helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2025-12-31 13:38:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

poco: patch CVE-2025-6375

Browse Source 
Pick commit mentioned in [1].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-6375

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Peter Marko 2025-07-13 11:48:12 +02:00 committed by Armin Kuster
parent 37b138014b
commit 205638f9ed
2 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
meta-oe/recipes-support/poco/poco/CVE-2025-6375.patch Normal file
View File

@ -0,0 +1,34 @@
From 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnter=20Obiltschnig?= <guenter.obiltschnig@appinf.com>
Date: Wed, 16 Apr 2025 09:15:33 +0200
Subject: [PATCH] fix(Net): A SEGV at Net/src/MultipartReader.cpp:164:1 #4915
(move assertion out of ctor)
CVE: CVE-2025-6375
Upstream-Status: Backport [https://github.com/pocoproject/poco/commit/6f2f85913c191ab9ddfb8fae781f5d66afccf3bf]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
Net/src/MultipartReader.cpp | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/Net/src/MultipartReader.cpp b/Net/src/MultipartReader.cpp
index f3a2f2bba..f4aa27dd8 100644
--- a/Net/src/MultipartReader.cpp
+++ b/Net/src/MultipartReader.cpp
@@ -36,7 +36,6 @@ MultipartStreamBuf::MultipartStreamBuf(std::istream& istr, const std::string& bo
_boundary(boundary),
_lastPart(false)
{
- poco_assert (!boundary.empty() && boundary.length() < STREAM_BUFFER_SIZE - 6);
}
@@ -47,7 +46,7 @@ MultipartStreamBuf::~MultipartStreamBuf()
int MultipartStreamBuf::readFromDevice(char* buffer, std::streamsize length)
{
- poco_assert_dbg (length >= _boundary.length() + 6);
+ poco_assert (!_boundary.empty() && _boundary.length() < length - 6);
static const int eof = std::char_traits<char>::eof();
std::streambuf& buf = *_istr.rdbuf();

1
meta-oe/recipes-support/poco/poco_1.12.5p2.bb
View File

@ -13,6 +13,7 @@ SRC_URI = "git://github.com/pocoproject/poco.git;branch=poco-1.12.5;protocol=htt
file://0001-cppignore.lnx-Ignore-PKCS12-and-testLaunch-test.patch \
file://run-ptest \
file://0002-fix-build-Install-cmake-files-with-resolved-ENABLE_J.patch \
file://CVE-2025-6375.patch \
"
SRCREV = "1d6fb3e1383e559cacbada5e3f861c0dafaf5d30"