From: Peter Marko <peter.marko@siemens.com>
To: openembedded-core@lists.openembedded.org
Cc: Peter Marko <peter.marko@siemens.com>
Subject: [scarthgap][PATCH] libpcre2: update to latest release branch hash 50b3c0d7ce
Date: Sat, 17 Oct 2026 00:02:49 +0200 [thread overview]
Message-ID: <20261016220249.3564587-1-peter.marko@siemens.com> (raw)
From: Peter Marko <peter.marko@siemens.com>
Handles CVE-2026-103111, CVE-2026-86145, CVE-2026-89158, CVE-2026-89160,
CVE-2026-89157, CVE-2026-89156 and CVE-2026-89161.
The project committed to have 5 year security support for each release
on a dedicated release branch.
Switch from release tarball to git fetcher to use this feature.
Git log with all changes and manually created CVE annotations:
$ git log --oneline pcre2-10.43..50b3c0d7ceaf23578d04e644c02781c322ef6cb0
50b3c0d7 Backport of pcre2-10.49-Fix-large-stack-allocation.patch [CVE-2026-103111]
b7d3ffd4 Backport of pcre2-10.48-Fix-DFA-workspace-overflows.patch [CVE-2026-86145]
9c11f0dc Backport of pcre2-10.48-Fix-compiler-integer-overflows.patch [CVE-2026-89158]
2866e543 Backport of pcre2-10.48-Fix-invalid-UTF-backwards-scans.patch [CVE-2026-89160]
714e1062 Backport of pcre2-10.48-Fix-allocation-byte-sizing.patch [CVE-2026-89157]
91759151 Backport of pcre2-10.48-Check-JIT-mode-before-validation.patch [CVE-2026-89156]
87f50503 Backport of pcre2-10.48-Fix-JIT-match-context-reuse.patch [CVE-2026-89161]
ed0e58f5 Backport of pcre2-10.48-Fix-JIT-STR_END.patch
dc733f56 Backport of pcre2-10.44-Fix-incorrect-compiling.patch
7f3e5400 Backport of pcre2-10.44-Fix-locking-region.patch
Diff of release tarball and git repository is:
Only in pcre2-10.43/: aclocal.m4
Only in pcre2-10.43/: ar-lib
Only in libpcre2-10.43+git/: autogen.sh
Only in libpcre2-10.43+git/: .bazelrc
Only in libpcre2-10.43+git/: BUILD.bazel
Only in libpcre2-10.43+git/: build.zig
Only in pcre2-10.43/: compile
Only in pcre2-10.43/: config.guess
Only in pcre2-10.43/: config.sub
Only in pcre2-10.43/: configure
Only in pcre2-10.43/: depcomp
Only in libpcre2-10.43+git/: .git
Only in libpcre2-10.43+git/: .github
Only in libpcre2-10.43+git/: .gitignore
Only in libpcre2-10.43+git/: index.md
Only in pcre2-10.43/: INSTALL
Only in pcre2-10.43/: install-sh
Only in pcre2-10.43/: ltmain.sh
Only in pcre2-10.43/m4: libtool.m4
Only in pcre2-10.43/m4: lt~obsolete.m4
Only in pcre2-10.43/m4: ltoptions.m4
Only in pcre2-10.43/m4: ltsugar.m4
Only in pcre2-10.43/m4: ltversion.m4
Only in libpcre2-10.43+git/: maint
Only in pcre2-10.43/: Makefile.in
Only in pcre2-10.43/: missing
Only in libpcre2-10.43+git/: MODULE.bazel
Only in libpcre2-10.43+git/: pcre2_fuzzer_16.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer_16.options
Only in libpcre2-10.43+git/: pcre2_fuzzer_32.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer_32.options
Only in libpcre2-10.43+git/: pcre2_fuzzer.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer.options
Only in libpcre2-10.43+git/: README.md
Only in pcre2-10.43/: test-driver
Only in libpcre2-10.43+git/: WORKSPACE.bazel
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
.../recipes-support/libpcre/libpcre2_10.43.bb | 20 +++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/meta/recipes-support/libpcre/libpcre2_10.43.bb b/meta/recipes-support/libpcre/libpcre2_10.43.bb
index f744df88fad..743b0ec04e5 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.43.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.43.bb
@@ -10,23 +10,27 @@ SECTION = "devel"
LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENCE;md5=321a5eb46acae6b6c1ff2c7a866d836a"
-SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2"
-
-GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
-UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
-
-SRC_URI[sha256sum] = "e2a53984ff0b07dfdb5ae4486bbb9b21cca8e7df2434096cc9bf1b728c350bcb"
+BASE_VER = "${@d.getVar('PV').split('+')[0]}"
+SRC_URI = "git://github.com/PCRE2Project/pcre2;protocol=https;branch=release/pcre2-${BASE_VER}"
+SRCREV = "50b3c0d7ceaf23578d04e644c02781c322ef6cb0"
+PV .= "+git"
CVE_PRODUCT = "pcre2"
-S = "${WORKDIR}/pcre2-${PV}"
+CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
+CVE_STATUS_STABLE_BACKPORTS = "CVE-2026-103111 CVE-2026-86145 CVE-2026-89158 CVE-2026-89160 \
+ CVE-2026-89157 CVE-2026-89156 CVE-2026-89161 \
+"
+CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
+
+S = "${WORKDIR}/git"
PROVIDES += "pcre2"
DEPENDS += "bzip2 zlib"
BINCONFIG = "${bindir}/pcre2-config"
-inherit autotools binconfig-disabled github-releases
+inherit autotools binconfig-disabled
EXTRA_OECONF = "\
--enable-newline-is-lf \
reply other threads:[~2026-10-16 22:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261016220249.3564587-1-peter.marko@siemens.com \
--to=peter.marko@siemens.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox