Re: [scarthgap][PATCH 5/8] curl: fix CVE-2026-8927

["Devansh Patel" <devanshp@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 1973 bytes --]

Hi Yoann,

I have rebased the remaining four patches (5/8–8/8) onto stable/scarthgap-review
and Sent v2 [1][2][3][4]. The backport notes now explain the test.h macro requirements,
and the commit messages include the validation results.

The fresh Scarthgap build succeeded along with ptests passing with no failures.

[1] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patch_v2_5_8/121787397
[2] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patch_v2_6_8/121787401
[3] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patch_v2_7_8/121787398
[4] https://lists.openembedded.org/g/openembedded-core/topic/scarthgap_patch_v2_8_8/121787400

Regards,
Devansh

On Fri, Oct 16, 2026 at 03:03 AM, Yoann Congal wrote:

> 
> On Thu Oct 15, 2026 at 10:27 AM CEST, Devansh Patel -X (devanshp - E
> INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> 
>> Hi Yoann,
> 
> Hello,
> 
> 
>> I compared the submitted backport with upstream. curl 8.7.1 lacks
>> first.h and uses the older test.h harness. Its res_easy_setopt() and
>> res_global_init() macros assign to res, requiring the rename in
>> init1647() and test().
> 
> Ok, now I see it. To give you an idea, this is the kind of info I want
> in the backport notes. Can you send a v2 of the series with that added?
> You will have to rebase on top of stable/scarthgap-review, I took some
> patches of the series.
> 
> 
>> run1647() retains upstream’s result. Following
>> your earlier feedback [1], init1647() also retains the CURLcode type.
>> With those adjustments, the test passes; reversing the library fix
>> reproduces the Digest header leak.
> 
> This info can go into your commit message. Knowing what kind of test was
> done is always good.
> 
> 
>> [1] https://www.mail-archive.com/openembedded-core%40lists.openembedded.org/msg226412.html
>> 
>> Regards,
>> Devansh
> 
> Thanks!
> --
> Yoann Congal
> Smile ECS

[-- Attachment #2: Type: text/html, Size: 2881 bytes --]