mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 06:17:16 +00:00
Code Issues Projects Releases Wiki Activity

msgpack-c: patch CVE-2026-72854

Browse Source 
Pick patch from [1] linked from [2] mentioned in [3].
Drop version bump related changes.

[1] https://github.com/msgpack/msgpack-c/pull/1182/commits
[2] https://github.com/msgpack/msgpack-c/issues/1181
[3] https://nvd.nist.gov/vuln/detail/cve-2026-72854

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Peter Marko authored and Anuj Mittal committed 2026-09-28 14:55:30 +05:30
1 parent 4601216546
commit 6a48592e95
2 files changed
+128
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-devtools/msgpack/msgpack-c/CVE-2026-72854.patch
+127
View File
@@ -0,0 +1,127 @@
From 8a48af0e3ed15ce0e60273de30a073ae6419489e Mon Sep 17 00:00:00 2001
From: Takatoshi Kondo <redboltz@gmail.com>
Date: Tue, 25 Aug 2026 11:44:54 +0900
Subject: [PATCH] Fix #1181
Fix integer overflow on msgpack_unpacker_expand_buffer().
CVE: CVE-2026-72854
Upstream-Status: Backport [https://github.com/msgpack/msgpack-c/commit/8a48af0e3ed15ce0e60273de30a073ae6419489e]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
.gitignore | 2 ++
CHANGELOG.md | 3 +++
src/unpack.c | 9 +++++++-
test/streaming_c.cpp | 51 ++++++++++++++++++++++++++++++++++++++++++++
4 files changed, 64 insertions(+), 1 deletion(-)
diff --git a/.gitignore b/.gitignore
index b9dc789b..f046aab4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,6 +27,8 @@ Makefile
.deps
.libs
+build
+
# Files generated by make.
*.o
*.so
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fc2ffa5b..9e30edfe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,6 @@
+# 2026-08-25 version 6.0.0-patched
+ * Fix integer overflow on msgpack_unpacker_expand_buffer(). (#1182)
+
# 2023-03-02 version 6.0.0
* Remove C++ requirement if test is disabled (#1055)
## << breaking changes >>
diff --git a/src/unpack.c b/src/unpack.c
index 9341cb08..2d02a721 100644
--- a/src/unpack.c
+++ b/src/unpack.c
@@ -442,7 +442,11 @@ bool msgpack_unpacker_expand_buffer(msgpack_unpacker* mpac, size_t size)
if(mpac->off == COUNTER_SIZE) {
char* tmp;
- size_t next_size = (mpac->used + mpac->free) * 2; // include COUNTER_SIZE
+ size_t next_size;
+ if(size > SIZE_MAX - mpac->used) {
+ return false;
+ }
+ next_size = (mpac->used + mpac->free) * 2; // include COUNTER_SIZE
while(next_size < size + mpac->used) {
size_t tmp_next_size = next_size * 2;
if (tmp_next_size <= next_size) {
@@ -464,6 +468,9 @@ bool msgpack_unpacker_expand_buffer(msgpack_unpacker* mpac, size_t size)
char* tmp;
size_t next_size = mpac->initial_buffer_size; // include COUNTER_SIZE
size_t not_parsed = mpac->used - mpac->off;
+ if(size > SIZE_MAX - not_parsed - COUNTER_SIZE) {
+ return false;
+ }
while(next_size < size + not_parsed + COUNTER_SIZE) {
size_t tmp_next_size = next_size * 2;
if (tmp_next_size <= next_size) {
diff --git a/test/streaming_c.cpp b/test/streaming_c.cpp
index d75bfbe5..ebf73362 100644
--- a/test/streaming_c.cpp
+++ b/test/streaming_c.cpp
@@ -192,3 +192,54 @@ TEST(streaming, basic_with_size)
msgpack_unpacker_free(unp);
msgpack_sbuffer_free(buffer);
}
+
+// https://github.com/msgpack/msgpack-c/issues/1181
+TEST(streaming, reserve_buffer_overflow_rewound)
+{
+ msgpack_unpacker mpac;
+ ASSERT_TRUE(msgpack_unpacker_init(&mpac, 8));
+
+ // off == COUNTER_SIZE path: size + used would wrap
+ size_t request = SIZE_MAX - 2;
+ EXPECT_FALSE(msgpack_unpacker_reserve_buffer(&mpac, request));
+
+ // a sane request still works
+ EXPECT_TRUE(msgpack_unpacker_reserve_buffer(&mpac, 64));
+ EXPECT_GE(msgpack_unpacker_buffer_capacity(&mpac), static_cast<size_t>(64));
+
+ msgpack_unpacker_destroy(&mpac);
+}
+
+TEST(streaming, reserve_buffer_overflow_not_rewound)
+{
+ msgpack_unpacker mpac;
+ ASSERT_TRUE(msgpack_unpacker_init(&mpac, 8));
+
+ // consume part of the buffer so off != COUNTER_SIZE
+ msgpack_sbuffer sbuf;
+ msgpack_sbuffer_init(&sbuf);
+ msgpack_packer pk;
+ msgpack_packer_init(&pk, &sbuf, msgpack_sbuffer_write);
+ msgpack_pack_int(&pk, 1);
+ msgpack_pack_int(&pk, 2);
+
+ ASSERT_TRUE(msgpack_unpacker_reserve_buffer(&mpac, sbuf.size));
+ memcpy(msgpack_unpacker_buffer(&mpac), sbuf.data, sbuf.size);
+ msgpack_unpacker_buffer_consumed(&mpac, sbuf.size);
+
+ msgpack_unpacked result;
+ msgpack_unpacked_init(&result);
+ ASSERT_EQ(MSGPACK_UNPACK_SUCCESS, msgpack_unpacker_next(&mpac, &result));
+ EXPECT_EQ(1, result.data.via.i64);
+
+ size_t request = SIZE_MAX - 2;
+ EXPECT_FALSE(msgpack_unpacker_reserve_buffer(&mpac, request));
+
+ // remaining data must still be parsable
+ ASSERT_EQ(MSGPACK_UNPACK_SUCCESS, msgpack_unpacker_next(&mpac, &result));
+ EXPECT_EQ(2, result.data.via.i64);
+
+ msgpack_unpacked_destroy(&result);
+ msgpack_sbuffer_destroy(&sbuf);
+ msgpack_unpacker_destroy(&mpac);
+}
meta-oe/recipes-devtools/msgpack/msgpack-c_6.0.0.bb
+1
View File
@@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://NOTICE;md5=7a858c074723608e08614061dc044352 \
"
SRC_URI = "git://github.com/msgpack/msgpack-c;branch=c_master;protocol=https \
file://CVE-2026-72854.patch \
"
SRCREV = "8160ede5e20fd3019a77eea46d9c72cf6163f802"