From 413d02b30eae6601a91dea28d013217110039c07 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Wed, 2 Sep 2026 22:04:55 +1200 Subject: [PATCH] editorconfig-core-c: patch CVE-2026-40489 Details: https://nvd.nist.gov/vuln/detail/cve-2026-40489 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../editorconfig-core-c/CVE-2026-40489.patch | 39 +++++++++++++++++++ .../editorconfig-core-c_0.12.9.bb | 4 +- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch diff --git a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch new file mode 100644 index 0000000000..e328052314 --- /dev/null +++ b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch @@ -0,0 +1,39 @@ +From 4d5fcd42739f0ae349efe4e9208c0f109bb7c141 Mon Sep 17 00:00:00 2001 +From: Hong Xu +Date: Tue, 14 Apr 2026 23:11:39 -0700 +Subject: [PATCH] Merge commit from fork + +Completes the buffer-overflow fix from #87, which bounded writes into +`pcre_str` but left the initial `strcpy` of `pattern` into `l_pattern` +at the top of `ec_glob` unguarded. Sufficiently long patterns smash the +stack before any of the bounds-checked code runs. + +Fix CVE-2026-40489 + +(cherry picked from commit 5159be88ad50641d9843289adda791ba300421ff) + +CVE: CVE-2026-40489 +Upstream-Status: Backport [https://github.com/editorconfig/editorconfig-core-c/commit/5159be88ad50641d9843289adda791ba300421ff] +Signed-off-by: Ankur Tyagi +--- + src/lib/ec_glob.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/lib/ec_glob.c b/src/lib/ec_glob.c +index d36076d..0e7f7ac 100644 +--- a/src/lib/ec_glob.c ++++ b/src/lib/ec_glob.c +@@ -96,8 +96,12 @@ int ec_glob(const char *pattern, const char *string) + _Bool are_braces_paired = 1; + UT_array * nums; /* number ranges */ + int ret = 0; ++ size_t pattern_len = strlen(pattern); + +- strcpy(l_pattern, pattern); ++ /* Reject patterns that would overflow l_pattern in the copy below. */ ++ if (pattern_len >= sizeof(l_pattern)) ++ return -1; ++ memcpy(l_pattern, pattern, pattern_len + 1); + p_pcre = pcre_str + 1; + pcre_str_end = pcre_str + 2 * PATTERN_MAX; + diff --git a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb index 319c1724c0..8d182d0cd0 100644 --- a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb +++ b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb @@ -4,7 +4,9 @@ SECTION = "libs" LICENSE = "BSD-2-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=38f617473e9f7373b5e79baf437accf8" -SRC_URI = "git://github.com/editorconfig/editorconfig-core-c.git;protocol=https;branch=master" +SRC_URI = "git://github.com/editorconfig/editorconfig-core-c.git;protocol=https;branch=master \ + file://CVE-2026-40489.patch \ +" SRCREV = "e082c947e7f7b14240195d55c060a6e1eda1b0a1"