Re: [OE-core][scarthgap][PATCH 5/8] curl: fix CVE-2026-8927

["Yoann Congal" <yoann.congal@smile.fr>]

Hello,

On Wed Oct 7, 2026 at 1:24 PM CEST, Devansh Patel via lists.openembedded.org wrote:
> From: Devansh Patel <devanshp@cisco.com>
>
> This patch applies the upstream fix as referenced in [3], using the
> commits shown in [1] and [2].
>
> [1] https://github.com/curl/curl/commit/1968b32afd8e41fbb87f8911d15c552c6b705385
> [2] https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567
> [3] https://curl.se/docs/CVE-2026-8927.html
>
> Signed-off-by: Devansh Patel <devanshp@cisco.com>
> ---
>  .../curl/curl/CVE-2026-8927-dependent.patch   |  41 ++
>  .../curl/curl/CVE-2026-8927.patch             | 378 ++++++++++++++++++
>  meta/recipes-support/curl/curl_8.7.1.bb       |   2 +
>  3 files changed, 421 insertions(+)
>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch
>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927.patch b/meta/recipes-support/curl/curl/CVE-2026-8927.patch
> +diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c
> +new file mode 100644
> +index 0000000000..16dc9d711c
> +--- /dev/null
> ++++ b/tests/libtest/lib1647.c
> ++/*
> ++ * argv1 = the first URL
> ++ * argv2 = URL2
> ++ * argv3 = credentials 1
> ++ * argv4 = credentials 2
> ++ */
> ++
> ++#include "test.h"
> ++#include "testutil.h"
> ++
> ++/* this is meant to pick up the proxy from the environment variable */
> ++static CURLcode init1647(CURL *curl, const char *url, const char *userpwd)
> ++{
> ++  CURLcode res = CURLE_OK;

Hello,

This patch contains changed code from the upstream patch. For exemple,
result -> res. This might seen minor but it might hide more problematic
changes.

Can you check by comparing with upstream patch that the diff is minimal?

Thanks!
-- 
Yoann Congal
Smile ECS