[OE-core][wrynose][PATCH 4/5] curl: fix CVE-2026-82208

["Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" <dkelaiya@cisco.com>]

From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a
[2] https://curl.se/docs/CVE-2026-82208.html

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../curl/curl/CVE-2026-82208.patch            | 52 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
 2 files changed, 53 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-82208.patch b/meta/recipes-support/curl/curl/CVE-2026-82208.patch
new file mode 100644
index 0000000000..2c733de210
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-82208.patch
@@ -0,0 +1,52 @@
+From ed0338befd1d865a8ea1fbaa90013a096dedd07a Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Wed, 26 Aug 2026 13:46:13 +0200
+Subject: [PATCH] wolfssl: do not run Curl_wssl_setup_x509_store() twice
+
+The flag preventing a rerun was not set when a cached_store
+was used.
+
+CURL_UNCONST an ech string for my old wolfssl version
+
+Closes #22689
+
+CVE: CVE-2026-82208
+Upstream-Status: Backport [https://github.com/curl/curl/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a]
+
+Backport Changes:
+- Omitted the unrelated CURL_UNCONST ECH compatibility change because
+  curl 8.19.0 uses a mutable ECH configuration string and a different
+  code path.
+
+(cherry picked from commit ed0338befd1d865a8ea1fbaa90013a096dedd07a)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/vtls/wolfssl.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
+index 74bd247..fdf33a8 100644
+--- a/lib/vtls/wolfssl.c
++++ b/lib/vtls/wolfssl.c
+@@ -597,9 +597,6 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
+   bool imported_native_ca = FALSE;
+   bool imported_ca_info_blob = FALSE;
+ 
+-  /* We do not want to do this again, no matter the outcome */
+-  wssl->x509_store_setup = TRUE;
+-
+ #ifndef NO_FILESYSTEM
+   /* load native CA certificates */
+   if(ssl_config->native_ca_store) {
+@@ -802,6 +799,9 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf,
+   WOLFSSL_X509_STORE *cached_store;
+   bool cache_criteria_met;
+ 
++  /* We do not want to do this again, no matter the outcome */
++  wssl->x509_store_setup = TRUE;
++
+   /* Consider the X509 store cacheable if it comes exclusively from a CAfile,
+      or no source is provided and we are falling back to wolfSSL's built-in
+      default. */
+-- 
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 33954465f7..0418bec61c 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -44,6 +44,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2026-11564.patch \
            file://CVE-2026-80255-dependent.patch \
            file://CVE-2026-80255.patch \
+           file://CVE-2026-82208.patch \
            file://CVE-2026-80230.patch \
            "
 
-- 
2.35.6