From b7c1c19585d7614fcc51e368405835c3abd9c740 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 21 Aug 2026 16:35:11 +1200 Subject: [PATCH] cjose: upgrade 0.6.2.7 -> 0.6.2.8 Drop patch that is part of the upstream version. Changelog: https://github.com/OpenIDC/cjose/releases/tag/v0.6.2.8 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj --- ...-the-decoded-buffer-lengths-up-front.patch | 149 ------------------ .../{cjose_0.6.2.7.bb => cjose_0.6.2.8.bb} | 6 +- 2 files changed, 2 insertions(+), 153 deletions(-) delete mode 100644 meta-oe/recipes-support/cjose/cjose/0001-jwk-initialize-the-decoded-buffer-lengths-up-front.patch rename meta-oe/recipes-support/cjose/{cjose_0.6.2.7.bb => cjose_0.6.2.8.bb} (66%) diff --git a/meta-oe/recipes-support/cjose/cjose/0001-jwk-initialize-the-decoded-buffer-lengths-up-front.patch b/meta-oe/recipes-support/cjose/cjose/0001-jwk-initialize-the-decoded-buffer-lengths-up-front.patch deleted file mode 100644 index eace7b659f..0000000000 --- a/meta-oe/recipes-support/cjose/cjose/0001-jwk-initialize-the-decoded-buffer-lengths-up-front.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 5e8337d3c0ad2b19b78098f72814fbe2442226c9 Mon Sep 17 00:00:00 2001 -From: Khem Raj -Date: Wed, 5 Aug 2026 19:27:04 +0000 -Subject: [PATCH] jwk: initialize the decoded buffer lengths up front - -_cjose_jwk_import_EC() and _cjose_jwk_import_RSA() declare their -*_buflen variables in the middle of the function, interleaved with -error paths that goto the shared cleanup label. When an early decode -fails, the goto jumps over the remaining declarations and the cleanup -block then reads them uninitialized: - -| jwk.c:1501:9: error: variable 'dq_buflen' is used uninitialized -| whenever 'if' condition is true -| [-Werror,-Wsometimes-uninitialized] -| jwk.c:1554:39: note: uninitialized use occurs here -| _cjose_cleanse_dealloc(dq_buffer, dq_buflen); - -_cjose_cleanse_dealloc() uses the length to wipe key material, so this -is a real out-of-bounds write hazard on the error path, not just a -warning. src/Makefile.am builds with -Werror, so it also breaks the -build with clang. - -Declare the lengths alongside the buffers they pair with and assign -them where they were previously initialized. - -Upstream-Status: Submitted [https://github.com/OpenIDC/cjose/pull/32] -Signed-off-by: Khem Raj ---- - src/jwk.c | 25 ++++++++++++++----------- - 1 file changed, 14 insertions(+), 11 deletions(-) - -diff --git a/src/jwk.c b/src/jwk.c -index 9c57a0b..58f872b 100644 ---- a/src/jwk.c -+++ b/src/jwk.c -@@ -1371,6 +1371,9 @@ static cjose_jwk_t *_cjose_jwk_import_EC(json_t *jwk_json, cjose_err *err) - uint8_t *x_buffer = NULL; - uint8_t *y_buffer = NULL; - uint8_t *d_buffer = NULL; -+ size_t x_buflen = 0; -+ size_t y_buflen = 0; -+ size_t d_buflen = 0; - - // get the value of the crv attribute - const char *crv_str = _get_json_object_string_attribute(jwk_json, CJOSE_JWK_CRV_STR, err); -@@ -1389,7 +1392,7 @@ static cjose_jwk_t *_cjose_jwk_import_EC(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of the x coordinate -- size_t x_buflen = (size_t)_ec_size_for_curve(crv, err); -+ x_buflen = (size_t)_ec_size_for_curve(crv, err); - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_X_STR, &x_buffer, &x_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1397,7 +1400,7 @@ static cjose_jwk_t *_cjose_jwk_import_EC(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of the y coordinate -- size_t y_buflen = (size_t)_ec_size_for_curve(crv, err); -+ y_buflen = (size_t)_ec_size_for_curve(crv, err); - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_Y_STR, &y_buffer, &y_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1405,7 +1408,7 @@ static cjose_jwk_t *_cjose_jwk_import_EC(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of the private key d -- size_t d_buflen = (size_t)_ec_size_for_curve(crv, err); -+ d_buflen = (size_t)_ec_size_for_curve(crv, err); - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_D_STR, &d_buffer, &d_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1455,9 +1458,16 @@ static cjose_jwk_t *_cjose_jwk_import_RSA(json_t *jwk_json, cjose_err *err) - uint8_t *dp_buffer = NULL; - uint8_t *dq_buffer = NULL; - uint8_t *qi_buffer = NULL; -+ size_t n_buflen = 0; -+ size_t e_buflen = 0; -+ size_t d_buflen = 0; -+ size_t p_buflen = 0; -+ size_t q_buflen = 0; -+ size_t dp_buflen = 0; -+ size_t dq_buflen = 0; -+ size_t qi_buflen = 0; - - // get the decoded value of n (buflen = 0 means no particular expected len) -- size_t n_buflen = 0; - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_N_STR, &n_buffer, &n_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1465,7 +1475,6 @@ static cjose_jwk_t *_cjose_jwk_import_RSA(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of e -- size_t e_buflen = 0; - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_E_STR, &e_buffer, &e_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1473,7 +1482,6 @@ static cjose_jwk_t *_cjose_jwk_import_RSA(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of d -- size_t d_buflen = 0; - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_D_STR, &d_buffer, &d_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1481,7 +1489,6 @@ static cjose_jwk_t *_cjose_jwk_import_RSA(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of p -- size_t p_buflen = 0; - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_P_STR, &p_buffer, &p_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1489,7 +1496,6 @@ static cjose_jwk_t *_cjose_jwk_import_RSA(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of q -- size_t q_buflen = 0; - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_Q_STR, &q_buffer, &q_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1497,7 +1503,6 @@ static cjose_jwk_t *_cjose_jwk_import_RSA(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of dp -- size_t dp_buflen = 0; - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_DP_STR, &dp_buffer, &dp_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1505,7 +1510,6 @@ static cjose_jwk_t *_cjose_jwk_import_RSA(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of dq -- size_t dq_buflen = 0; - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_DQ_STR, &dq_buffer, &dq_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); -@@ -1513,7 +1517,6 @@ static cjose_jwk_t *_cjose_jwk_import_RSA(json_t *jwk_json, cjose_err *err) - } - - // get the decoded value of qi -- size_t qi_buflen = 0; - if (!_decode_json_object_base64url_attribute(jwk_json, CJOSE_JWK_QI_STR, &qi_buffer, &qi_buflen, err)) - { - CJOSE_ERROR(err, CJOSE_ERR_INVALID_ARG); --- -2.43.0 - diff --git a/meta-oe/recipes-support/cjose/cjose_0.6.2.7.bb b/meta-oe/recipes-support/cjose/cjose_0.6.2.8.bb similarity index 66% rename from meta-oe/recipes-support/cjose/cjose_0.6.2.7.bb rename to meta-oe/recipes-support/cjose/cjose_0.6.2.8.bb index 4538d33ef6..492ee0d143 100644 --- a/meta-oe/recipes-support/cjose/cjose_0.6.2.7.bb +++ b/meta-oe/recipes-support/cjose/cjose_0.6.2.8.bb @@ -3,11 +3,9 @@ HOMEPAGE = "https://github.com/OpenIDC/cjose" LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE;md5=7249e2f9437adfb8c88d870438042f0e" -SRC_URI = "git://github.com/OpenIDC/cjose;protocol=https;branch=version-0.6.2.x;tag=v${PV} \ - file://0001-jwk-initialize-the-decoded-buffer-lengths-up-front.patch \ - " +SRC_URI = "git://github.com/OpenIDC/cjose;protocol=https;branch=version-0.6.2.x;tag=v${PV}" -SRCREV = "10af8915a666b50caa5500cdc3f2523b916be720" +SRCREV = "e787ace6a203d483038a793fd58f958a2f9b48c1" DEPENDS = "openssl libcheck jansson"