mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-21 20:19:33 +00:00
Code Issues Projects Releases Wiki Activity

libvncserver: patch CVE-2026-32854

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32854

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Khem Raj committed 2026-10-20 07:51:41 -07:00
1 parent 08a5882d96
commit 75b6dd52a1
2 files changed
+67
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch
+66
View File
@@ -0,0 +1,66 @@
From bf01ccc67bc8181568af2d1f6e1f6f6888b51bde Mon Sep 17 00:00:00 2001
From: Kazuma Matsumoto <269371721+y637F9QQ2x@users.noreply.github.com>
Date: Thu, 19 Mar 2026 17:42:00 +0900
Subject: [PATCH] libvncserver: fix NULL pointer dereferences in httpd proxy
handlers
httpProcessInput() passes the return value of strchr() to atoi()
and strncmp() without checking for NULL. If a CONNECT request
contains no colon, or a GET request contains no slash, strchr()
returns NULL, leading to a segmentation fault.
Add NULL checks before using the strchr() return values.
(cherry picked from commit dc78dee51a7e270e537a541a17befdf2073f5314)
CVE: CVE-2026-32854
Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/libvncserver/httpd.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/src/libvncserver/httpd.c b/src/libvncserver/httpd.c
index 2186ae54..604e5bf9 100644
--- a/src/libvncserver/httpd.c
+++ b/src/libvncserver/httpd.c
@@ -337,10 +337,11 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen)
/* Process the request. */
- if(rfbScreen->httpEnableProxyConnect) {
+if(rfbScreen->httpEnableProxyConnect) {
const static char* PROXY_OK_STR = "HTTP/1.0 200 OK\r\nContent-Type: octet-stream\r\nPragma: no-cache\r\n\r\n";
if(!strncmp(buf, "CONNECT ", 8)) {
- if(atoi(strchr(buf, ':')+1)!=rfbScreen->port) {
+ char *colon = strchr(buf, ':');
+ if(colon == NULL || atoi(colon+1)!=rfbScreen->port) {
rfbErr("httpd: CONNECT format invalid.\n");
rfbWriteExact(&cl,INVALID_REQUEST_STR, strlen(INVALID_REQUEST_STR));
httpCloseSock(rfbScreen);
@@ -353,14 +354,17 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen)
rfbScreen->httpSock = RFB_INVALID_SOCKET;
return;
}
- if (!strncmp(buf, "GET ",4) && !strncmp(strchr(buf,'/'),"/proxied.connection HTTP/1.", 27)) {
- /* proxy connection */
- rfbLog("httpd: client asked for /proxied.connection\n");
- rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR));
- rfbNewClientConnection(rfbScreen,rfbScreen->httpSock);
- rfbScreen->httpSock = RFB_INVALID_SOCKET;
- return;
- }
+ if (!strncmp(buf, "GET ",4)) {
+ char *slash = strchr(buf, '/');
+ if (slash != NULL && !strncmp(slash,"/proxied.connection HTTP/1.", 27)) {
+ /* proxy connection */
+ rfbLog("httpd: client asked for /proxied.connection\n");
+ rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR));
+ rfbNewClientConnection(rfbScreen,rfbScreen->httpSock);
+ rfbScreen->httpSock = RFB_INVALID_SOCKET;
+ return;
+ }
+ }
}
if (strncmp(buf, "GET ", 4)) {
meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+1
View File
@@ -47,6 +47,7 @@ inherit cmake pkgconfig
SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag=LibVNCServer-${PV} \
file://0001-CMake-require-at-least-CMake-3.5.patch \
file://CVE-2026-44988.patch \
file://CVE-2026-32854.patch \
"
SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"