freeipmi: patch CVE-2026-85508

Backport commit from v1.6.19 matching NVD description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85508

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85508.patch

@@ -0,0 +1,51 @@
+From 4525750676ebf8dcf96a04bcd8cd59767581c44c Mon Sep 17 00:00:00 2001
+From: Albert L Chu <chu11@llnl.gov>
+Date: Tue, 18 Aug 2026 12:44:01 -0700
+Subject: [PATCH] ipmi-oem: bound Dell CMC-IPv6-info accumulation loop against
+ buffer size
+
+_output_dell_system_info_cmc_ipv6_info accumulates configuration
+parameter data from four get-system-info responses into a 256-byte
+cmc_ipv6_info stack buffer, copying (len - 1) bytes per iteration at a
+running offset with no check against the destination size.  The response
+field is BMC-controlled and can legitimately return up to 128 bytes per
+call, so a malicious BMC returning large blocks overflows the stack
+buffer with attacker-controlled data starting on the third iteration.
+
+Reject any copy whose cumulative length would exceed sizeof
+(cmc_ipv6_info) before the memcpy, mirroring the existing invalid-length
+error path.
+
+Assisted-by: Claude (Opus 4.8) <noreply@anthropic.com>
+(cherry picked from commit b34841134f3d3206840de06fb152ae3ee0b8bcff)
+
+CVE: CVE-2026-85508
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?h=freeipmi-1-6-19&id=b34841134f3d3206840de06fb152ae3ee0b8bcff]
+
+Dropped changes to the ChangeLog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ ipmi-oem/ipmi-oem-dell.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/ipmi-oem/ipmi-oem-dell.c b/ipmi-oem/ipmi-oem-dell.c
+index f322cdfb8..ff2d39b1c 100644
+--- a/ipmi-oem/ipmi-oem-dell.c
++++ b/ipmi-oem/ipmi-oem-dell.c
+@@ -1220,6 +1220,15 @@ _output_dell_system_info_cmc_ipv6_info (ipmi_oem_state_data_t *state_data)
+           goto cleanup;
+         }
+ 
++      if ((cmc_ipv6_info_len + (len - 1)) > sizeof (cmc_ipv6_info))
++        {
++          pstdout_fprintf (state_data->pstate,
++                           stderr,
++                           "ipmi_cmd_get_system_info_parameters: invalid buffer length returned: %d\n",
++                           len);
++          goto cleanup;
++        }
++
+       memcpy (&cmc_ipv6_info[cmc_ipv6_info_len],
+               configuration_parameter_data + 1, /* remove set selector */
+               len - 1);

meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb

@@ -17,6 +17,7 @@ SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \
            file://CVE-2026-50031-1.patch \
            file://CVE-2026-50031-2.patch \
            file://CVE-2026-85509.patch \
+           file://CVE-2026-85508.patch \
 "
 SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"