From 56beba6867c0b0252f0663637ff935b2ce64c150 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 6 Nov 2026 09:05:51 +1300 Subject: [PATCH] libgphoto2: patch CVE-2026-120451 Details: https://nvd.nist.gov/vuln/detail/cve-2026-120451 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj --- .../gphoto2/libgphoto2/CVE-2026-120451.patch | 43 +++++++++++++++++++ .../gphoto2/libgphoto2_2.5.34.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch new file mode 100644 index 0000000000..7addb4d566 --- /dev/null +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-120451.patch @@ -0,0 +1,43 @@ +From 5924549b4750f0b17369f82e98959b779880400a Mon Sep 17 00:00:00 2001 +From: TheProtagonist07 <63047129+TheProtagonist07@users.noreply.github.com> +Date: Wed, 28 Oct 2026 18:51:05 +0530 +Subject: [PATCH] jl2005c: reject an allocation table that does not fit the + buffers + +jl2005c_init() computes alloc_table_size from the entry count reported by +the camera and then reads that many bytes into the 0x4020 byte info[] stack +buffer and copies them into priv->table[0x4000]. For nb_entries >= 1022 both +operations write past the end of their destination. + +Return GP_ERROR_CORRUPTED_DATA if the table would not fit. + +Addresses findings 1 and 2 of #1326. + +(cherry picked from commit 6a3393dd996502457ab965432cf0b2035278825e) + +CVE: CVE-2026-120451 +Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/6a3393dd996502457ab965432cf0b2035278825e] +Signed-off-by: Ankur Tyagi +--- + camlibs/jl2005c/jl2005c.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/camlibs/jl2005c/jl2005c.c b/camlibs/jl2005c/jl2005c.c +index c447a2300..12c106acb 100644 +--- a/camlibs/jl2005c/jl2005c.c ++++ b/camlibs/jl2005c/jl2005c.c +@@ -144,6 +144,14 @@ restart: + alloc_table_size = priv->nb_entries * 0x10 + 0x30; + if (alloc_table_size%0x200) + alloc_table_size += 0x200 - (alloc_table_size%0x200); ++ /* nb_entries comes from the camera. The table has to fit into the ++ * local info buffer as well as into priv->table. */ ++ if ((size_t)alloc_table_size > sizeof(info) || ++ (size_t)alloc_table_size - 0x30 > sizeof(priv->table)) { ++ GP_DEBUG("alloc_table_size 0x%x is too large for %d entries\n", ++ alloc_table_size, priv->nb_entries); ++ return GP_ERROR_CORRUPTED_DATA; ++ } + /* However, we have already just now downloaded 0x200 bytes, so + * when downloading the rest of the table we correct for that and + * just download whatever remains of the information block. diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb index fca158fe11..488364b542 100644 --- a/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb +++ b/meta-oe/recipes-graphics/gphoto2/libgphoto2_2.5.34.bb @@ -12,6 +12,7 @@ DEPENDS = "libtool jpeg virtual/libusb0 libexif zlib libxml2" SRC_URI = "${SOURCEFORGE_MIRROR}/gphoto/${BP}.tar.xz;name=libgphoto2 \ file://40-libgphoto2.rules \ file://0001-configure-Filter-out-buildpaths-from-CC.patch \ + file://CVE-2026-120451.patch \ " SRC_URI[libgphoto2.sha256sum] = "51993f5d9bfb6b4e5925cbbe5883085791bff6f81bcacb8ffe1b783ce76d586a"