From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4426ACCA462 for ; Fri, 16 Oct 2026 13:10:32 +0000 (UTC) Subject: Re: [scarthgap][PATCH 5/8] curl: fix CVE-2026-8927 To: openembedded-core@lists.openembedded.org From: "Devansh Patel" X-Originating-Location: Mumbai, Maharashtra, IN (151.186.177.21) X-Originating-Platform: Windows Edge 155 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Fri, 16 Oct 2026 06:10:23 -0700 References: <20261007112403.486499-1-devanshp@cisco.com> <20261007112403.486499-5-devanshp@cisco.com> In-Reply-To: Message-ID: <2040945.1792156223788444481@lists.openembedded.org> Content-Type: multipart/alternative; boundary="218e4RBUyGY5cvUx1lms" List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 13:10:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248022 --218e4RBUyGY5cvUx1lms Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Yoann, I have rebased the remaining four patches (5/8=E2=80=938/8) onto stable/sca= rthgap-review and Sent v2 [1][2][3][4]. The backport notes now explain the test.h macro r= equirements, and the commit messages include the validation results. The fresh Scarthgap build succeeded along with ptests passing with no failu= res. [1] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patc= h_v2_5_8/121787397 [2] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patc= h_v2_6_8/121787401 [3] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patc= h_v2_7_8/121787398 [4] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patc= h_v2_8_8/121787400 Regards, Devansh On Fri, Oct 16, 2026 at 03:03 AM, Yoann Congal wrote: >=20 > On Thu Oct 15, 2026 at 10:27 AM CEST, Devansh Patel -X (devanshp - E > INFOCHIPS PRIVATE LIMITED at Cisco) wrote: >=20 >> Hi Yoann, >=20 > Hello, >=20 >=20 >> I compared the submitted backport with upstream. curl 8.7.1 lacks >> first.h and uses the older test.h harness. Its res_easy_setopt() and >> res_global_init() macros assign to res, requiring the rename in >> init1647() and test(). >=20 > Ok, now I see it. To give you an idea, this is the kind of info I want > in the backport notes. Can you send a v2 of the series with that added? > You will have to rebase on top of stable/scarthgap-review, I took some > patches of the series. >=20 >=20 >> run1647() retains upstream=E2=80=99s result. Following >> your earlier feedback [1], init1647() also retains the CURLcode type. >> With those adjustments, the test passes; reversing the library fix >> reproduces the Digest header leak. >=20 > This info can go into your commit message. Knowing what kind of test was > done is always good. >=20 >=20 >> [1] https://www.mail-archive.com/openembedded-core%40lists.openembedded.= org/msg226412.html >>=20 >> Regards, >> Devansh >=20 > Thanks! > -- > Yoann Congal > Smile ECS --218e4RBUyGY5cvUx1lms Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
Hi Yoann,

I have rebased the remaining four patches (5/8&nd= ash;8/8) onto stable/scarthgap-review
and Sent v2 [1][2][3][4]. The b= ackport notes now explain the test.h macro requirements,
and the commi= t messages include the validation results.

The fresh Scarthgap b= uild succeeded along with ptests passing with no failures.

[1] <= a href=3D"https://lists.openembedded.org/g/openembedded-core/topic/scarthga= p_patch_v2_5_8/121787397" target=3D"_blank" rel=3D"noopener">https://lists.= openembedded.org/g/openembedded-core/topic/scarthgap_patch_v2_5_8/121787397=
[2] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patch_v= 2_6_8/121787401
 
On Fri, Oct 16, 2026 at 03:03 AM, Yoann Congal wrote:
On Thu Oct 15, 2026 at 10:27 AM CEST, Devansh Patel -X (devansh= p - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
Hi Yoann,
Hello,

I compared the submitted backport with upstream. curl 8.7.1 lac= ks
first.h and uses the older test.h harness. Its res_easy_setopt() an= d
res_global_init() macros assign to res, requiring the rename in
init1647() and test().
Ok, now I see it. To give you an idea, this is the kind of info I want
in the backport notes. Can you send a v2 of the series with that added?You will have to rebase on top of stable/scarthgap-review, I took somepatches of the series.

run1647() retains upstream’s result. Following
your = earlier feedback [1], init1647() also retains the CURLcode type.
With = those adjustments, the test passes; reversing the library fix
reproduc= es the Digest header leak.
This info can go into your commit message. Knowing what kind of test wasdone is always good.

[1] = https://www.mail-archive.com/openembedded-core%40lists.openembedded.org/msg= 226412.html
Regards,
Devansh
Thanks!
--
Yoann Congal
Smile ECS
--218e4RBUyGY5cvUx1lms--