mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-25 17:32:06 +00:00
Code Issues Projects Releases Wiki Activity

giflib: Fix CVE-2026-26740

Browse Source 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-26740
[2] https://ubuntu.com/security/CVE-2026-26740

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Vijay Anusuri
2026-08-18 14:49:43 +05:30
committed by Khem Raj
parent 5b4d5deac5
commit 385c728e8f
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/giflib/giflib/CVE-2026-26740.patch
+40
View File
@@ -0,0 +1,40 @@
From 061605081115bbfd7019bafc119a13b6f17fcf25 Mon Sep 17 00:00:00 2001
From: Anthony Hurtado <amhurtado@protonmail.com>
Date: Mon, 1 Jun 2026 15:40:48 -0500
Subject: [PATCH] Fix CVE-2026-26740: heap OOB write in EGifGCBToSavedExtension
EGifGCBToSavedExtension calls EGifGCBToExtension which unconditionally
writes 4 bytes into ep->Bytes without checking ep->ByteCount. If the
extension block was allocated with fewer than 4 bytes, this results in
a heap buffer overflow.
The read-side counterpart DGifExtensionToGCB already validates that
GifExtensionLength == 4 before reading. Add the symmetric check on
the write side: return GIF_ERROR when ep->ByteCount < 4.
Signed-off-by: Anthony Hurtado <amhurtado@pm.me>
Upstream-Status: Backport [https://sourceforge.net/p/giflib/code/ci/061605081115bbfd7019bafc119a13b6f17fcf25]
CVE: CVE-2026-26740
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
egif_lib.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/egif_lib.c b/egif_lib.c
index f1141a2..d74e8df 100644
--- a/egif_lib.c
+++ b/egif_lib.c
@@ -690,6 +690,9 @@ int EGifGCBToSavedExtension(const GraphicsControlBlock *GCB,
ExtensionBlock *ep =
&GifFile->SavedImages[ImageIndex].ExtensionBlocks[i];
if (ep->Function == GRAPHICS_EXT_FUNC_CODE) {
+ if (ep->ByteCount < 4) {
+ return GIF_ERROR;
+ }
EGifGCBToExtension(GCB, ep->Bytes);
return GIF_OK;
}
--
2.43.0
meta-oe/recipes-devtools/giflib/giflib_6.1.3.bb
+1
View File
@@ -9,6 +9,7 @@ DEPENDS = "xmlto-native"
SRC_URI = "${SOURCEFORGE_MIRROR}/giflib/${BP}.tar.gz \
https://sourceforge.net/p/giflib/code/ci/d54b45b0240d455bbaedee4be5203d2703e59967/tree/doc/giflib-logo.gif?format=raw;subdir=${BP}/doc;name=logo;downloadfilename=giflib-logo.gif \
file://CVE-2026-26740.patch \
"
SRC_URI[logo.sha256sum] = "1a54383986adad1521d00e003b4c482c27e8bc60690be944a1f3319c75abc2c9"