From d1e32437905ffd992114ad3fdf9fe567fcae4d53 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Wed, 23 Sep 2026 22:40:20 +1200 Subject: [PATCH] flatcc: patch CVE-2026-90785 Details: https://nvd.nist.gov/vuln/detail/cve-2026-90785 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../flatcc/flatcc/CVE-2026-90785.patch | 29 +++++++++++++++++++ meta-oe/recipes-devtools/flatcc/flatcc_git.bb | 1 + 2 files changed, 30 insertions(+) create mode 100644 meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-90785.patch diff --git a/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-90785.patch b/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-90785.patch new file mode 100644 index 0000000000..82f4f9e02f --- /dev/null +++ b/meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-90785.patch @@ -0,0 +1,29 @@ +From d44946b10f4da3c2c7b46e0a58bb86f9b5e9f342 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Mikkel=20Fahn=C3=B8e=20J=C3=B8rgensen?= +Date: Tue, 4 Aug 2026 20:01:22 +0200 +Subject: [PATCH] Avoid processing structs recursively if recursion already + detected (closes #388) + +(cherry picked from commit f705032346ee39efd7d3848c50b73d455d28d06d) + +CVE: CVE-2026-90785 +Upstream-Status: Backport [https://github.com/dvidelabs/flatcc/commit/f705032346ee39efd7d3848c50b73d455d28d06d] +Signed-off-by: Ankur Tyagi +--- + src/compiler/semantics.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/compiler/semantics.c b/src/compiler/semantics.c +index 21ff948..2b49eee 100644 +--- a/src/compiler/semantics.c ++++ b/src/compiler/semantics.c +@@ -505,6 +505,9 @@ static int analyze_struct(fb_parser_t *P, fb_compound_type_t *ct) + uint16_t align; + fb_token_t *t; + ++ /* Avoid triggering assertions on already detected circular references. */ ++ if (P->failed) return P->failed; ++ + assert(ct->symbol.kind == fb_is_struct); + + assert(!(ct->symbol.flags & fb_circular_open)); diff --git a/meta-oe/recipes-devtools/flatcc/flatcc_git.bb b/meta-oe/recipes-devtools/flatcc/flatcc_git.bb index a6bf3c1cf4..b3cf7bed04 100644 --- a/meta-oe/recipes-devtools/flatcc/flatcc_git.bb +++ b/meta-oe/recipes-devtools/flatcc/flatcc_git.bb @@ -13,6 +13,7 @@ SRC_URI = " \ file://0001-Check-for-C-standard-version-23-for-__fallthrough__.patch \ file://0002-allow-build-with-cmake-4.patch \ file://CVE-2026-90786.patch \ + file://CVE-2026-90785.patch \ " SRCREV = "1653ec964730ec7d9892a08a1695ada6d20f5196"