opensc: patch CVE-2026-103531

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-103531

(cherry picked from commit 27b41701a04a46e498f7f3f6212ac2a5e2bc8d1a)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch

@@ -0,0 +1,54 @@
+From 4b0f46d922866d9453e3631ff5e0a24900fae8dd Mon Sep 17 00:00:00 2001
+From: wanglanlan <wanglanlan@users.noreply.github.com>
+Date: Wed, 2 Sep 2026 08:36:47 +0000
+Subject: [PATCH] setcos: Fix buffer overflow in setcos_construct_fci_44
+
+The FCI construction copied type_attr, sec_attr and prop_attr of the
+file into a fixed 64-byte stack buffer without checking the length.
+Malicious or corrupted attribute lengths (e.g. prop_attr_len > 64,
+reachable through fuzz_pkcs15init and attacker-controlled card
+responses) caused a stack buffer overflow (write).
+
+Return SC_ERROR_INVALID_DATA if any attribute exceeds the buffer size.
+
+Found with the fuzz_pkcs15init fuzzer.
+
+Co-Authored-By: Claude <noreply@anthropic.com>
+(cherry picked from commit ad730304052937c32b4eb489a06835ac6123632c)
+
+CVE: CVE-2026-103531
+Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libopensc/card-setcos.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/libopensc/card-setcos.c b/src/libopensc/card-setcos.c
+index 0ebe7c34f..8c7baa3e4 100644
+--- a/src/libopensc/card-setcos.c
++++ b/src/libopensc/card-setcos.c
+@@ -218,6 +218,8 @@ static int setcos_construct_fci_44(sc_card_t *card, const sc_file_t *file, u8 *o
+ 
+ 	/* Type */
+ 	if (file->type_attr_len) {
++		if (file->type_attr_len > sizeof(buf))
++			LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ 		memcpy(buf, file->type_attr, file->type_attr_len);
+ 		sc_asn1_put_tag(0x82, buf, file->type_attr_len, p, *outlen - (p - out), &p);
+ 	} else {
+@@ -271,11 +273,15 @@ static int setcos_construct_fci_44(sc_card_t *card, const sc_file_t *file, u8 *o
+ 	}
+ 
+ 	/* Security Attributes */
++	if (file->sec_attr_len > sizeof(buf))
++		LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ 	memcpy(buf, file->sec_attr, file->sec_attr_len);
+ 	sc_asn1_put_tag(0x86, buf, file->sec_attr_len, p, *outlen - (p - out), &p);
+ 
+ 	/* Life cycle status */
+ 	if (file->prop_attr_len) {
++		if (file->prop_attr_len > sizeof(buf))
++			LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ 		memcpy(buf, file->prop_attr, file->prop_attr_len);
+ 		sc_asn1_put_tag(0x8A, buf, file->prop_attr_len, p, *outlen - (p - out), &p);
+ 	}

meta-oe/recipes-support/opensc/opensc_0.27.1.bb

@@ -14,6 +14,7 @@ DEPENDS = "openssl"
 SRCREV = "19868984dc4dc697af6a86d65ab32a1f19a43ea4"
 SRC_URI = "git://github.com/OpenSC/OpenSC;branch=master;protocol=https \
            file://0001-Changes-for-OpenSSL-4.0.0.patch \
+           file://CVE-2026-103531.patch \
            "
 
 CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0"