7dy8cnUCBa3KKyY/0crEeKV545D c3Swz7rIKb3Mjln8+rNLVMsiP1Q2y6PeuKyp2RhJWeJIo4/ZBvhIYYbpsqL3SWFSBq6b+CVapRb 2CnawxuF68sBBitZL14ey/MUOcb+GR0771iKXozfASBi23WhKhWiSDy2t0VMDfInY9C4wwck6vg F8iOZnhann4c2RmxTQpBSyAjwIXuARTuLaf9B9CjAFYq5e+zQ3tC48W0CSK19MaCNAN+nhexaJY S/xRamgwzDMnbbbUswwYjHfD2lToIz6USE5deDLoHksA6qW8VJNxVuCtfEuirQ== X-Received: by 2002:a05:7301:da07:b0:36e:c85c:3bbc with SMTP id 5a478bee46e88-36f75254869mr504787eec.12.1793913792882; Thu, 05 Nov 2026 13:23:12 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:12 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 9/14] libgphoto2: patch CVE-2026-120452 Date: Fri, 6 Nov 2026 10:22:45 +1300 Message-ID: <20261105212250.490188-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131946 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-120452 Signed-off-by: Ankur Tyagi --- .../gphoto2/libgphoto2/CVE-2026-120452.patch | 40 +++++++++++++++++++ .../gphoto2/libgphoto2_2.5.33.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch new file mode 100644 index 0000000000..40db2a45bc --- /dev/null +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch @@ -0,0 +1,40 @@ +From 7a074672b3729925ee757eaafab6a30f0f4866e9 Mon Sep 17 00:00:00 2001 +From: TheProtagonist07 <63047129+TheProtagonist07@users.noreply.github.com> +Date: Wed, 28 Oct 2026 19:19:32 +0530 +Subject: [PATCH] jl2005c: bound thumbnail conversion by the real input length + +jl2005bcd_decompress() picks thumbnail_width/height from a device header +byte and then byte-swaps that many RGB565 samples starting at input+16. +When the device claims a 128x120 thumbnail but the input buffer is smaller, +the loop reads and writes about 30 KB past the heap buffer. + +Reject the conversion with GP_ERROR_CORRUPTED_DATA when the input is too +small. Addresses finding 3 of #1326. + +(cherry picked from commit 30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb) + +CVE: CVE-2026-120452 +Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb] +Signed-off-by: Ankur Tyagi +--- + camlibs/jl2005c/jl2005bcd_decompress.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/camlibs/jl2005c/jl2005bcd_decompress.c b/camlibs/jl2005c/jl2005bcd_decompress.c +index dff2d62..7f06a5a 100644 +--- a/camlibs/jl2005c/jl2005bcd_decompress.c ++++ b/camlibs/jl2005c/jl2005bcd_decompress.c +@@ -123,6 +123,13 @@ jl2005bcd_decompress (unsigned char *output, unsigned char *input, + GP_DEBUG("No thumbnail is present!\n"); + return GP_ERROR_NOT_SUPPORTED; + } else { ++ /* thumbnail_width/height come from a device header byte; the ++ * RGB565 payload that follows the 16-byte header must actually ++ * be large enough for that many samples. */ ++ if (inputsize < 16 + 2 * thumbnail_width * thumbnail_height) { ++ GP_DEBUG("thumbnail larger than input\n"); ++ return GP_ERROR_CORRUPTED_DATA; ++ } + out = malloc(thumbnail_width * thumbnail_height * 3); + thumb = (uint16_t *)(input + 16); + for (i = 0; i < thumbnail_width * thumbnail_height; diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb index 5f1aba6e9c..2b633ec46c 100644 --- a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb @@ -22,6 +22,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/gphoto/${BP}.tar.xz;name=libgphoto2 \ file://CVE-2026-40340.patch \ file://CVE-2026-40341.patch \ file://CVE-2026-120451.patch \ + file://CVE-2026-120452.patch \ " SRC_URI[libgphoto2.sha256sum] = "28825f767a85544cb58f6e15028f8e53a5bb37a62148b3f1708b524781c3bef2" From patchwork Thu Nov 5 21:22:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103187 Received: from mail-dy1-f171.google.com (mail-dy1-f171.google.com [74.125.82.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6751.1793913795861162838 for ; Thu, 05 Nov 2026 13:23:15 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=tV0E4/+9; spf=pass (domain: gmail.com, ip: 74.125.82.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f171.google.com with SMTP id 5a478bee46e88-36e99cf7bb3so1421979eec.0 for ; Thu, 05 Nov 2026 13:23:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913795; x=1794518595; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OC0MBZGq+nSb8g55EZk5TwW3G/NNdLuEE7oDuNqtdaA=; b=tV0E4/+9MEfENAJR39DN7KnGxx6uK7827kU+EGUYLt9ESRZLnEpN7hxXV6V20SH8YI F9ZSGh3NSY2LZIXEmdEGzFv85suRKURyX8G7rRnxa7eugtSp2j/GCYn6ZYpvXgPmaiLs ev7YwIZWDZlygSGu9+uapkr4YCeX6GVS2djZzZGiCr5InE8+ox5s65TLHbb9c8zhR8rv uMqXXpw1U6Z6o3W/jUrM11+R7x5XRKWofL6fUOTX1C2IXYw8ayaQLTIMJ1PgOcwxP/6l uo67pcE/yo9VPtXfmXxk0AReQo/3J9IYbnsXZP244CdjCJvHl2iPNB9wDnd1+B1UiXlG NnOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913795; x=1794518595; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=OC0MBZGq+nSb8g55EZk5TwW3G/NNdLuEE7oDuNqtdaA=; b=zM1GFGrRUaODKx7V9Uw/GkjYLS832gyYODY1TZLcb03HNA/Klrf127OEuvtGKbqIIA PSkqz9r5bMh0tJ44SgLznmcJxoT8fowCe4v2HI5lp76YOY/BHM7Eps6mVYKWKQqlkYN3 0qtAJ1zZ0QlNwbGEVkbkVqYGnBjcmsCZQwv90A+rTGA0UAhdztaIHwgMuYXLWhUMOkwc hXWQYA9EbCiAWHxxf6xDbGgmyzRil8SdQ1ZqZPQJ9JaMRRHdNGBC9Ve7Wb5hSJ883JrR OgoopqE7Ibgu50uhQQUB55UQMNbO4/FKBxlRmQfPfZxyB/cVvHnTvdqxpC8BWDa/W7Or DVhg== X-Gm-Message-State: APuU4Z9+S2cY5fcoajHkjtPRPn5aYSEJtofXFMdU/Cp9+bT6lgcFakrE 9HGMBQZ8CDWxgudv9W/0SCTX2qkpvSEKumvAGW9Cu1TweIKYYhOy+F30ILvB3A== X-Gm-Gg: AYBFou2Rc/pJnC7S1DCPrzjPxqkCxVubaZfkwZAa4g4BQZ9NudaJmwIRdI+5DYHYn6S ZS4tSDxCe+W+6rZm47Xfh4dTpNpsTWfrLoTJfL4hCD+/1O7Odb4vTGQXtc5OEdcLdfIVJ+oPZYp 66pM3jZsqvVwAN/vrByGBw5nEcufsW/jLhwBlZD8IQcoJ4060vcDCUNTa2HEWRaMD5W3MAFHd/Q jOdchIfuD9EVfeAzZ3aGc73rpxtpN5dBsQSeZVmDTvtEWmdCgi5sIZwvIkEFsUM7XPE7lYcLUr6 6U4f9N9BHDC85BxteAx4i3thXmGx+467/yBENVKKqujQwBPOLxcure63Nor6M5oVxRuDJ3dUxX/ pNijP7XdUpgf4/i60cG5jaFHJl3iTGMn9RZrzB2wOaQypozuyVhcnm9p5oMtCP1eowJNKubYlAC Iob2MEJxtbTX6T6ti4OrlkF8/zm2oIaU6fMbeTxQ5a+mzxxOeYjLXvM+lelP4BS9ApzdNpCE9+N V3ppnUeYgFGU0xLXoDMi/XBNbzbwsYJ0pApzqUmeWp5E1+UMalWWFSGxNF/I+QZfQSrbNg11GJB /Uyz2Z5OHWjgwG6S31kdSAZ1zW/zwxiM7jUidi+ODSn3A0e13fqehrcpn0OYvqBnKSQkv/qjHcC C3GqOOZ2Z+w== X-Received: by 2002:a05:693c:2a0b:b0:36d:d7ec:5e3d with SMTP id 5a478bee46e88-36f772f8940mr470367eec.21.1793913795083; Thu, 05 Nov 2026 13:23:15 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:14 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-oe][wrynose][PATCH 10/14] smarty: upgrade 5.8.4 -> 5.8.5 Date: Fri, 6 Nov 2026 10:22:46 +1300 Message-ID: <20261105212250.490188-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131947 From: Ankur Tyagi Changelog: https://github.com/smarty-php/smarty/releases/tag/v5.8.5 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 3fe4c2247419cbe376ad010e2e56536bec3faab0) Signed-off-by: Ankur Tyagi --- .../recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} (96%) diff --git a/meta-oe/recipes-support/smarty/smarty_5.8.4.bb b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb similarity index 96% rename from meta-oe/recipes-support/smarty/smarty_5.8.4.bb rename to meta-oe/recipes-support/smarty/smarty_5.8.5.bb index 0c1487f1df..9fabef958e 100644 --- a/meta-oe/recipes-support/smarty/smarty_5.8.4.bb +++ b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb @@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2c0f216b2120ffc367e20f2b56df51b3" SRC_URI = "git://github.com/smarty-php/smarty.git;protocol=https;branch=master;tag=v${PV}" -SRCREV = "94a27cbbc7820198d7adc17a2be8d457fb267753" +SRCREV = "0ae663525dcbc9e996feb2a867e43bc85f960938" INHIBIT_DEFAULT_DEPS = "1" From patchwork Thu Nov 5 21:22:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103188 Received: from mail-dy1-f174.google.com (mail-dy1-f174.google.com [74.125.82.174]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6753.1793913798051122750 for ; Thu, 05 Nov 2026 13:23:18 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=TcE0ajHO; spf=pass (domain: gmail.com, ip: 74.125.82.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f174.google.com with SMTP id 5a478bee46e88-353804b591eso4458931eec.0 for ; Thu, 05 Nov 2026 13:23:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913797; x=1794518597; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=YYs0YTX3ACuvTvvG7h3lurK1wzpL0jUs1l5a2Uu7sN0=; b=TcE0ajHOqeUVmIcYbY/gU1TO2K0hJHzQrsu6xfdR+VJCry+gHuHzoz0Vb/94qZCJcE lNmL3OnOyCvUiGT+1L+HK4C+ZAYNe7iOthd0vkpP9bJp0yYPmHuKop7l2cjY+pwKXqk4 WSn1NrpcflVQ1VMi6oJBmlqJYCZodm6K8UHNe495PSE62alIiQVKDXJEf0gG/ChNc1K7 tOKWTeEsInhbJOXZS6b5HyGfr21/aj3HUs1zN43W4XOPRdtofyUoSgJfbIfHh/bRNjk7 MY/3js2QX5ZlwFb37Kk0Km5DjaYJXxCatiWcqErM7+OWFkFPXcdKs9/0tPEojf6pulIz mdAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913797; x=1794518597; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=YYs0YTX3ACuvTvvG7h3lurK1wzpL0jUs1l5a2Uu7sN0=; b=bw/Q1OkzpR2pqUQvrdD4IvSH1TqPJ4JCsghLxKhP8/n64KKmOiLTHbpm0KfGAVD13f Wk+uST4/R0fPv/gKzSFWsxYF8Bd2pccOnRQhALrAzwQWSZPgMxye/ZCX8PDVqJX81ARP 4wnQc3S8iGUkseOZvldR982gcG8I35RSvqIPu1GnmQeJHdUSST+r+6yMB6RjlNF57Yx1 lS0V/CY3UwcVrOmt/VWmxvyrQh5rDNCbrFGrENQ5gaYyW5bZ0v36bl4lSSOxAhTKXlLl /P+Tqx78b3CeloWn5Xr20iUXTFQj20IxJki/vEPC1U+TUfj9xfcj1C80suGIhKncRMpw Zgzw== X-Gm-Message-State: APuU4Z+LAX8lxjEWFeGidshI/iDwkxI2svCBerALY7zPily7L3KPGerY 0UM3+nr8frLd1mWlkHTPZt+pTToNtzIvUXyocmBBuNp9k+oKD/bFq8yanwy+9A== X-Gm-Gg: AYBFou1L0/G4MCi9HhkhQkR3J3gCuEXR8DTrGggAadMAZ1fqw9Lhikh5hwD2+dc/FJa /qTkG36hOSt7m9wwZNzpF69BGDlv04B7LXECqRbKM/+b5s/hx+GjhtFKfhTMMXVipKmZ/rE0B28 oj+G+MZcmZjZbIHuOKKiMzwNq3dQ2b2UEoS5DLg66DpwDbSMqX79mAgWDrx8dPbYWsspNnNt7XV QUehAQqBUiloKE22/4ND3HVatHGVYO0XMWCgz+OAb5uoKHXCBYGHrPA0oe7n7y8vk8fgX+dCk9w Z8TWoQJuDeeBPnhmN6lXJfvkU/z4kaopqRbA8bEOId8vNXyN3a1lXqvCQFGjyY9gDG3E9CLUi5a ceOD56joA8dlZfPRULFmXNLCTmDlhw86B045WhYNMFV0hX40pQNdNKfNSMaJHntnihk88ZsOO6o bHHH9APkVVtwIprXl8gf4RbNifokTi9FsdM9l8HCyn7ofn2lx5weaRUqfmN9Tz+m1YiKt19NamC aWIBxoj9P7HRiJWE/qx2QDxl2fpYgp2GkOZziVCOlj4lupLNe1TwMFTzwOnoU+BOK9C8sWNpwuk t7wJKy2k4qCn32hLuwrKwioGUhXQrU0N6sg4AGO/hANqNwRXOuAyqJ7A73Fl0Q== X-Received: by 2002:a05:7301:251b:b0:36a:1e0a:accb with SMTP id 5a478bee46e88-36f7631c69amr483757eec.35.1793913797110; Thu, 05 Nov 2026 13:23:17 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:16 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 11/14] valkey: upgrade 9.0.6 -> 9.0.7 Date: Fri, 6 Nov 2026 10:22:47 +1300 Message-ID: <20261105212250.490188-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131948 From: Ankur Tyagi Changelog: https://github.com/valkey-io/valkey/releases/tag/9.0.7 Signed-off-by: Ankur Tyagi --- .../valkey/{valkey_9.0.6.bb => valkey_9.0.7.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-extended/valkey/{valkey_9.0.6.bb => valkey_9.0.7.bb} (98%) diff --git a/meta-oe/recipes-extended/valkey/valkey_9.0.6.bb b/meta-oe/recipes-extended/valkey/valkey_9.0.7.bb similarity index 98% rename from meta-oe/recipes-extended/valkey/valkey_9.0.6.bb rename to meta-oe/recipes-extended/valkey/valkey_9.0.7.bb index d31a5dbfe5..10a8eec507 100644 --- a/meta-oe/recipes-extended/valkey/valkey_9.0.6.bb +++ b/meta-oe/recipes-extended/valkey/valkey_9.0.7.bb @@ -15,7 +15,7 @@ SRC_URI = "git://github.com/valkey-io/valkey.git;branch=9.0;protocol=https;tag=$ file://0001-src-Do-not-reset-FINAL_LIBS.patch \ file://GNU_SOURCE-7.patch \ " -SRCREV = "a100149d56208209c03f8af9840afe2efa7fb8d1" +SRCREV = "fe8d406c0b5a64ec897f6455e4de684629883764" RPROVIDES:${PN} = "virtual-redis" From patchwork Thu Nov 5 21:22:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103186 Received: from mail-dy1-f173.google.com (mail-dy1-f173.google.com [74.125.82.173]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6640.1793913800195311484 for ; Thu, 05 Nov 2026 13:23:20 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=MbdQKVLN; spf=pass (domain: gmail.com, ip: 74.125.82.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f173.google.com with SMTP id 5a478bee46e88-3535a54bed9so3138407eec.1 for ; Thu, 05 Nov 2026 13:23:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913799; x=1794518599; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=j3LhxCRDW7ejRhMafqTS44jzjbnZZdEr+g85gFvYhac=; b=MbdQKVLNLZXRMuugZUUFTozIM9qbsQ/nT57khYPjaYkqK/Q33/+nCtqXiHqDlEIdu6 SidC9OTk8ckmLgMWTaQq/Dwm3Wi0LlgcLwvx+qG68hKS6xWX1rzCG+/IY5ze6FAFnv08 1YE+yrjHgqM/ZXjW7UOHFo8Qo2KB0DwfWdPz7OQNw0ZPeWUR+ZaDawIa0HtZoa91oF7Q +InegP6O/DtOhC/lINhxZyb1cKbKAIOhJFdxjogeD8+uHV75bB7W/7BYS2/eHbB/C7WO vCfMgQzdoLoy0jXkcIS1c4w+8ZUFmmW4RarChHdcPE1u44nUhbVdLbaES/MGB7wUX30u KWoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913799; x=1794518599; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=j3LhxCRDW7ejRhMafqTS44jzjbnZZdEr+g85gFvYhac=; b=mnT+TT4PeEnMNfoBtjRnMYMnGP51RLnyiHZdOm4R7sa0T8xgoeFsaJmKNDdPXsGuV+ 6fkW1CPEoFitDWi1eeYrTcv2HV4CtSq63RMsb4Y3q3i3LZpaxrN77Cw8f6IVXep58U8I dDW9XoyaMXnwmX6Wz/hK5PNCqV6MieGTzq9a08l76hUb2fG03DxuworjhojrQwryvPWm jViJee+q5xvc6ijvt13olfK6F5zlpc4nwh6I55HmECX9ZkIhVVOcEmuP1LM1Ygt3Jtv6 6fvFjHDog2RjIv84qc8c+sHmEnDBaRM5TVPOuXU+uQIzghx5HHLu4TqDxEhR+wec50Y/ wrLA== X-Gm-Message-State: APuU4Z/IcJ5bXLvU7Xzf+pOOw7hpFd+n1ScaCWWkUC0R1MDJ6OmIMoKA IrGU9fkUesFt//byLZZK4mvPd08vZqGify5T7a6yd8pSyw4ggIdTeLFBWyWtEg== X-Gm-Gg: AYBFou0sURJbH12n7JGAwYfUVSboMGL4Jm8bQLyLuc1lj5Rv2JzP0stXkKSgCUjUowH hfNkFzG+fus3Tx2hxzW24QbDh/tApLJoB00fUJAa8kN4ska0MUN1FHXVER49lo82MOvg5bLjugN fbZl5YDkWKqDANvkImIm9oy9nylEGZw5NhJrjpAkqSwryTAgl0AlOD0zCGjpRknYL8uBuYPDydR XOJEhVXEQJWAwHJn1GZEPdNLXfTPmO3H+i8/tbFeK9spPk9gv8IgIv6hPiLVZ3Txwj3EO/ht6uG pbuToOhTxEDfW02l8/2j306srsvo2LkQo2132eGbFvJQZaIjmvX41cqFrYQHjVnC+aajKJNCDPx 0kBfs8xd2kTCQbRerLyXuGksCudY+4ict4EMuW6SlLSeXcxtcX1U0WhvW10aU8Ydw8FtaZTjHLq GkDrytPYaF11Xml+Rz+iu8RTb5q/J+mUrt2O8wjq30PFBRBXT/vUl+uO9Z11CFxSFnIicaNiHX8 dgCTlhQf7WW/r0lq5bX3rvdK50zyoGBSZAaD3y7CPjQQjLMoIZZOn76bpJPYZ15W7MKyWFQNWqR ts+Eaod7Gzwffj3jjEnJiY3DEv/oxROQd8BtWOYvU8Tf7XACR5UZ3r4rk7Ss5w== X-Received: by 2002:a05:693c:8842:b0:369:535f:4d12 with SMTP id 5a478bee46e88-36f729cf093mr595020eec.3.1793913799379; Thu, 05 Nov 2026 13:23:19 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:19 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 12/14] uriparser: upgrade 1.0.2 -> 1.0.3 Date: Fri, 6 Nov 2026 10:22:48 +1300 Message-ID: <20261105212250.490188-12-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131949 From: Ankur Tyagi Changelog: https://github.com/uriparser/uriparser/blob/uriparser-1.0.3/ChangeLog Signed-off-by: Ankur Tyagi --- .../uriparser/{uriparser_1.0.2.bb => uriparser_1.0.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-support/uriparser/{uriparser_1.0.2.bb => uriparser_1.0.3.bb} (91%) diff --git a/meta-oe/recipes-support/uriparser/uriparser_1.0.2.bb b/meta-oe/recipes-support/uriparser/uriparser_1.0.3.bb similarity index 91% rename from meta-oe/recipes-support/uriparser/uriparser_1.0.2.bb rename to meta-oe/recipes-support/uriparser/uriparser_1.0.3.bb index d4be4b14c8..3eb4635fa3 100644 --- a/meta-oe/recipes-support/uriparser/uriparser_1.0.2.bb +++ b/meta-oe/recipes-support/uriparser/uriparser_1.0.3.bb @@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://src/COPYING;md5=fcc5a53146c2401f4b4f6a3bdf3f0168 \ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${BP}/${BP}.tar.gz \ file://run-ptest" -SRC_URI[sha256sum] = "963554c32d40fb6cba5644f1ba63e6dd7a182b2948bd71ee448c532f53b07f1e" +SRC_URI[sha256sum] = "b5014a630e61e085787f760c83675a35ef8e719972b05e8f61ff2f48692b15dc" inherit cmake github-releases ptest From patchwork Thu Nov 5 21:22:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103191 Received: from mail-dl1-f53.google.com (mail-dl1-f53.google.com [74.125.82.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6641.1793913802275835547 for ; Thu, 05 Nov 2026 13:23:22 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=qZT48VFb; spf=pass (domain: gmail.com, ip: 74.125.82.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dl1-f53.google.com with SMTP id a92af1059eb24-1b244fb7fffso44183c88.1 for ; Thu, 05 Nov 2026 13:23:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913802; x=1794518602; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Wu64f+fIPEqDX7N2tuAJghxYWBq+Kh019JW4Y+0CK1Q=; b=qZT48VFbm+JcsIj2iIF0iDoa4ieRjCpzeoojh+o+ORFH8rXoikvFT03fIV8cul27CF 4Ndltul7sUOhaH5wDMq8H/vjq5gpiDICcKblLe0ujnsiMp/xv7Y7p1s5SCE2qyphr6yL N168npcUa2kYdNxtCLGp5ulbYNT2iOP/cwUDYeC29tQRC4oRVVHoh1I3W/82qGJ4UFVk r2ewVglobon1hAPFsr/gCPfC+5XObE7uHI0L2X9s6f0q0pElmD/IzKVTe7hhbBQgWS+l pDBpWG6q/Ug0Ima4ZGNoWdl3KlhyzOxeaj+/D8D9o0gUXNEihmJEbXn3dhgmuEUV3vci Fgiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913802; x=1794518602; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Wu64f+fIPEqDX7N2tuAJghxYWBq+Kh019JW4Y+0CK1Q=; b=k8ad+aGZEU0Zjq15WH2cLjO+dc+0uImUZ1zlRoiz2l8ve5WdBMx+z6gch5NQtJwe4c qu/OK9PKcC21+jtVaDamdPrXsR0eVvBX0gtREfQRm1t50b7UrnoCobaapVxtkf/l9b9+ pcJdl3gD3CtliemxuYR+IR6xT8AbGubTr2iMW9QbCAt2FYMb/mOzBjbiVcoXsdt5mbKn XZfvqCBAkZUXaUKGNkAVCROidLMm1n3v6f5ozskZ99PK7Jw/y87Fd6KyOZQ/saVIX2Mf NqEpdoxr0ai591KXm+bi2kuOddNlbDR+tQS3APsAyLdmqnU5f86tXnR0o8ENJp4zeitS MXuw== X-Gm-Message-State: APuU4Z8PVJWvPUT1eukchNg+1WepoD6LL/GZaEzHVmlFOYUCse7htuRy z4Gu0DIs5pOhq7wXQL7z/wUX7Y/ZOdnBnGmyuV5du8oe+PZyqKhieF6DmXhUpw== X-Gm-Gg: AYBFou3RzxUaz+pHbMnzE/CDINF05jSD+U4VUP2d6rH78ES0qpuFZj8662FOYgfcQAw 4GlAnB9spsvejviFlJT1Rm24oDKjmWjaP0ce5H7WW6v4k2SnvCoba3ev5ttaWEI6XJLKn5EI3G5 k2/gVxH7ICnY4E9Ly3diIbksjK5/Ybodh/gMdHIP1PT92EbLo4BpyISghrwCs3VTgT37KlDLYdh NbI1QL1HGjLnrp0cTHOVPXfbC2X5+7QkJss1wQ4IJuM0652gt/Uvt1Mk9ClQtO9ffl9pQw7z8Sj 67qnrJBN5IqJx2nJ/TXAizcsdjDcImB89pHSNIOCaG8xJfpOYRFcfyAnxqoLzp93Xi73zOzJxKo a63GEUSj4FACl/A2IUmjB2jKeYfXnxIz4pP2lRmDJ98+16X11jwoup49N2sJsaNkLbWor6/zQRY WZAHskjexCr0XrU2EybabsN2MzXrfqDsWamd8AxB7PBA//YmtkvTJFKNhlZn/kQdN81Lx1BgYEP dVVbz4xQusXCcT+SlZLlSuupOwrhr69OJrVF4uKj234bn718fF3fWYOvoPzMVJ+H7zDzMujbhuh C9TcTprg+uHrZL0mMAdfSwrA+RoOhwlvruYykCi71sAd1IWr8TrXtq7Vyye3rDfRuxh6Yg6tkwX ZoYlVYUU= X-Received: by 2002:a05:701b:428c:20b0:151:2e62:fe8a with SMTP id a92af1059eb24-1b25d395b70mr301932c88.40.1793913801302; Thu, 05 Nov 2026 13:23:21 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:20 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][wrynose][PATCH 13/14] python3-django: upgrade 6.0.9 -> 6.0.10 Date: Fri, 6 Nov 2026 10:22:49 +1300 Message-ID: <20261105212250.490188-13-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131950 From: Ankur Tyagi Changelog: https://docs.djangoproject.com/en/dev/releases/6.0.10/ Signed-off-by: Ankur Tyagi --- .../{python3-django_6.0.9.bb => python3-django_6.0.10.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-django_6.0.9.bb => python3-django_6.0.10.bb} (79%) diff --git a/meta-python/recipes-devtools/python/python3-django_6.0.9.bb b/meta-python/recipes-devtools/python/python3-django_6.0.10.bb similarity index 79% rename from meta-python/recipes-devtools/python/python3-django_6.0.9.bb rename to meta-python/recipes-devtools/python/python3-django_6.0.10.bb index f4e29dc645..46b02a57ef 100644 --- a/meta-python/recipes-devtools/python/python3-django_6.0.9.bb +++ b/meta-python/recipes-devtools/python/python3-django_6.0.10.bb @@ -1,7 +1,7 @@ require python3-django.inc inherit python_setuptools_build_meta -SRC_URI[sha256sum] = "8ce037c971f421cfb47d38c097ca233a8f6dd42d9e9501a37e02dd7d08c5cb3f" +SRC_URI[sha256sum] = "6005d030df924f85088454c18bd35dcf082b058aa355ad3df520d8de9aef9f41" SRC_URI += "file://0001-Revert-Bumped-minimum-setuptools-version-to-83.patch" # Set DEFAULT_PREFERENCE so that the LTS version of django is built by From patchwork Thu Nov 5 21:22:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103192 Received: from mail-dy1-f170.google.com (mail-dy1-f170.google.com [74.125.82.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6644.1793913804194742942 for ; Thu, 05 Nov 2026 13:23:24 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=CHNDlMM1; spf=pass (domain: gmail.com, ip: 74.125.82.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-dy1-f170.google.com with SMTP id 5a478bee46e88-3535a54bed9so3138497eec.1 for ; Thu, 05 Nov 2026 13:23:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793913803; x=1794518603; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=w95POYmQZEf0KpMriEhmkm8OvcFFA0SoZ3QLQ9rWgTA=; b=CHNDlMM1lo6MyJ5w0BUTrbKXvJ5z/ttP9sFS0sXv9N/ppJXq6hAI6JQzyXkAVbR3pX CBl0u7EobxOITzbHb8voJ4scSpD28GMJ4g7O51wwbj/7u06+AYRLhUF+4UX80QTM6i3j pKBzvY2ivkJTK9+DlMzToFI8CAZCBQ7bx9Gj37S5jWC/j7GXz2DGCFadaKEZM/I8m9E2 pnQ4ZZcU8TAYBu3un+UbXcaijPtsH0WQbuPYaE8/DDlW7KhHcEgWyT+5EtJsLoW+0+h5 0L+Dm0s3PxcGpYcNAJVn5/nGKnGC+Wngb0RG3/GbHePFbpTkLzq2Q+NMF92qAEy3EsqV asxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793913803; x=1794518603; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=w95POYmQZEf0KpMriEhmkm8OvcFFA0SoZ3QLQ9rWgTA=; b=UlW3hw1pCg623S0rcAvhCinVgnu/GpFJkoxAkyxRu2fOGeArYIzCQAwt4r86VC+GxZ DPgnNlVjs02f7rAO7EcsvZs/7laIZbdbGYnGwLyqDc24ntybH+A4fBVwb+JLc8fht0R5 Gd11FfqIZwjsMGGRdCu0l3mLfy4GLAX4NjLiHtIab5x7HLNjTFodKUV+I7Xq+9wkkb02 P42mskwt3MSFUtvRKy+BrzBPNRv8TVAVKK8Xt5cn2CO/tDdIGj1jd9lfZnyPWnbg37rO kEykipvCq48I6XwSpwoefKwMJy5m1jHQ7ejDWI/fAl0MjKSHbuLTmOv6D79arh/oMowC u6tg== X-Gm-Message-State: APuU4Z89tpuvzfilkhs+sdE3LPyyf57U26DEifmzmDyAnfF2STQzHey1 5OwnRepMcDrO4vfXxs9OvsH0e3UOVND+uv5K3lsNbg7iELahKRZuh//T8fQpZw== X-Gm-Gg: AYBFou3+OE17AiHPykRuxpcPHVrVa9iZCg9M7/43+wzUgLpK94SMFb54HTZ90L8Xfxt P0tfXKr9KM7+7SfcyyAEijv6/7Wl+2EU4VAFE8MY7hQ38ndPK98UTb7FFzbROaLUTyKPJ31OuLM w0HxEZ4f/c2BB/93NKHw1nR/wR1pPMn+M9P7MvaTttD+xaiyno/vA2oFsteQGtb0QY2ozGuxjF4 1usg8/v8jIfmU9pZ+EpWksu9jWEeKzhfBrmSSElw7d+zreEc9U68BpMDTVw/18bHTYWf14qrSuf 3lbv+5tTFRn8W2E8W8VMp8541kMm1o2jfUPz0V95JMCoPAovcKdprwcbW0ovH5dXIdOYDcEK2dr 7vq+4aU3dFVEk9el1se8wUgaTDinmIwq2voDlCHI8fwiBNcWnxDr9uiL9OPXCvGdwQ1ZzozXtBH 8PPvZpmB5YL/yB5yywBUqXG8Ni+/t6w8eKwo/H5VcFl+Iv8WJiN133d7v1bEQryltDKZk+62c6U q/DuqibxDOaDW62E9TcgL4nScGOX6ldxvH/XpDKlY1WT/D6EmKXlaWxN77zui3OhfOyZygiLz0E ITr8YJhLuv2TIGrzBKIjmu8+p3shJz1pF0/l2rKRBs49ufUGzOtIlkDjU2GCgQ== X-Received: by 2002:a05:7301:db88:b0:369:f9b6:f486 with SMTP id 5a478bee46e88-36f773fb044mr460924eec.41.1793913803303; Thu, 05 Nov 2026 13:23:23 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36f71a25da0sm1034059eec.24.2026.11.05.13.23.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 13:23:23 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][wrynose][PATCH 14/14] python3-django: upgrade 5.2.18 -> 5.2.19 Date: Fri, 6 Nov 2026 10:22:50 +1300 Message-ID: <20261105212250.490188-14-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261105212250.490188-1-ankur.tyagi85@gmail.com> References: <20261105212250.490188-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 21:23:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131951 From: Ankur Tyagi Changelog: https://docs.djangoproject.com/en/dev/releases/5.2.19/ Signed-off-by: Ankur Tyagi --- .../{python3-django_5.2.18.bb => python3-django_5.2.19.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-django_5.2.18.bb => python3-django_5.2.19.bb} (70%) diff --git a/meta-python/recipes-devtools/python/python3-django_5.2.18.bb b/meta-python/recipes-devtools/python/python3-django_5.2.19.bb similarity index 70% rename from meta-python/recipes-devtools/python/python3-django_5.2.18.bb rename to meta-python/recipes-devtools/python/python3-django_5.2.19.bb index 4e3d0b431d..46c1cca1fa 100644 --- a/meta-python/recipes-devtools/python/python3-django_5.2.18.bb +++ b/meta-python/recipes-devtools/python/python3-django_5.2.19.bb @@ -3,4 +3,4 @@ inherit python_setuptools_build_meta SRC_URI += "file://0001-fix-test_msgfmt_error_including_non_ascii-test.patch \ file://0001-pyproject-lower-setuptools-requirement.patch" -SRC_URI[sha256sum] = "461c5dd06d2ea16bd5ca37d3f46e4def1d6b0fe7588c6f4e2119517bb0af8b2d" +SRC_URI[sha256sum] = "ad03d8abc51dbff95ebf34b27123cf0c26a3b62db7ba0cd520783686362533d1"