mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-09 06:40:17 +00:00
Devansh Patel
b8bd073f05
Scarthgap already contains 4810cd8c5b [3], which backports
fb4ee161 and e61a5f36 for read-ahead/read-size handling. The
associated submission [4] labels that work as CVE-2026-26209, but
it does not add the max_depth protection required for uncontrolled
recursion [2].
Complete the existing backport with the 5.9.0 max-depth chain:
- bcb6cea4: add the C decoder depth limit [1]
- 94e0d212: add the security-essential pure-Python depth limit
- 53521e7c: apply the required type correction
- a7ac10d5: raise the default depth limit to 400
- d903d62c: synchronize the C function signature default
The 5.9.0 upgrade description [5] also identifies max_depth as the
CVE fix. Full upstream commit links are recorded in the embedded
patch headers.
[1] https://github.com/agronholm/cbor2/commit/bcb6cea4edde1d00ff4f0eece883dea951f66e1b
[2] https://github.com/advisories/GHSA-3c37-wwvx-h642
[3] https://git.openembedded.org/meta-openembedded/commit/?id=4810cd8c5bbc0b4349a78eac85a6a882bc0b03a2
[4] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105607.html
[5] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105418.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
82 lines
2.7 KiB
Diff
82 lines
2.7 KiB
Diff
From 3aa613d4b3ec1ed78dcaf5577cea867309d228c8 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Alex=20Gr=C3=B6nholm?= <alex.gronholm@nextday.fi>
|
|
Date: Sat, 21 Mar 2026 23:48:20 +0200
|
|
Subject: [PATCH] Upped the max_depth value to 400
|
|
|
|
CVE: CVE-2026-26209
|
|
Upstream-Status: Backport [https://github.com/agronholm/cbor2/commit/a7ac10d5cbb7a8622e8270c201a131ac2abc26c7]
|
|
|
|
Backport Changes:
|
|
- Omitted docs/versionhistory.rst after it failed to cherry-pick because
|
|
Scarthgap 5.6.4 lacks the later release sections; all source and test
|
|
changes are retained.
|
|
|
|
(cherry picked from commit a7ac10d5cbb7a8622e8270c201a131ac2abc26c7)
|
|
Signed-off-by: Devansh Patel <devanshp@cisco.com>
|
|
---
|
|
cbor2/_decoder.py | 6 +++---
|
|
source/decoder.h | 2 +-
|
|
tests/test_decoder.py | 4 ++--
|
|
3 files changed, 6 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/cbor2/_decoder.py b/cbor2/_decoder.py
|
|
index 024c403..cccd0ac 100644
|
|
--- a/cbor2/_decoder.py
|
|
+++ b/cbor2/_decoder.py
|
|
@@ -75,7 +75,7 @@ class CBORDecoder:
|
|
str_errors: Literal["strict", "error", "replace"] = "strict",
|
|
read_size: int = 1,
|
|
*,
|
|
- max_depth: int = 100,
|
|
+ max_depth: int = 400,
|
|
):
|
|
"""
|
|
:param fp:
|
|
@@ -817,7 +817,7 @@ def loads(
|
|
str_errors: Literal["strict", "error", "replace"] = "strict",
|
|
read_size: int = 1,
|
|
*,
|
|
- max_depth: int = 100,
|
|
+ max_depth: int = 400,
|
|
) -> Any:
|
|
"""
|
|
Deserialize an object from a bytestring.
|
|
@@ -866,7 +866,7 @@ def load(
|
|
str_errors: Literal["strict", "error", "replace"] = "strict",
|
|
read_size: int = 1,
|
|
*,
|
|
- max_depth: int = 100,
|
|
+ max_depth: int = 400,
|
|
) -> Any:
|
|
"""
|
|
Deserialize an object from an open file.
|
|
diff --git a/source/decoder.h b/source/decoder.h
|
|
index c4ef1c1..2989fc1 100644
|
|
--- a/source/decoder.h
|
|
+++ b/source/decoder.h
|
|
@@ -6,7 +6,7 @@
|
|
// Default readahead buffer size for streaming reads.
|
|
// Set to 1 for backwards compatibility (no buffering).
|
|
#define CBOR2_DEFAULT_READ_SIZE 1
|
|
-#define CBOR2_DEFAULT_MAX_DEPTH 100
|
|
+#define CBOR2_DEFAULT_MAX_DEPTH 400
|
|
|
|
// Forward declaration for function pointer typedef
|
|
struct CBORDecoderObject_;
|
|
diff --git a/tests/test_decoder.py b/tests/test_decoder.py
|
|
index 5a90adf..9e33ded 100644
|
|
--- a/tests/test_decoder.py
|
|
+++ b/tests/test_decoder.py
|
|
@@ -142,9 +142,9 @@ class TestMaximumDepth:
|
|
def test_default(self, impl) -> None:
|
|
with pytest.raises(
|
|
impl.CBORDecodeError,
|
|
- match="maximum container nesting depth \\(100\\) exceeded",
|
|
+ match="maximum container nesting depth \\(400\\) exceeded",
|
|
):
|
|
- impl.loads(b"\x81" * 101 + b"\x80")
|
|
+ impl.loads(b"\x81" * 401 + b"\x80")
|
|
|
|
def test_explicit(self, impl) -> None:
|
|
with pytest.raises(
|