mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-23 20:58:33 +00:00
Hitendra Prajapati
8a6e67f063
Pick patch from [1] also mentioned at NVD report in [2] [1] https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-40528 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
45 lines
1.3 KiB
Diff
45 lines
1.3 KiB
Diff
From 0358817ec74aeca654f83e7709c7720b14c5db59 Mon Sep 17 00:00:00 2001
|
|
From: Jakub Jelen <jjelen@redhat.com>
|
|
Date: Tue, 3 Mar 2026 15:04:33 +0100
|
|
Subject: [PATCH] profile: Avoid possible buffer overrun
|
|
|
|
Profile file of the following format will cause buffer overrun
|
|
when parsed during the pkcs15-init invocation:
|
|
|
|
```
|
|
cardinfo {
|
|
key CHV1 {
|
|
value = "=XXXX..."; // 200+ X characters
|
|
}
|
|
}
|
|
```
|
|
This will cause both stack and heap buffer overrun.
|
|
|
|
Thanks Nicholas Carlini from Anthropic for the report.
|
|
|
|
CVE: CVE-2026-40528
|
|
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
src/pkcs15init/profile.c | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/src/pkcs15init/profile.c b/src/pkcs15init/profile.c
|
|
index a6b2103f8..58416b7e1 100644
|
|
--- a/src/pkcs15init/profile.c
|
|
+++ b/src/pkcs15init/profile.c
|
|
@@ -987,6 +987,10 @@ do_key_value(struct state *cur, int argc, char **argv)
|
|
if (key[0] == '=') {
|
|
++key;
|
|
key_len = strlen(key);
|
|
+ if (key_len > sizeof(keybuf)) {
|
|
+ parse_error(cur, "Key value too long (%zu > %zu)\n", key_len, sizeof(keybuf));
|
|
+ return 1;
|
|
+ }
|
|
memcpy(keybuf, key, key_len);
|
|
} else {
|
|
key_len = sizeof(keybuf);
|
|
--
|
|
2.50.1
|
|
|