mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-23 11:21:11 +00:00
Code Issues Projects Releases Wiki Activity

giflib: Fix CVE-2026-26740

Browse Source 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-26740
[2] https://ubuntu.com/security/CVE-2026-26740

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Vijay Anusuri
2026-09-01 06:57:07 +05:30
committed by Anuj Mittal
parent 6bb11ad0c3
commit 2e49cdb4d2
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/giflib/giflib/CVE-2026-26740.patch
+40
View File
@@ -0,0 +1,40 @@
From 061605081115bbfd7019bafc119a13b6f17fcf25 Mon Sep 17 00:00:00 2001
From: Anthony Hurtado <amhurtado@protonmail.com>
Date: Mon, 1 Jun 2026 15:40:48 -0500
Subject: [PATCH] Fix CVE-2026-26740: heap OOB write in EGifGCBToSavedExtension
EGifGCBToSavedExtension calls EGifGCBToExtension which unconditionally
writes 4 bytes into ep->Bytes without checking ep->ByteCount. If the
extension block was allocated with fewer than 4 bytes, this results in
a heap buffer overflow.
The read-side counterpart DGifExtensionToGCB already validates that
GifExtensionLength == 4 before reading. Add the symmetric check on
the write side: return GIF_ERROR when ep->ByteCount < 4.
Signed-off-by: Anthony Hurtado <amhurtado@pm.me>
Upstream-Status: Backport [https://sourceforge.net/p/giflib/code/ci/061605081115bbfd7019bafc119a13b6f17fcf25]
CVE: CVE-2026-26740
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
egif_lib.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/egif_lib.c b/egif_lib.c
index 1526868..8160560 100644
--- a/egif_lib.c
+++ b/egif_lib.c
@@ -678,6 +678,9 @@ int EGifGCBToSavedExtension(const GraphicsControlBlock *GCB,
ExtensionBlock *ep =
&GifFile->SavedImages[ImageIndex].ExtensionBlocks[i];
if (ep->Function == GRAPHICS_EXT_FUNC_CODE) {
+ if (ep->ByteCount < 4) {
+ return GIF_ERROR;
+ }
EGifGCBToExtension(GCB, ep->Bytes);
return GIF_OK;
}
--
2.43.0
meta-oe/recipes-devtools/giflib/giflib_5.2.2.bb
+1
View File
@@ -12,6 +12,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.gz \
file://0001-Makefile-fix-typo-in-soname-argument.patch \
file://CVE-2026-23868.patch \
file://CVE-2025-31344.patch \
file://CVE-2026-26740.patch \
"
SRC_URI[logo.sha256sum] = "1a54383986adad1521d00e003b4c482c27e8bc60690be944a1f3319c75abc2c9"