* [Buildroot] [PATCH] package/wget: fix CVE-2026-58470
@ 2026-08-20 9:40 Stefan Mueller via buildroot
2026-08-22 16:39 ` Julien Olivain via buildroot
0 siblings, 1 reply; 2+ messages in thread
From: Stefan Mueller via buildroot @ 2026-08-20 9:40 UTC (permalink / raw)
To: buildroot; +Cc: Bernd Kuhls, Stefan Müller
From: Stefan Müller <stemu86@gmx.ch>
Backport the upstream fix for integer overflows while parsing Content-Range headers, together with the follow-up fix using strtoll() for wgint values.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
---
...e_content_range-Fix-integer-overflow.patch | 80 +++++++++++++++++++
..._range-Use-strtoll-instead-of-strtol.patch | 48 +++++++++++
package/wget/wget.mk | 4 +
3 files changed, 132 insertions(+)
create mode 100644 package/wget/0005-src-http.c-parse_content_range-Fix-integer-overflow.patch
create mode 100644 package/wget/0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch
diff --git a/package/wget/0005-src-http.c-parse_content_range-Fix-integer-overflow.patch b/package/wget/0005-src-http.c-parse_content_range-Fix-integer-overflow.patch
new file mode 100644
index 0000000000..c36aac458c
--- /dev/null
+++ b/package/wget/0005-src-http.c-parse_content_range-Fix-integer-overflow.patch
@@ -0,0 +1,80 @@
+From 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Mon, 29 Jun 2026 18:57:54 +0200
+Subject: [PATCH] * src/http.c (parse_content_range): Fix integer overflow
+
+Reported-by: TristanInSec@gmail.com
+CVE: CVE-2026-58470
+Upstream: https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
+Signed-off-by: Stefan Müller <stemu86@gmx.ch>
+
+---
+ src/http.c | 35 ++++++++++++++++++++++++-----------
+ 1 file changed, 24 insertions(+), 11 deletions(-)
+
+diff --git a/src/http.c b/src/http.c
+index 61d83df1..f447c7f7 100644
+--- a/src/http.c
++++ b/src/http.c
+@@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
+ wgint *last_byte_ptr, wgint *entity_length_ptr)
+ {
+ wgint num;
++ char *end;
+
+ /* Ancient versions of Netscape proxy server, presumably predating
+ rfc2068, sent out `Content-Range' without the "bytes"
+@@ -932,27 +933,39 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
+ }
+ if (!c_isdigit (*hdr))
+ return false;
+- for (num = 0; c_isdigit (*hdr); hdr++)
+- num = 10 * num + (*hdr - '0');
+- if (*hdr != '-' || !c_isdigit (*(hdr + 1)))
++
++ errno = 0;
++ num = strtol(hdr, &end, 10);
++ if (errno == ERANGE)
++ return false;
++ hdr = end;
++
++ if (*hdr++ != '-' || !c_isdigit (*hdr))
+ return false;
+ *first_byte_ptr = num;
+- ++hdr;
+- for (num = 0; c_isdigit (*hdr); hdr++)
+- num = 10 * num + (*hdr - '0');
+- if (*hdr != '/')
++
++ errno = 0;
++ num = strtol(hdr, &end, 10);
++ if (errno == ERANGE)
++ return false;
++ hdr = end;
++
++ if (*hdr++ != '/')
+ return false;
+ *last_byte_ptr = num;
+- if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*'))
++ if (!(c_isdigit (*hdr) || *hdr == '*'))
+ return false;
+ if (*last_byte_ptr < *first_byte_ptr)
+ return false;
+- ++hdr;
+ if (*hdr == '*')
+ num = -1;
+ else
+- for (num = 0; c_isdigit (*hdr); hdr++)
+- num = 10 * num + (*hdr - '0');
++ {
++ errno = 0;
++ num = strtol(hdr, NULL, 10);
++ if (errno == ERANGE)
++ return false;
++ }
+ *entity_length_ptr = num;
+ if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1)
+ return false;
+--
+GitLab
+
diff --git a/package/wget/0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch b/package/wget/0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch
new file mode 100644
index 0000000000..9c484dda32
--- /dev/null
+++ b/package/wget/0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch
@@ -0,0 +1,48 @@
+From 01ff771caac1958662ca8665eed2021ec386a7af Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Wed, 12 Aug 2026 19:45:21 +0200
+Subject: [PATCH] * src/http.c (parse_content_range): Use strtoll instead of
+ strtol.
+
+CVE: CVE-2026-58470
+Upstream: https://gitlab.com/gnuwget/wget/-/commit/01ff771caac1958662ca8665eed2021ec386a7af
+Signed-off-by: Stefan Müller <stemu86@gmx.ch>
+
+---
+ src/http.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/http.c b/src/http.c
+index e5e75ee6..8170a43c 100644
+--- a/src/http.c
++++ b/src/http.c
+@@ -949,7 +949,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
+ return false;
+
+ errno = 0;
+- num = strtol(hdr, &end, 10);
++ num = strtoll(hdr, &end, 10);
+ if (errno == ERANGE)
+ return false;
+ hdr = end;
+@@ -959,7 +959,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
+ *first_byte_ptr = num;
+
+ errno = 0;
+- num = strtol(hdr, &end, 10);
++ num = strtoll(hdr, &end, 10);
+ if (errno == ERANGE)
+ return false;
+ hdr = end;
+@@ -976,7 +976,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
+ else
+ {
+ errno = 0;
+- num = strtol(hdr, NULL, 10);
++ num = strtoll(hdr, NULL, 10);
+ if (errno == ERANGE)
+ return false;
+ }
+--
+GitLab
+
diff --git a/package/wget/wget.mk b/package/wget/wget.mk
index 8118811efe..015fc0c59e 100644
--- a/package/wget/wget.mk
+++ b/package/wget/wget.mk
@@ -17,6 +17,10 @@ WGET_CPE_ID_VENDOR = gnu
# 0004-src-metalink.c-Include-ctype.h.patch
WGET_IGNORE_CVES += CVE-2026-58469
+# 0005-src-http.c-parse_content_range-Fix-integer-overflow.patch
+# 0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch
+WGET_IGNORE_CVES += CVE-2026-58470
+
WGET_CONF_OPTS += --disable-pcre
ifeq ($(BR2_PACKAGE_LIBPSL),y)
--
2.25.1
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-22 16:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-20 9:40 [Buildroot] [PATCH] package/wget: fix CVE-2026-58470 Stefan Mueller via buildroot
2026-08-22 16:39 ` Julien Olivain via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox