Re: [OE-core] [PATCH 22/24] libpcre2: upgrade 10.48 -> 10.49

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Mon Oct 5, 2026 at 11:06 AM CEST, Yoann Congal via lists.openembedded.org wrote:
> On Wed Sep 30, 2026 at 10:16 AM CEST, Mathieu Dubois-Briand via lists.openembedded.org wrote:
>> Version 10.49 28-September-2026
>> -------------------------------
>>
>> This is a security-only release, to address GHSA-r9hj-j2rw-4q3m.
>>
>> Compared to 10.48, this release has only a minimal code change to prevent an
>> out-of-bounds write with arbitrary data. An attacker-controlled regex pattern
>> is required, and applications are only affected if using the
>> pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable
>> JIT stack, and then matching against a pattern with unusually high JIT stack
>> usage, such as a large number of capturing groups.
>>
>> The implications of an out-of-bounds write could include arbitrary code
>> execution.
>>
>> The issue is not a regression and affects releases 10.48 and earlier.
>>
>> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
>> ---
>>  meta/recipes-support/libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/meta/recipes-support/libpcre/libpcre2_10.48.bb b/meta/recipes-support/libpcre/libpcre2_10.49.bb
>> similarity index 96%
>> rename from meta/recipes-support/libpcre/libpcre2_10.48.bb
>> rename to meta/recipes-support/libpcre/libpcre2_10.49.bb
>> index 56791171c238..5fa7c3db3b4c 100644
>> --- a/meta/recipes-support/libpcre/libpcre2_10.48.bb
>> +++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb
>> @@ -20,7 +20,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \
>>  GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
>>  UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
>>  
>> -SRC_URI[sha256sum] = "b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed"
>> +SRC_URI[sha256sum] = "53c156e1ba416a20da8e65395daa132da0d80e76910424caca3fcdae7831d384"
>>  
>>  CVE_PRODUCT = "pcre2"
>>  
>
> Hello,
>
> Shouldn't this patch have removed 
> meta/recipes-support/libpcre/libpcre2/testoutput3C ?
>
> See: https://git.openembedded.org/openembedded-core/commit/?id=3c447001749427b151dc2e6f08c790bac77b1c43
>
> Regards,

Hi,

I assumed it had to stay for this release, but my tests are proving me
wrong. I will send a patch to remove it.

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com