mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-09 18:50:13 +00:00
Devansh Patel
b8bd073f05
Scarthgap already contains 4810cd8c5b [3], which backports
fb4ee161 and e61a5f36 for read-ahead/read-size handling. The
associated submission [4] labels that work as CVE-2026-26209, but
it does not add the max_depth protection required for uncontrolled
recursion [2].
Complete the existing backport with the 5.9.0 max-depth chain:
- bcb6cea4: add the C decoder depth limit [1]
- 94e0d212: add the security-essential pure-Python depth limit
- 53521e7c: apply the required type correction
- a7ac10d5: raise the default depth limit to 400
- d903d62c: synchronize the C function signature default
The 5.9.0 upgrade description [5] also identifies max_depth as the
CVE fix. Full upstream commit links are recorded in the embedded
patch headers.
[1] https://github.com/agronholm/cbor2/commit/bcb6cea4edde1d00ff4f0eece883dea951f66e1b
[2] https://github.com/advisories/GHSA-3c37-wwvx-h642
[3] https://git.openembedded.org/meta-openembedded/commit/?id=4810cd8c5bbc0b4349a78eac85a6a882bc0b03a2
[4] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105607.html
[5] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105418.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
29 lines
1.0 KiB
Diff
29 lines
1.0 KiB
Diff
From 83317379cb68b0caafae35f374e40d95eec106b0 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Alex=20Gr=C3=B6nholm?= <alex.gronholm@nextday.fi>
|
|
Date: Sun, 22 Mar 2026 17:26:27 +0200
|
|
Subject: [PATCH] Updated the max_depth default value in the C function
|
|
signature
|
|
|
|
CVE: CVE-2026-26209
|
|
Upstream-Status: Backport [https://github.com/agronholm/cbor2/commit/d903d62c86de118e8abe626596f9be7b98ac44e9]
|
|
|
|
(cherry picked from commit d903d62c86de118e8abe626596f9be7b98ac44e9)
|
|
Signed-off-by: Devansh Patel <devanshp@cisco.com>
|
|
---
|
|
source/decoder.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/source/decoder.c b/source/decoder.c
|
|
index 04c9142..3ce2545 100644
|
|
--- a/source/decoder.c
|
|
+++ b/source/decoder.c
|
|
@@ -170,7 +170,7 @@ error:
|
|
|
|
|
|
// CBORDecoder.__init__(self, fp=None, tag_hook=None, object_hook=None,
|
|
-// str_errors='strict', read_size=1, *, max_depth=100)
|
|
+// str_errors='strict', read_size=1, *, max_depth=400)
|
|
int
|
|
CBORDecoder_init(CBORDecoderObject *self, PyObject *args, PyObject *kwargs)
|
|
{
|