Re: [Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48

[Julien Olivain via buildroot <buildroot@buildroot.org>]

On 10/09/2026 09:37, Bernd Kuhls wrote:
> https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
> 
> Fixes the following security issues:
> 
> (Security fix for specific API usage, GHSA-2p8c-ff85-vh9x)
>  If pcre2_jit_compile() is called with options for some match modes, 
> and
>  then pcre2_match() is used to perform a match for a different match
>  mode, an out-of-bounds read can occur if the match is attempted 
> against
>  invalid UTF input.
> 
> (Security fix for pattern conversion, GHSA-q8g2-wprr-34m9)
>  If pcre2_convert() is called on untrusted input on platforms with
>  32-bit size_t, an out-of-bounds heap write can occur.
> 
> (Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
>  matching when using a heap limit; also fixed possible integer 
> overflows
>  which could cause under-allocation of the workspace.
> 
> (Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several
>  integer overflows while compiling patterns on 32-bit CPUs, which could
>  cause under-allocation followed by out-of-bounds writes.
> 
> (Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to
>  prevent two out-of-bounds reads while scanning backwards through
>  invalid UTF data with PCRE2_MATCH_INVALID_UTF.
> 
> (Security fix for specific API usage, #937) Fixed a leak and later
>  invalid free when calling the fast-path pcre2_jit_match() function 
> with
>  a match data object previously used with pcre2_match() and
>  PCRE2_COPY_MATCHED_SUBJECT.
> 
> (Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
>  uninitialised bytes from malloc() via pcre2_serialize_encode().
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot