mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-14 03:57:15 +00:00
Code Issues Projects Releases Wiki Activity

libgphoto2: patch CVE-2026-120452

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120452

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Anuj Mittal committed 2026-11-09 09:10:44 +05:30
1 parent 9d29072b9c
commit 191a178028
2 files changed
+41
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120452.patch
+40
View File
@@ -0,0 +1,40 @@
From 7a074672b3729925ee757eaafab6a30f0f4866e9 Mon Sep 17 00:00:00 2001
From: TheProtagonist07 <63047129+TheProtagonist07@users.noreply.github.com>
Date: Wed, 28 Oct 2026 19:19:32 +0530
Subject: [PATCH] jl2005c: bound thumbnail conversion by the real input length
jl2005bcd_decompress() picks thumbnail_width/height from a device header
byte and then byte-swaps that many RGB565 samples starting at input+16.
When the device claims a 128x120 thumbnail but the input buffer is smaller,
the loop reads and writes about 30 KB past the heap buffer.
Reject the conversion with GP_ERROR_CORRUPTED_DATA when the input is too
small. Addresses finding 3 of #1326.
(cherry picked from commit 30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb)
CVE: CVE-2026-120452
Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
camlibs/jl2005c/jl2005bcd_decompress.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/camlibs/jl2005c/jl2005bcd_decompress.c b/camlibs/jl2005c/jl2005bcd_decompress.c
index dff2d62..7f06a5a 100644
--- a/camlibs/jl2005c/jl2005bcd_decompress.c
+++ b/camlibs/jl2005c/jl2005bcd_decompress.c
@@ -123,6 +123,13 @@ jl2005bcd_decompress (unsigned char *output, unsigned char *input,
GP_DEBUG("No thumbnail is present!\n");
return GP_ERROR_NOT_SUPPORTED;
} else {
+ /* thumbnail_width/height come from a device header byte; the
+ * RGB565 payload that follows the 16-byte header must actually
+ * be large enough for that many samples. */
+ if (inputsize < 16 + 2 * thumbnail_width * thumbnail_height) {
+ GP_DEBUG("thumbnail larger than input\n");
+ return GP_ERROR_CORRUPTED_DATA;
+ }
out = malloc(thumbnail_width * thumbnail_height * 3);
thumb = (uint16_t *)(input + 16);
for (i = 0; i < thumbnail_width * thumbnail_height;
meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.33.bb
+1
View File
@@ -22,6 +22,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/gphoto/${BP}.tar.xz;name=libgphoto2 \
file://CVE-2026-40340.patch \
file://CVE-2026-40341.patch \
file://CVE-2026-120451.patch \
file://CVE-2026-120452.patch \
"
SRC_URI[libgphoto2.sha256sum] = "28825f767a85544cb58f6e15028f8e53a5bb37a62148b3f1708b524781c3bef2"