Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCH] package/libconfuse: bump to version 3.4
@ 2026-09-08  8:35 Michael Fischer
  2026-09-13 10:25 ` Fiona Klute via buildroot
  0 siblings, 1 reply; 2+ messages in thread
From: Michael Fischer @ 2026-09-08  8:35 UTC (permalink / raw)
  To: buildroot; +Cc: Michael Fischer

The backported fix is dropped, as 3.4 ships it:

  0001-Fix-163-unterminated-username-used-with-getpwnam.patch
    -> upstream commit d73777c2c356, released in 3.4

With the patch gone, LIBCONFUSE_IGNORE_CVES is no longer needed either.

3.4 also fixes three robustness defects that carry no CVE:

  #180  isspace() argument fix, could crash the lexer
  #182  stack exhaustion from deeply nested sections
  #187  null dereference on an empty comment with CFGF_COMMENTS

Signed-off-by: Michael Fischer <mf@go-sys.de>
---
 ...rminated-username-used-with-getpwnam.patch | 43 -------------------
 package/libconfuse/libconfuse.hash            |  4 +-
 package/libconfuse/libconfuse.mk              |  5 +--
 3 files changed, 2 insertions(+), 50 deletions(-)
 delete mode 100644 package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch

diff --git a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
deleted file mode 100644
index 44e15468ac..0000000000
--- a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From d73777c2c3566fb2647727bb56d9a2295b81669b Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Fri, 2 Sep 2022 16:12:46 +0200
-Subject: [PATCH] Fix #163: unterminated username used with getpwnam()
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
-
-CVE: CVE-2022-40320
-Upstream: https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
----
- src/confuse.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/src/confuse.c b/src/confuse.c
-index 6d1fdbd..05566b5 100644
---- a/src/confuse.c
-+++ b/src/confuse.c
-@@ -1894,18 +1894,20 @@ DLLIMPORT char *cfg_tilde_expand(const char *filename)
- 			passwd = getpwuid(geteuid());
- 			file = filename + 1;
- 		} else {
--			/* ~user or ~user/path */
--			char *user;
-+			char *user; /* ~user or ~user/path */
-+			size_t len;
- 
- 			file = strchr(filename, '/');
- 			if (file == 0)
- 				file = filename + strlen(filename);
- 
--			user = malloc(file - filename);
-+			len = file - filename - 1;
-+			user = malloc(len + 1);
- 			if (!user)
- 				return NULL;
- 
--			strncpy(user, filename + 1, file - filename - 1);
-+			strncpy(user, &filename[1], len);
-+			user[len] = 0;
- 			passwd = getpwnam(user);
- 			free(user);
- 		}
diff --git a/package/libconfuse/libconfuse.hash b/package/libconfuse/libconfuse.hash
index bb968f7a52..19453828d8 100644
--- a/package/libconfuse/libconfuse.hash
+++ b/package/libconfuse/libconfuse.hash
@@ -1,5 +1,3 @@
-# From https://github.com/martinh/libconfuse/releases/download/v3.3/confuse-3.3.tar.xz.md5
-md5  a183cef2cecdd3783436ff8de500d274  confuse-3.3.tar.xz
 # Locally computed
-sha256  1dd50a0320e135a55025b23fcdbb3f0a81913b6d0b0a9df8cc2fdf3b3dc67010  confuse-3.3.tar.xz
+sha256  36bfa3928f9c323914c7c8317e8722cb22f41db69d7c9d4c24b4689fa955445d  confuse-3.4.tar.xz
 sha256  dc3ff4b62f851dd2e94a151061ffeb7d28ddfc880a442068dc5283dbaa927306  LICENSE
diff --git a/package/libconfuse/libconfuse.mk b/package/libconfuse/libconfuse.mk
index fff684a55b..ac3866f746 100644
--- a/package/libconfuse/libconfuse.mk
+++ b/package/libconfuse/libconfuse.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBCONFUSE_VERSION = 3.3
+LIBCONFUSE_VERSION = 3.4
 LIBCONFUSE_SOURCE = confuse-$(LIBCONFUSE_VERSION).tar.xz
 LIBCONFUSE_SITE = https://github.com/libconfuse/libconfuse/releases/download/v$(LIBCONFUSE_VERSION)
 LIBCONFUSE_INSTALL_STAGING = YES
@@ -14,8 +14,5 @@ LIBCONFUSE_LICENSE_FILES = LICENSE
 LIBCONFUSE_CPE_ID_VALID = YES
 LIBCONFUSE_DEPENDENCIES = $(TARGET_NLS_DEPENDENCIES)
 
-# 0001-Fix-163-unterminated-username-used-with-getpwnam.patch
-LIBCONFUSE_IGNORE_CVES += CVE-2022-40320
-
 $(eval $(autotools-package))
 $(eval $(host-autotools-package))
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 2+ messages in thread
* Re: [Buildroot] [PATCH] package/libconfuse: bump to version 3.4
  2026-09-08  8:35 [Buildroot] [PATCH] package/libconfuse: bump to version 3.4 Michael Fischer
@ 2026-09-13 10:25 ` Fiona Klute via buildroot
  0 siblings, 0 replies; 2+ messages in thread
From: Fiona Klute via buildroot @ 2026-09-13 10:25 UTC (permalink / raw)
  To: Michael Fischer, buildroot

Am 08.09.26 um 10:35 schrieb Michael Fischer:
> The backported fix is dropped, as 3.4 ships it:
> 
>    0001-Fix-163-unterminated-username-used-with-getpwnam.patch
>      -> upstream commit d73777c2c356, released in 3.4
> 
> With the patch gone, LIBCONFUSE_IGNORE_CVES is no longer needed either.
> 
> 3.4 also fixes three robustness defects that carry no CVE:
> 
>    #180  isspace() argument fix, could crash the lexer
>    #182  stack exhaustion from deeply nested sections
>    #187  null dereference on an empty comment with CFGF_COMMENTS
> 
> Signed-off-by: Michael Fischer <mf@go-sys.de>

Applied to master, thank you. FYI, I've added a link to the upstream 
release notes to the commit message.

> ---
>   ...rminated-username-used-with-getpwnam.patch | 43 -------------------
>   package/libconfuse/libconfuse.hash            |  4 +-
>   package/libconfuse/libconfuse.mk              |  5 +--
>   3 files changed, 2 insertions(+), 50 deletions(-)
>   delete mode 100644 package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
> 
> diff --git a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
> deleted file mode 100644
> index 44e15468ac..0000000000
> --- a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
> +++ /dev/null
> @@ -1,43 +0,0 @@
> -From d73777c2c3566fb2647727bb56d9a2295b81669b Mon Sep 17 00:00:00 2001
> -From: Joachim Wiberg <troglobit@gmail.com>
> -Date: Fri, 2 Sep 2022 16:12:46 +0200
> -Subject: [PATCH] Fix #163: unterminated username used with getpwnam()
> -
> -Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
> -
> -CVE: CVE-2022-40320
> -Upstream: https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
> -Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ----
> - src/confuse.c | 10 ++++++----
> - 1 file changed, 6 insertions(+), 4 deletions(-)
> -
> -diff --git a/src/confuse.c b/src/confuse.c
> -index 6d1fdbd..05566b5 100644
> ---- a/src/confuse.c
> -+++ b/src/confuse.c
> -@@ -1894,18 +1894,20 @@ DLLIMPORT char *cfg_tilde_expand(const char *filename)
> - 			passwd = getpwuid(geteuid());
> - 			file = filename + 1;
> - 		} else {
> --			/* ~user or ~user/path */
> --			char *user;
> -+			char *user; /* ~user or ~user/path */
> -+			size_t len;
> -
> - 			file = strchr(filename, '/');
> - 			if (file == 0)
> - 				file = filename + strlen(filename);
> -
> --			user = malloc(file - filename);
> -+			len = file - filename - 1;
> -+			user = malloc(len + 1);
> - 			if (!user)
> - 				return NULL;
> -
> --			strncpy(user, filename + 1, file - filename - 1);
> -+			strncpy(user, &filename[1], len);
> -+			user[len] = 0;
> - 			passwd = getpwnam(user);
> - 			free(user);
> - 		}
> diff --git a/package/libconfuse/libconfuse.hash b/package/libconfuse/libconfuse.hash
> index bb968f7a52..19453828d8 100644
> --- a/package/libconfuse/libconfuse.hash
> +++ b/package/libconfuse/libconfuse.hash
> @@ -1,5 +1,3 @@
> -# From https://github.com/martinh/libconfuse/releases/download/v3.3/confuse-3.3.tar.xz.md5
> -md5  a183cef2cecdd3783436ff8de500d274  confuse-3.3.tar.xz
>   # Locally computed
> -sha256  1dd50a0320e135a55025b23fcdbb3f0a81913b6d0b0a9df8cc2fdf3b3dc67010  confuse-3.3.tar.xz
> +sha256  36bfa3928f9c323914c7c8317e8722cb22f41db69d7c9d4c24b4689fa955445d  confuse-3.4.tar.xz
>   sha256  dc3ff4b62f851dd2e94a151061ffeb7d28ddfc880a442068dc5283dbaa927306  LICENSE
> diff --git a/package/libconfuse/libconfuse.mk b/package/libconfuse/libconfuse.mk
> index fff684a55b..ac3866f746 100644
> --- a/package/libconfuse/libconfuse.mk
> +++ b/package/libconfuse/libconfuse.mk
> @@ -4,7 +4,7 @@
>   #
>   ################################################################################
>   
> -LIBCONFUSE_VERSION = 3.3
> +LIBCONFUSE_VERSION = 3.4
>   LIBCONFUSE_SOURCE = confuse-$(LIBCONFUSE_VERSION).tar.xz
>   LIBCONFUSE_SITE = https://github.com/libconfuse/libconfuse/releases/download/v$(LIBCONFUSE_VERSION)
>   LIBCONFUSE_INSTALL_STAGING = YES
> @@ -14,8 +14,5 @@ LIBCONFUSE_LICENSE_FILES = LICENSE
>   LIBCONFUSE_CPE_ID_VALID = YES
>   LIBCONFUSE_DEPENDENCIES = $(TARGET_NLS_DEPENDENCIES)
>   
> -# 0001-Fix-163-unterminated-username-used-with-getpwnam.patch
> -LIBCONFUSE_IGNORE_CVES += CVE-2022-40320
> -
>   $(eval $(autotools-package))
>   $(eval $(host-autotools-package))
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-13 10:25 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-08  8:35 [Buildroot] [PATCH] package/libconfuse: bump to version 3.4 Michael Fischer
2026-09-13 10:25 ` Fiona Klute via buildroot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox