helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-04-02 02:49:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

exiv2: patch CVE-2026-27596

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27596

Backport the commits referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Gyorgy Sarvari 2026-03-11 11:03:51 +01:00 committed by Anuj Mittal
parent 7e66b15669
commit 3175de6547
No known key found for this signature in database
GPG Key ID: 4340AEFE69F5085C
3 changed files with 97 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch Normal file
View File

@ -0,0 +1,71 @@
From eb658ca4af5c81e790b5c85810ef19481655157f Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 26 Feb 2026 20:44:18 +0000
Subject: [PATCH] Regression test for
https://github.com/Exiv2/exiv2/issues/3511
CVE: CVE-2026-27596
Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/fe0d0154ab2886feb503e6cfd38c3b6d5722921f]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
test/data/issue_3511_poc.eps | 13 +++++++++++++
tests/bugfixes/github/test_issue_3511.py | 17 +++++++++++++++++
.../test_regression_allfiles.py | 1 +
3 files changed, 31 insertions(+)
create mode 100644 test/data/issue_3511_poc.eps
create mode 100644 tests/bugfixes/github/test_issue_3511.py
diff --git a/test/data/issue_3511_poc.eps b/test/data/issue_3511_poc.eps
new file mode 100644
index 000000000..4d403cc51
--- /dev/null
+++ b/test/data/issue_3511_poc.eps
@@ -0,0 +1,13 @@
+%!PS-Adobe-3.0 EPSF-3.0
+%%BoundingBox: 0 0 100 100
+%%EndComments
+%%BeginProlog
+%%EndProlog
+%%Page: 1 1
+%%BeginPageSetup
+%%EndPageSetup
+%BeginPhotoshop: 16
+3842494D040C00000000000441424344
+%EndPhotoshop
+%%PageTrailer
+%%EOF
diff --git a/tests/bugfixes/github/test_issue_3511.py b/tests/bugfixes/github/test_issue_3511.py
new file mode 100644
index 000000000..1825550a1
--- /dev/null
+++ b/tests/bugfixes/github/test_issue_3511.py
@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+
+import system_tests
+
+
+class test_issue_3511_sigma_LoaderNative_getData(metaclass=system_tests.CaseMeta):
+ url = "https://github.com/Exiv2/exiv2/issues/3511"
+
+ filename = "$data_path/issue_3511_poc.eps"
+ commands = ["$exiv2 -pp $filename"]
+ retval = [1]
+ stderr = [
+ """$exiv2_exception_message $filename:
+$kerCorruptedMetadata
+"""
+ ]
+ stdout = [""]
diff --git a/tests/regression_tests/test_regression_allfiles.py b/tests/regression_tests/test_regression_allfiles.py
index 09a218e18..34bea3b03 100644
--- a/tests/regression_tests/test_regression_allfiles.py
+++ b/tests/regression_tests/test_regression_allfiles.py
@@ -124,6 +124,7 @@ def get_valid_files(data_dir):
"pocIssue283.jpg",
"poc_1522.jp2",
"xmpsdk.xmp",
+ "issue_3511_poc.eps",
# large file that creates 11Mb of output so let's exclude it
"ReaganLargeTiff.tiff",
# files that don't create any output

24
meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch Normal file
View File

@ -0,0 +1,24 @@
From b05f12b6c94e946648a681c39c4581b2fe81afc3 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 26 Feb 2026 20:44:54 +0000
Subject: [PATCH] Check for integer overflow.
CVE: CVE-2026-27596
Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/2cb728a850b4aa048a683711906d716c5f9a32ac]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/preview.cpp | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/preview.cpp b/src/preview.cpp
index 993c3b749..90f60146f 100644
--- a/src/preview.cpp
+++ b/src/preview.cpp
@@ -422,6 +422,7 @@ DataBuf LoaderNative::getData() const {
#endif
return {};
}
+ Internal::enforce(sizeData >= 28, ErrorCode::kerCorruptedMetadata);
return {record + sizeHdr + 28, sizeData - 28};
}
throw Error(ErrorCode::kerErrorMessage, "Invalid native preview filter: " + nativePreview_.filter_);

2
meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb
View File

@ -10,6 +10,8 @@ SRC_URI = "git://github.com/Exiv2/exiv2.git;protocol=https;branch=0.28.x \
file://0001-Add-new-method-appendIccProfile-to-fix-quadratic-per.patch \
file://CVE-2026-25884-1.patch \
file://CVE-2026-25884-2.patch \
file://CVE-2026-27596-1.patch \
file://CVE-2026-27596-2.patch \
"
SRCREV = "a6a79ef064f131ffd03c110acce2d3edb84ffa2e"
S = "${WORKDIR}/git"