* [OE-core][scarthgap 01/16] openssh: Fix CVE-2025-26466
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 02/16] curl: ignore CVE-2025-0725 Steve Sakoman
` (14 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
(inclusive) is vulnerable to a memory/CPU denial-of-service related
to the handling of SSH2_MSG_PING packets. This condition may be
mitigated using the existing PerSourcePenalties feature.
Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2]
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../openssh/openssh/CVE-2025-26466.patch | 38 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 39 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-26466.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2025-26466.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2025-26466.patch
new file mode 100644
index 0000000000..27b2fa7143
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2025-26466.patch
@@ -0,0 +1,38 @@
+From 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 18 Feb 2025 08:02:12 +0000
+Subject: [PATCH] upstream: Don't reply to PING in preauth phase or during KEX
+
+Reported by the Qualys Security Advisory team. ok markus@
+
+OpenBSD-Commit-ID: c656ac4abd1504389d1733d85152044b15830217
+
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2]
+CVE: CVE-2025-26466
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ packet.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/packet.c b/packet.c
+index beb214f..aeab98c 100644
+--- a/packet.c
++++ b/packet.c
+@@ -1773,6 +1773,14 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
+ if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0)
+ return r;
+ DBG(debug("Received SSH2_MSG_PING len %zu", len));
++ if (!ssh->state->after_authentication) {
++ DBG(debug("Won't reply to PING in preauth"));
++ break;
++ }
++ if (ssh_packet_is_rekeying(ssh)) {
++ DBG(debug("Won't reply to PING during KEX"));
++ break;
++ }
+ if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
+ (r = sshpkt_put_string(ssh, d, len)) != 0 ||
+ (r = sshpkt_send(ssh)) != 0)
+--
+2.25.1
+
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index a8ba67e360..ea5face097 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -29,6 +29,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2024-6387.patch \
file://CVE-2024-39894.patch \
file://0001-Fix-missing-header-for-systemd-notification.patch \
+ file://CVE-2025-26466.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 02/16] curl: ignore CVE-2025-0725
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 01/16] openssh: Fix CVE-2025-26466 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 03/16] xwayland: Fix CVE-2024-9632 Steve Sakoman
` (13 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Poonam Jadhav <poonam.jadhav@kpit.com>
CVE-2025-0725 can only trigger for curl when using a runtime
zlib version 1.2.0.3 or older and scarthgap supports
zlib 1.3.1 version, hence ignore cve for scarthgap
https://curl.se/docs/CVE-2025-0725.html
Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/curl/curl_8.7.1.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 439fcb7881..ddd591dd96 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -27,6 +27,8 @@ SRC_URI[sha256sum] = "6fea2aac6a4610fbd0400afb0bcddbe7258a64c63f1f68e5855ebc0c65
CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"
CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack"
+CVE_STATUS[CVE-2025-0725] = "not-applicable-config: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older"
+
inherit autotools pkgconfig binconfig multilib_header ptest
# Entropy source for random PACKAGECONFIG option
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 03/16] xwayland: Fix CVE-2024-9632
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 01/16] openssh: Fix CVE-2025-26466 Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 02/16] curl: ignore CVE-2025-0725 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 04/16] xwayland: Fix CVE-2025-26594 Steve Sakoman
` (12 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-9632
Upstream patch:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/ba1d14f8eff2a123bd7ff4d48c02e1d5131358e0
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2024-9632.patch | 59 +++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 4 +-
2 files changed, 62 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch
new file mode 100644
index 0000000000..54888f6347
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch
@@ -0,0 +1,59 @@
+From ba1d14f8eff2a123bd7ff4d48c02e1d5131358e0 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Thu, 10 Oct 2024 10:37:28 +0200
+Subject: [PATCH] xkb: Fix buffer overflow in _XkbSetCompatMap()
+
+The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
+buffer.
+
+However, It didn't update its size properly. It updated `num_si` only,
+without updating `size_si`.
+
+This may lead to local privilege escalation if the server is run as root
+or remote code execution (e.g. x11 over ssh).
+
+CVE-2024-9632, ZDI-CAN-24756
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: José Expósito <jexposit@redhat.com>
+(cherry picked from commit 85b77657)
+
+Part-of: <!1734>
+
+CVE: CVE-2024-9632
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/ba1d14f8eff2a123bd7ff4d48c02e1d5131358e0]
+
+Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/xkb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 276dc19..7da00a0 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -2992,13 +2992,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
+ XkbSymInterpretPtr sym;
+ unsigned int skipped = 0;
+
+- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
+- compat->num_si = req->firstSI + req->nSI;
++ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
++ compat->num_si = compat->size_si = req->firstSI + req->nSI;
+ compat->sym_interpret = reallocarray(compat->sym_interpret,
+- compat->num_si,
++ compat->size_si,
+ sizeof(XkbSymInterpretRec));
+ if (!compat->sym_interpret) {
+- compat->num_si = 0;
++ compat->num_si = compat->size_si = 0;
+ return BadAlloc;
+ }
+ }
+--
+2.40.0
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index b934a873d1..c88fdb6e9f 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -9,7 +9,9 @@ HOMEPAGE = "https://fedoraproject.org/wiki/Changes/XwaylandStandalone"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://COPYING;md5=5df87950af51ac2c5822094553ea1880"
-SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz"
+SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
+ file://CVE-2024-9632.patch \
+"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
UPSTREAM_CHECK_REGEX = "xwayland-(?P<pver>\d+(\.(?!90\d)\d+)+)\.tar"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 04/16] xwayland: Fix CVE-2025-26594
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 03/16] xwayland: Fix CVE-2024-9632 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 05/16] xwayland: Fix CVE-2025-26595 Steve Sakoman
` (11 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from
https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26594-1.patch | 54 +++++++++++++++++++
.../xwayland/xwayland/CVE-2025-26594-2.patch | 51 ++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 2 +
3 files changed, 107 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch
new file mode 100644
index 0000000000..f34a89e6ea
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch
@@ -0,0 +1,54 @@
+From 01642f263f12becf803b19be4db95a4a83f94acc Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 27 Nov 2024 11:27:05 +0100
+Subject: [PATCH] Cursor: Refuse to free the root cursor
+
+If a cursor reference count drops to 0, the cursor is freed.
+
+The root cursor however is referenced with a specific global variable,
+and when the root cursor is freed, the global variable may still point
+to freed memory.
+
+Make sure to prevent the rootCursor from being explicitly freed by a
+client.
+
+CVE-2025-26594, ZDI-CAN-25544
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+v2: Explicitly forbid XFreeCursor() on the root cursor (Peter Hutterer
+<peter.hutterer@who-t.net>)
+v3: Return BadCursor instead of BadValue (Michel Danzer
+<michel@daenzer.net>)
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Suggested-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26]
+CVE: CVE-2025-26594
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ dix/dispatch.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/dix/dispatch.c b/dix/dispatch.c
+index 4602961..30b95c1 100644
+--- a/dix/dispatch.c
++++ b/dix/dispatch.c
+@@ -3107,6 +3107,10 @@ ProcFreeCursor(ClientPtr client)
+ rc = dixLookupResourceByType((void **) &pCursor, stuff->id, RT_CURSOR,
+ client, DixDestroyAccess);
+ if (rc == Success) {
++ if (pCursor == rootCursor) {
++ client->errorValue = stuff->id;
++ return BadCursor;
++ }
+ FreeResource(stuff->id, RT_NONE);
+ return Success;
+ }
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch
new file mode 100644
index 0000000000..6ebf540ab9
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch
@@ -0,0 +1,51 @@
+From b0a09ba6020147961acc62d9c73d807b4cccd9f7 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 4 Dec 2024 15:49:43 +1000
+Subject: [PATCH] dix: keep a ref to the rootCursor
+
+CreateCursor returns a cursor with refcount 1 - that refcount is used by
+the resource system, any caller needs to call RefCursor to get their own
+reference. That happens correctly for normal cursors but for our
+rootCursor we keep a variable to the cursor despite not having a ref for
+ourselves.
+
+Fix this by reffing/unreffing the rootCursor to ensure our pointer is
+valid.
+
+Related to CVE-2025-26594, ZDI-CAN-25544
+
+Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6]
+CVE: CVE-2025-26594
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ dix/main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/dix/main.c b/dix/main.c
+index bfc8add..38e29ce 100644
+--- a/dix/main.c
++++ b/dix/main.c
+@@ -231,6 +231,8 @@ dix_main(int argc, char *argv[], char *envp[])
+ FatalError("could not open default cursor font");
+ }
+
++ rootCursor = RefCursor(rootCursor);
++
+ #ifdef PANORAMIX
+ /*
+ * Consolidate window and colourmap information for each screen
+@@ -271,6 +273,8 @@ dix_main(int argc, char *argv[], char *envp[])
+
+ Dispatch();
+
++ UnrefCursor(rootCursor);
++
+ UndisplayDevices();
+ DisableAllDevices();
+
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index c88fdb6e9f..3af0bb9012 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -11,6 +11,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=5df87950af51ac2c5822094553ea1880"
SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-9632.patch \
+ file://CVE-2025-26594-1.patch \
+ file://CVE-2025-26594-2.patch \
"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 05/16] xwayland: Fix CVE-2025-26595
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 04/16] xwayland: Fix CVE-2025-26594 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 06/16] xwayland: Fix CVE-2025-26596 Steve Sakoman
` (10 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda87
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26595.patch | 65 +++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 1 +
2 files changed, 66 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch
new file mode 100644
index 0000000000..a7478d9e2a
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch
@@ -0,0 +1,65 @@
+From 11fcda8753e994e15eb915d28cf487660ec8e722 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 27 Nov 2024 14:41:45 +0100
+Subject: [PATCH] xkb: Fix buffer overflow in XkbVModMaskText()
+
+The code in XkbVModMaskText() allocates a fixed sized buffer on the
+stack and copies the virtual mod name.
+
+There's actually two issues in the code that can lead to a buffer
+overflow.
+
+First, the bound check mixes pointers and integers using misplaced
+parenthesis, defeating the bound check.
+
+But even though, if the check fails, the data is still copied, so the
+stack overflow will occur regardless.
+
+Change the logic to skip the copy entirely if the bound check fails.
+
+CVE-2025-26595, ZDI-CAN-25545
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda87]
+CVE: CVE-2025-26595
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/xkbtext.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
+index 0184664207..93262528bb 100644
+--- a/xkb/xkbtext.c
++++ b/xkb/xkbtext.c
+@@ -173,14 +173,14 @@ XkbVModMaskText(XkbDescPtr xkb,
+ len = strlen(tmp) + 1 + (str == buf ? 0 : 1);
+ if (format == XkbCFile)
+ len += 4;
+- if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) {
+- if (str != buf) {
+- if (format == XkbCFile)
+- *str++ = '|';
+- else
+- *str++ = '+';
+- len--;
+- }
++ if ((str - buf) + len > VMOD_BUFFER_SIZE)
++ continue; /* Skip */
++ if (str != buf) {
++ if (format == XkbCFile)
++ *str++ = '|';
++ else
++ *str++ = '+';
++ len--;
+ }
+ if (format == XkbCFile)
+ sprintf(str, "%sMask", tmp);
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index 3af0bb9012..2215d2fe4d 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -13,6 +13,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-9632.patch \
file://CVE-2025-26594-1.patch \
file://CVE-2025-26594-2.patch \
+ file://CVE-2025-26595.patch \
"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 06/16] xwayland: Fix CVE-2025-26596
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 05/16] xwayland: Fix CVE-2025-26595 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 07/16] xwayland: Fix CVE-2025-26597 Steve Sakoman
` (9 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26596.patch | 49 +++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch
new file mode 100644
index 0000000000..f9df8d75ea
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch
@@ -0,0 +1,49 @@
+From 80d69f01423fc065c950e1ff4e8ddf9f675df773 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Thu, 28 Nov 2024 11:49:34 +0100
+Subject: [PATCH] xkb: Fix computation of XkbSizeKeySyms
+
+The computation of the length in XkbSizeKeySyms() differs from what is
+actually written in XkbWriteKeySyms(), leading to a heap overflow.
+
+Fix the calculation in XkbSizeKeySyms() to match what kbWriteKeySyms()
+does.
+
+CVE-2025-26596, ZDI-CAN-25543
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01]
+CVE: CVE-2025-26596
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/xkb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 85659382da..744dba63d7 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -1095,10 +1095,10 @@ XkbSizeKeySyms(XkbDescPtr xkb, xkbGetMapReply * rep)
+ len = rep->nKeySyms * SIZEOF(xkbSymMapWireDesc);
+ symMap = &xkb->map->key_sym_map[rep->firstKeySym];
+ for (i = nSyms = 0; i < rep->nKeySyms; i++, symMap++) {
+- if (symMap->offset != 0) {
+- nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width;
+- nSyms += nSymsThisKey;
+- }
++ nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width;
++ if (nSymsThisKey == 0)
++ continue;
++ nSyms += nSymsThisKey;
+ }
+ len += nSyms * 4;
+ rep->totalSyms = nSyms;
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index 2215d2fe4d..63803a7a44 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -14,6 +14,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26594-1.patch \
file://CVE-2025-26594-2.patch \
file://CVE-2025-26595.patch \
+ file://CVE-2025-26596.patch \
"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 07/16] xwayland: Fix CVE-2025-26597
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 06/16] xwayland: Fix CVE-2025-26596 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 08/16] xwayland: Fix CVE-2025-26598 Steve Sakoman
` (8 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26597.patch | 46 +++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 1 +
2 files changed, 47 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch
new file mode 100644
index 0000000000..b0735d0b46
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch
@@ -0,0 +1,46 @@
+From 0e4ed94952b255c04fe910f6a1d9c852878dcd64 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Thu, 28 Nov 2024 14:09:04 +0100
+Subject: [PATCH] xkb: Fix buffer overflow in XkbChangeTypesOfKey()
+
+If XkbChangeTypesOfKey() is called with nGroups == 0, it will resize the
+key syms to 0 but leave the key actions unchanged.
+
+If later, the same function is called with a non-zero value for nGroups,
+this will cause a buffer overflow because the key actions are of the wrong
+size.
+
+To avoid the issue, make sure to resize both the key syms and key actions
+when nGroups is 0.
+
+CVE-2025-26597, ZDI-CAN-25683
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949]
+CVE: CVE-2025-26597
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/XKBMisc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xkb/XKBMisc.c b/xkb/XKBMisc.c
+index abbfed90eb..fd180fad2c 100644
+--- a/xkb/XKBMisc.c
++++ b/xkb/XKBMisc.c
+@@ -553,6 +553,7 @@ XkbChangeTypesOfKey(XkbDescPtr xkb,
+ i = XkbSetNumGroups(i, 0);
+ xkb->map->key_sym_map[key].group_info = i;
+ XkbResizeKeySyms(xkb, key, 0);
++ XkbResizeKeyActions(xkb, key, 0);
+ return Success;
+ }
+
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index 63803a7a44..7f94c5e2e2 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -15,6 +15,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26594-2.patch \
file://CVE-2025-26595.patch \
file://CVE-2025-26596.patch \
+ file://CVE-2025-26597.patch \
"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 08/16] xwayland: Fix CVE-2025-26598
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 07/16] xwayland: Fix CVE-2025-26597 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 09/16] xwayland: Fix CVE-2025-26599 Steve Sakoman
` (7 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26598.patch | 120 ++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 1 +
2 files changed, 121 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch
new file mode 100644
index 0000000000..210a76262a
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch
@@ -0,0 +1,120 @@
+From bba9df1a9d57234c76c0b93f88dacb143d01bca2 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 16 Dec 2024 11:25:11 +0100
+Subject: [PATCH] Xi: Fix barrier device search
+
+The function GetBarrierDevice() would search for the pointer device
+based on its device id and return the matching value, or supposedly NULL
+if no match was found.
+
+Unfortunately, as written, it would return the last element of the list
+if no matching device id was found which can lead to out of bounds
+memory access.
+
+Fix the search function to return NULL if not matching device is found,
+and adjust the callers to handle the case where the device cannot be
+found.
+
+CVE-2025-26598, ZDI-CAN-25740
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a]
+CVE: CVE-2025-26598
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xi/xibarriers.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/Xi/xibarriers.c b/Xi/xibarriers.c
+index 700b2b8c53..6761bcb49a 100644
+--- a/Xi/xibarriers.c
++++ b/Xi/xibarriers.c
+@@ -132,14 +132,15 @@ static void FreePointerBarrierClient(struct PointerBarrierClient *c)
+
+ static struct PointerBarrierDevice *GetBarrierDevice(struct PointerBarrierClient *c, int deviceid)
+ {
+- struct PointerBarrierDevice *pbd = NULL;
++ struct PointerBarrierDevice *p, *pbd = NULL;
+
+- xorg_list_for_each_entry(pbd, &c->per_device, entry) {
+- if (pbd->deviceid == deviceid)
++ xorg_list_for_each_entry(p, &c->per_device, entry) {
++ if (p->deviceid == deviceid) {
++ pbd = p;
+ break;
++ }
+ }
+
+- BUG_WARN(!pbd);
+ return pbd;
+ }
+
+@@ -340,6 +341,9 @@ barrier_find_nearest(BarrierScreenPtr cs, DeviceIntPtr dev,
+ double distance;
+
+ pbd = GetBarrierDevice(c, dev->id);
++ if (!pbd)
++ continue;
++
+ if (pbd->seen)
+ continue;
+
+@@ -448,6 +452,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen,
+ nearest = &c->barrier;
+
+ pbd = GetBarrierDevice(c, master->id);
++ if (!pbd)
++ continue;
++
+ new_sequence = !pbd->hit;
+
+ pbd->seen = TRUE;
+@@ -488,6 +495,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen,
+ int flags = 0;
+
+ pbd = GetBarrierDevice(c, master->id);
++ if (!pbd)
++ continue;
++
+ pbd->seen = FALSE;
+ if (!pbd->hit)
+ continue;
+@@ -682,6 +692,9 @@ BarrierFreeBarrier(void *data, XID id)
+ continue;
+
+ pbd = GetBarrierDevice(c, dev->id);
++ if (!pbd)
++ continue;
++
+ if (!pbd->hit)
+ continue;
+
+@@ -741,6 +754,8 @@ static void remove_master_func(void *res, XID id, void *devid)
+ barrier = container_of(b, struct PointerBarrierClient, barrier);
+
+ pbd = GetBarrierDevice(barrier, *deviceid);
++ if (!pbd)
++ return;
+
+ if (pbd->hit) {
+ BarrierEvent ev = {
+@@ -905,6 +920,10 @@ ProcXIBarrierReleasePointer(ClientPtr client)
+ barrier = container_of(b, struct PointerBarrierClient, barrier);
+
+ pbd = GetBarrierDevice(barrier, dev->id);
++ if (!pbd) {
++ client->errorValue = dev->id;
++ return BadDevice;
++ }
+
+ if (pbd->barrier_event_id == event_id)
+ pbd->release_event_id = event_id;
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index 7f94c5e2e2..b46a02e5c3 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -16,6 +16,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26595.patch \
file://CVE-2025-26596.patch \
file://CVE-2025-26597.patch \
+ file://CVE-2025-26598.patch \
"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 09/16] xwayland: Fix CVE-2025-26599
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 08/16] xwayland: Fix CVE-2025-26598 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 10/16] xwayland: Fix CVE-2025-26600 Steve Sakoman
` (6 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from
https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be & https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26599-1.patch | 66 +++++++++
.../xwayland/xwayland/CVE-2025-26599-2.patch | 129 ++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 2 +
3 files changed, 197 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch
new file mode 100644
index 0000000000..60b68a0d9a
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch
@@ -0,0 +1,66 @@
+From c1ff84bef2569b4ba4be59323cf575d1798ba9be Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Tue, 17 Dec 2024 15:19:45 +0100
+Subject: [PATCH] composite: Handle failure to redirect in compRedirectWindow()
+
+The function compCheckRedirect() may fail if it cannot allocate the
+backing pixmap.
+
+In that case, compRedirectWindow() will return a BadAlloc error.
+
+However that failure code path will shortcut the validation of the
+window tree marked just before, which leaves the validate data partly
+initialized.
+
+That causes a use of uninitialized pointer later.
+
+The fix is to not shortcut the call to compHandleMarkedWindows() even in
+the case of compCheckRedirect() returning an error.
+
+CVE-2025-26599, ZDI-CAN-25851
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be]
+CVE: CVE-2025-26599
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ composite/compalloc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/composite/compalloc.c b/composite/compalloc.c
+index eaabf0d..0bbbc55 100644
+--- a/composite/compalloc.c
++++ b/composite/compalloc.c
+@@ -140,6 +140,7 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
+ CompScreenPtr cs = GetCompScreen(pWin->drawable.pScreen);
+ WindowPtr pLayerWin;
+ Bool anyMarked = FALSE;
++ int status = Success;
+
+ if (pWin == cs->pOverlayWin) {
+ return Success;
+@@ -218,13 +219,13 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
+
+ if (!compCheckRedirect(pWin)) {
+ FreeResource(ccw->id, RT_NONE);
+- return BadAlloc;
++ status = BadAlloc;
+ }
+
+ if (anyMarked)
+ compHandleMarkedWindows(pWin, pLayerWin);
+
+- return Success;
++ return status;
+ }
+
+ void
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch
new file mode 100644
index 0000000000..252b033261
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch
@@ -0,0 +1,129 @@
+From b07192a8bedb90b039dc0f70ae69daf047ff9598 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 13 Jan 2025 16:09:43 +0100
+Subject: [PATCH] composite: initialize border clip even when pixmap alloc
+ fails
+
+If it fails to allocate the pixmap, the function compAllocPixmap() would
+return early and leave the borderClip region uninitialized, which may
+lead to the use of uninitialized value as reported by valgrind:
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x4F9B33: compClipNotify (compwindow.c:317)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x48EEDBC: pixman_region_translate (pixman-region.c:2233)
+ by 0x4F9255: RegionTranslate (regionstr.h:312)
+ by 0x4F9B7E: compClipNotify (compwindow.c:319)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x48EEE33: UnknownInlinedFun (pixman-region.c:2241)
+ by 0x48EEE33: pixman_region_translate (pixman-region.c:2225)
+ by 0x4F9255: RegionTranslate (regionstr.h:312)
+ by 0x4F9B7E: compClipNotify (compwindow.c:319)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+Fix compAllocPixmap() to initialize the border clip even if the creation
+of the backing pixmap has failed, to avoid depending later on
+uninitialized border clip values.
+
+Related to CVE-2025-26599, ZDI-CAN-25851
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8]
+CVE: CVE-2025-26599
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ composite/compalloc.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/composite/compalloc.c b/composite/compalloc.c
+index 7cf7351e00..4a1243170d 100644
+--- a/composite/compalloc.c
++++ b/composite/compalloc.c
+@@ -605,9 +605,12 @@ compAllocPixmap(WindowPtr pWin)
+ int h = pWin->drawable.height + (bw << 1);
+ PixmapPtr pPixmap = compNewPixmap(pWin, x, y, w, h);
+ CompWindowPtr cw = GetCompWindow(pWin);
++ Bool status;
+
+- if (!pPixmap)
+- return FALSE;
++ if (!pPixmap) {
++ status = FALSE;
++ goto out;
++ }
+ if (cw->update == CompositeRedirectAutomatic)
+ pWin->redirectDraw = RedirectDrawAutomatic;
+ else
+@@ -621,14 +624,16 @@ compAllocPixmap(WindowPtr pWin)
+ DamageRegister(&pWin->drawable, cw->damage);
+ cw->damageRegistered = TRUE;
+ }
++ status = TRUE;
+
++out:
+ /* Make sure our borderClip is up to date */
+ RegionUninit(&cw->borderClip);
+ RegionCopy(&cw->borderClip, &pWin->borderClip);
+ cw->borderClipX = pWin->drawable.x;
+ cw->borderClipY = pWin->drawable.y;
+
+- return TRUE;
++ return status;
+ }
+
+ void
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index b46a02e5c3..cafddc62b5 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -17,6 +17,8 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26596.patch \
file://CVE-2025-26597.patch \
file://CVE-2025-26598.patch \
+ file://CVE-2025-26599-1.patch \
+ file://CVE-2025-26599-2.patch \
"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 10/16] xwayland: Fix CVE-2025-26600
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (8 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 09/16] xwayland: Fix CVE-2025-26599 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 11/16] xwayland: Fix CVE-2025-26601 Steve Sakoman
` (5 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26600.patch | 68 +++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 1 +
2 files changed, 69 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch
new file mode 100644
index 0000000000..43b47b3ca3
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch
@@ -0,0 +1,68 @@
+From 6e0f332ba4c8b8c9a9945dc9d7989bfe06f80e14 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 16 Dec 2024 16:18:04 +0100
+Subject: [PATCH] dix: Dequeue pending events on frozen device on removal
+
+When a device is removed while still frozen, the events queued for that
+device remain while the device itself is freed.
+
+As a result, replaying the events will cause a use after free.
+
+To avoid the issue, make sure to dequeue and free any pending events on
+a frozen device when removed.
+
+CVE-2025-26600, ZDI-CAN-25871
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b]
+CVE: CVE-2025-26600
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ dix/devices.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index 1516147..459f1ed 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -962,6 +962,23 @@ FreeAllDeviceClasses(ClassesPtr classes)
+
+ }
+
++static void
++FreePendingFrozenDeviceEvents(DeviceIntPtr dev)
++{
++ QdEventPtr qe, tmp;
++
++ if (!dev->deviceGrab.sync.frozen)
++ return;
++
++ /* Dequeue any frozen pending events */
++ xorg_list_for_each_entry_safe(qe, tmp, &syncEvents.pending, next) {
++ if (qe->device == dev) {
++ xorg_list_del(&qe->next);
++ free(qe);
++ }
++ }
++}
++
+ /**
+ * Close down a device and free all resources.
+ * Once closed down, the driver will probably not expect you that you'll ever
+@@ -1026,6 +1043,7 @@ CloseDevice(DeviceIntPtr dev)
+ free(dev->last.touches[j].valuators);
+ free(dev->last.touches);
+ dev->config_info = NULL;
++ FreePendingFrozenDeviceEvents(dev);
+ dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE);
+ free(dev);
+ }
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index cafddc62b5..ac0408ea67 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -19,6 +19,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26598.patch \
file://CVE-2025-26599-1.patch \
file://CVE-2025-26599-2.patch \
+ file://CVE-2025-26600.patch \
"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 11/16] xwayland: Fix CVE-2025-26601
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (9 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 10/16] xwayland: Fix CVE-2025-26600 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 12/16] ffmpeg: fix CVE-2025-25473 Steve Sakoman
` (4 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from
https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d &
https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f &
https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26601-1.patch | 71 ++++++++++
.../xwayland/xwayland/CVE-2025-26601-2.patch | 85 +++++++++++
.../xwayland/xwayland/CVE-2025-26601-3.patch | 52 +++++++
.../xwayland/xwayland/CVE-2025-26601-4.patch | 132 ++++++++++++++++++
.../xwayland/xwayland_23.2.5.bb | 4 +
5 files changed, 344 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch
new file mode 100644
index 0000000000..df5416a452
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch
@@ -0,0 +1,71 @@
+From 16a1242d0ffc7f45ed3c595ee7564b5c04287e0b Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 16:52:01 +0100
+Subject: [PATCH] sync: Do not let sync objects uninitialized
+
+When changing an alarm, the change mask values are evaluated one after
+the other, changing the trigger values as requested and eventually,
+SyncInitTrigger() is called.
+
+SyncInitTrigger() will evaluate the XSyncCACounter first and may free
+the existing sync object.
+
+Other changes are then evaluated and may trigger an error and an early
+return, not adding the new sync object.
+
+This can be used to cause a use after free when the alarm eventually
+triggers.
+
+To avoid the issue, delete the existing sync object as late as possible
+only once we are sure that no further error will cause an early exit.
+
+CVE-2025-26601, ZDI-CAN-25870
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d]
+CVE: CVE-2025-26601
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xext/sync.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index ee0010e657..585cfa6f68 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -360,11 +360,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ client->errorValue = syncObject;
+ return rc;
+ }
+- if (pSync != pTrigger->pSync) { /* new counter for trigger */
+- SyncDeleteTriggerFromSyncObject(pTrigger);
+- pTrigger->pSync = pSync;
+- newSyncObject = TRUE;
+- }
+ }
+
+ /* if system counter, ask it what the current value is */
+@@ -432,6 +427,14 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ }
+ }
+
++ if (changes & XSyncCACounter) {
++ if (pSync != pTrigger->pSync) { /* new counter for trigger */
++ SyncDeleteTriggerFromSyncObject(pTrigger);
++ pTrigger->pSync = pSync;
++ newSyncObject = TRUE;
++ }
++ }
++
+ /* we wait until we're sure there are no errors before registering
+ * a new counter on a trigger
+ */
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch
new file mode 100644
index 0000000000..22e751c017
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch
@@ -0,0 +1,85 @@
+From f52cea2f93a0c891494eb3334894442a92368030 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 16:54:30 +0100
+Subject: [PATCH] sync: Check values before applying changes
+
+In SyncInitTrigger(), we would set the CheckTrigger function before
+validating the counter value.
+
+As a result, if the counter value overflowed, we would leave the
+function SyncInitTrigger() with the CheckTrigger applied but without
+updating the trigger object.
+
+To avoid that issue, move the portion of code checking for the trigger
+check value before updating the CheckTrigger function.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f]
+CVE: CVE-2025-26601
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xext/sync.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 585cfa6f68..10302160fb 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -381,6 +381,24 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ }
+ }
+
++ if (changes & (XSyncCAValueType | XSyncCAValue)) {
++ if (pTrigger->value_type == XSyncAbsolute)
++ pTrigger->test_value = pTrigger->wait_value;
++ else { /* relative */
++ Bool overflow;
++
++ if (pCounter == NULL)
++ return BadMatch;
++
++ overflow = checked_int64_add(&pTrigger->test_value,
++ pCounter->value, pTrigger->wait_value);
++ if (overflow) {
++ client->errorValue = pTrigger->wait_value >> 32;
++ return BadValue;
++ }
++ }
++ }
++
+ if (changes & XSyncCATestType) {
+
+ if (pSync && SYNC_FENCE == pSync->type) {
+@@ -409,24 +427,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ }
+ }
+
+- if (changes & (XSyncCAValueType | XSyncCAValue)) {
+- if (pTrigger->value_type == XSyncAbsolute)
+- pTrigger->test_value = pTrigger->wait_value;
+- else { /* relative */
+- Bool overflow;
+-
+- if (pCounter == NULL)
+- return BadMatch;
+-
+- overflow = checked_int64_add(&pTrigger->test_value,
+- pCounter->value, pTrigger->wait_value);
+- if (overflow) {
+- client->errorValue = pTrigger->wait_value >> 32;
+- return BadValue;
+- }
+- }
+- }
+-
+ if (changes & XSyncCACounter) {
+ if (pSync != pTrigger->pSync) { /* new counter for trigger */
+ SyncDeleteTriggerFromSyncObject(pTrigger);
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch
new file mode 100644
index 0000000000..8d714f0302
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch
@@ -0,0 +1,52 @@
+From 8cbc90c8817306af75a60f494ec9dbb1061e50db Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 17:06:07 +0100
+Subject: [PATCH] sync: Do not fail SyncAddTriggerToSyncObject()
+
+We do not want to return a failure at the very last step in
+SyncInitTrigger() after having all changes applied.
+
+SyncAddTriggerToSyncObject() must not fail on memory allocation, if the
+allocation of the SyncTriggerList fails, trigger a FatalError() instead.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8]
+CVE: CVE-2025-26601
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xext/sync.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 10302160fb..65f2d43780 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -201,8 +201,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger)
+ return Success;
+ }
+
+- if (!(pCur = malloc(sizeof(SyncTriggerList))))
+- return BadAlloc;
++ /* Failure is not an option, it's succeed or burst! */
++ pCur = XNFalloc(sizeof(SyncTriggerList));
+
+ pCur->pTrigger = pTrigger;
+ pCur->next = pTrigger->pSync->pTriglist;
+@@ -439,8 +439,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ * a new counter on a trigger
+ */
+ if (newSyncObject) {
+- if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success)
+- return rc;
++ SyncAddTriggerToSyncObject(pTrigger);
+ }
+ else if (pCounter && IsSystemCounter(pCounter)) {
+ SyncComputeBracketValues(pCounter);
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch
new file mode 100644
index 0000000000..e2261192fa
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch
@@ -0,0 +1,132 @@
+From c285798984c6bb99e454a33772cde23d394d3dcd Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 17:10:31 +0100
+Subject: [PATCH] sync: Apply changes last in SyncChangeAlarmAttributes()
+
+SyncChangeAlarmAttributes() would apply the various changes while
+checking for errors.
+
+If one of the changes triggers an error, the changes for the trigger,
+counter or delta value would remain, possibly leading to inconsistent
+changes.
+
+Postpone the actual changes until we're sure nothing else can go wrong.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989]
+CVE: CVE-2025-26601
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xext/sync.c | 42 +++++++++++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 65f2d43780..cab73be927 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -830,8 +830,14 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+ int status;
+ XSyncCounter counter;
+ Mask origmask = mask;
++ SyncTrigger trigger;
++ Bool select_events_changed = FALSE;
++ Bool select_events_value = FALSE;
++ int64_t delta;
+
+- counter = pAlarm->trigger.pSync ? pAlarm->trigger.pSync->id : None;
++ trigger = pAlarm->trigger;
++ delta = pAlarm->delta;
++ counter = trigger.pSync ? trigger.pSync->id : None;
+
+ while (mask) {
+ int index2 = lowbit(mask);
+@@ -847,24 +853,24 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+ case XSyncCAValueType:
+ mask &= ~XSyncCAValueType;
+ /* sanity check in SyncInitTrigger */
+- pAlarm->trigger.value_type = *values++;
++ trigger.value_type = *values++;
+ break;
+
+ case XSyncCAValue:
+ mask &= ~XSyncCAValue;
+- pAlarm->trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
++ trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
+ values += 2;
+ break;
+
+ case XSyncCATestType:
+ mask &= ~XSyncCATestType;
+ /* sanity check in SyncInitTrigger */
+- pAlarm->trigger.test_type = *values++;
++ trigger.test_type = *values++;
+ break;
+
+ case XSyncCADelta:
+ mask &= ~XSyncCADelta;
+- pAlarm->delta = ((int64_t)values[0] << 32) | values[1];
++ delta = ((int64_t)values[0] << 32) | values[1];
+ values += 2;
+ break;
+
+@@ -874,10 +880,8 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+ client->errorValue = *values;
+ return BadValue;
+ }
+- status = SyncEventSelectForAlarm(pAlarm, client,
+- (Bool) (*values++));
+- if (status != Success)
+- return status;
++ select_events_value = (Bool) (*values++);
++ select_events_changed = TRUE;
+ break;
+
+ default:
+@@ -886,25 +890,33 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+ }
+ }
+
++ if (select_events_changed) {
++ status = SyncEventSelectForAlarm(pAlarm, client, select_events_value);
++ if (status != Success)
++ return status;
++ }
++
+ /* "If the test-type is PositiveComparison or PositiveTransition
+ * and delta is less than zero, or if the test-type is
+ * NegativeComparison or NegativeTransition and delta is
+ * greater than zero, a Match error is generated."
+ */
+ if (origmask & (XSyncCADelta | XSyncCATestType)) {
+- if ((((pAlarm->trigger.test_type == XSyncPositiveComparison) ||
+- (pAlarm->trigger.test_type == XSyncPositiveTransition))
+- && pAlarm->delta < 0)
++ if ((((trigger.test_type == XSyncPositiveComparison) ||
++ (trigger.test_type == XSyncPositiveTransition))
++ && delta < 0)
+ ||
+- (((pAlarm->trigger.test_type == XSyncNegativeComparison) ||
+- (pAlarm->trigger.test_type == XSyncNegativeTransition))
+- && pAlarm->delta > 0)
++ (((trigger.test_type == XSyncNegativeComparison) ||
++ (trigger.test_type == XSyncNegativeTransition))
++ && delta > 0)
+ ) {
+ return BadMatch;
+ }
+ }
+
+ /* postpone this until now, when we're sure nothing else can go wrong */
++ pAlarm->delta = delta;
++ pAlarm->trigger = trigger;
+ if ((status = SyncInitTrigger(client, &pAlarm->trigger, counter, RTCounter,
+ origmask & XSyncCAAllTrigger)) != Success)
+ return status;
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
index ac0408ea67..0265366393 100644
--- a/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_23.2.5.bb
@@ -20,6 +20,10 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26599-1.patch \
file://CVE-2025-26599-2.patch \
file://CVE-2025-26600.patch \
+ file://CVE-2025-26601-1.patch \
+ file://CVE-2025-26601-2.patch \
+ file://CVE-2025-26601-3.patch \
+ file://CVE-2025-26601-4.patch \
"
SRC_URI[sha256sum] = "33ec7ff2687a59faaa52b9b09aa8caf118e7ecb6aed8953f526a625ff9f4bd90"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 12/16] ffmpeg: fix CVE-2025-25473
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (10 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 11/16] xwayland: Fix CVE-2025-26601 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 13/16] ffmpeg: fix CVE-2025-25471 Steve Sakoman
` (3 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer
dereference via the component libavformat/mov.c.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2025-25473.patch | 36 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25473.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25473.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25473.patch
new file mode 100644
index 0000000000..ea619025d1
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25473.patch
@@ -0,0 +1,36 @@
+From c08d300481b8ebb846cd43a473988fdbc6793d1b Mon Sep 17 00:00:00 2001
+From: James Almer <jamrial@gmail.com>
+Date: Fri, 17 Jan 2025 00:05:31 -0300
+Subject: [PATCH] avformat/avformat: also clear FFFormatContext packet queue
+ when closing a muxer
+
+packet_buffer is used in mux.c, and if a muxing process fails at a point where
+packets remained in said queue, they will leak.
+
+Fixes ticket #11419
+
+Signed-off-by: James Almer <jamrial@gmail.com>
+
+CVE: CVE-2025-25473
+
+Upstream-Status: Backport [https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/c08d300481b8ebb846cd43a473988fdbc6793d1b]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ libavformat/avformat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libavformat/avformat.c b/libavformat/avformat.c
+index 5b8bb78..73f31cd 100644
+--- a/libavformat/avformat.c
++++ b/libavformat/avformat.c
+@@ -138,6 +138,7 @@ void avformat_free_context(AVFormatContext *s)
+ av_dict_free(&si->id3v2_meta);
+ av_packet_free(&si->pkt);
+ av_packet_free(&si->parse_pkt);
++ avpriv_packet_list_free(&si->packet_buffer);
+ av_freep(&s->streams);
+ ff_flush_packet_queue(s);
+ av_freep(&s->url);
+--
+2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
index 91ee6c6b0d..cb6a50401b 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
@@ -47,6 +47,7 @@ SRC_URI = " \
file://CVE-2024-36618.patch \
file://CVE-2024-36619.patch \
file://CVE-2024-35369.patch \
+ file://CVE-2025-25473.patch \
"
SRC_URI[sha256sum] = "8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 13/16] ffmpeg: fix CVE-2025-25471
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (11 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 12/16] ffmpeg: fix CVE-2025-25473 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 14/16] ffmpeg: fix CVE-2025-22921 Steve Sakoman
` (2 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer
dereference via the component libavformat/mov.c.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2025-25471.patch | 39 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
2 files changed, 40 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25471.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25471.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25471.patch
new file mode 100644
index 0000000000..6af01b298f
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25471.patch
@@ -0,0 +1,39 @@
+From 1446e37d3d032e1452844778b3e6ba2c20f0c322 Mon Sep 17 00:00:00 2001
+From: James Almer <jamrial@gmail.com>
+Date: Mon, 30 Dec 2024 00:25:41 -0300
+Subject: [PATCH] avfilter/buffersrc: check for valid sample rate
+
+A sample rate <= 0 is invalid.
+
+Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set.
+Fixes ticket #11385.
+
+Signed-off-by: James Almer <jamrial@gmail.com>
+
+CVE: CVE-2025-25471
+
+Upstream-Status: Backport [https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1446e37d3d032e1452844778b3e6ba2c20f0c322]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ libavfilter/buffersrc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/libavfilter/buffersrc.c b/libavfilter/buffersrc.c
+index 453fc0f..f49aa91 100644
+--- a/libavfilter/buffersrc.c
++++ b/libavfilter/buffersrc.c
+@@ -401,6 +401,11 @@ FF_ENABLE_DEPRECATION_WARNINGS
+ av_channel_layout_describe(&s->ch_layout, buf, sizeof(buf));
+ }
+
++ if (s->sample_rate <= 0) {
++ av_log(ctx, AV_LOG_ERROR, "Sample rate not set\n");
++ return AVERROR(EINVAL);
++ }
++
+ if (!s->time_base.num)
+ s->time_base = (AVRational){1, s->sample_rate};
+
+--
+2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
index cb6a50401b..6af43bcf37 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
@@ -48,6 +48,7 @@ SRC_URI = " \
file://CVE-2024-36619.patch \
file://CVE-2024-35369.patch \
file://CVE-2025-25473.patch \
+ file://CVE-2025-25471.patch \
"
SRC_URI[sha256sum] = "8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 14/16] ffmpeg: fix CVE-2025-22921
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (12 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 13/16] ffmpeg: fix CVE-2025-25471 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 15/16] ffmpeg: fix CVE-2025-0518 Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 16/16] systemd: add libpcre2 as RRECOMMENDS if pcre2 is enabled Steve Sakoman
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation
violation via the component /libavcodec/jpeg2000dec.c.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2025-22921.patch | 34 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22921.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22921.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22921.patch
new file mode 100644
index 0000000000..20fac68d01
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22921.patch
@@ -0,0 +1,34 @@
+From 7f9c7f9849a2155224711f0ff57ecdac6e4bfb57 Mon Sep 17 00:00:00 2001
+From: James Almer <jamrial@gmail.com>
+Date: Wed, 1 Jan 2025 23:58:39 -0300
+Subject: [PATCH] avcodec/jpeg2000dec: clear array length when freeing it
+
+Fixes NULL pointer dereferences.
+Fixes ticket #11393.
+
+Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
+Signed-off-by: James Almer <jamrial@gmail.com>
+
+CVE: CVE-2025-22921
+
+Upstream-Status: Backport [https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/7f9c7f9849a2155224711f0ff57ecdac6e4bfb57]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ libavcodec/jpeg2000dec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
+index 691cfbd..b56902c 100644
+--- a/libavcodec/jpeg2000dec.c
++++ b/libavcodec/jpeg2000dec.c
+@@ -1223,6 +1223,7 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile,
+ }
+ }
+ av_freep(&cblk->lengthinc);
++ cblk->nb_lengthinc = 0;
+ }
+ }
+ // Save state of stream
+--
+2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
index 6af43bcf37..bd1259d392 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
@@ -49,6 +49,7 @@ SRC_URI = " \
file://CVE-2024-35369.patch \
file://CVE-2025-25473.patch \
file://CVE-2025-25471.patch \
+ file://CVE-2025-22921.patch \
"
SRC_URI[sha256sum] = "8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 15/16] ffmpeg: fix CVE-2025-0518
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (13 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 14/16] ffmpeg: fix CVE-2025-22921 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
2025-03-05 22:11 ` [OE-core][scarthgap 16/16] systemd: add libpcre2 as RRECOMMENDS if pcre2 is enabled Steve Sakoman
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows
Read Sensitive Constants Within an Executable. This vulnerability is associated
with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C
This issue affects FFmpeg: 7.1.
Issue was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a
This issue was discovered by: Simcha Kosma
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2025-0518.patch | 34 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-0518.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-0518.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-0518.patch
new file mode 100644
index 0000000000..d3e02bebe6
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-0518.patch
@@ -0,0 +1,34 @@
+From b5b6391d64807578ab872dc58fb8aa621dcfc38a Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Mon, 6 Jan 2025 22:01:39 +0100
+Subject: [PATCH] avfilter/af_pan: Fix sscanf() use
+
+Fixes: Memory Data Leak
+
+Found-by: Simcha Kosman <simcha.kosman@cyberark.com>
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+CVE: CVE-2025-0518
+
+Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ libavfilter/af_pan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
+index cfed9f1..ffcd214 100644
+--- a/libavfilter/af_pan.c
++++ b/libavfilter/af_pan.c
+@@ -165,7 +165,7 @@ static av_cold int init(AVFilterContext *ctx)
+ sign = 1;
+ while (1) {
+ gain = 1;
+- if (sscanf(arg, "%lf%n *%n", &gain, &len, &len))
++ if (sscanf(arg, "%lf%n *%n", &gain, &len, &len) >= 1)
+ arg += len;
+ if (parse_channel_name(&arg, &in_ch_id, &named)){
+ av_log(ctx, AV_LOG_ERROR,
+--
+2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
index bd1259d392..06ca65a480 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb
@@ -50,6 +50,7 @@ SRC_URI = " \
file://CVE-2025-25473.patch \
file://CVE-2025-25471.patch \
file://CVE-2025-22921.patch \
+ file://CVE-2025-0518.patch \
"
SRC_URI[sha256sum] = "8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968"
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread* [OE-core][scarthgap 16/16] systemd: add libpcre2 as RRECOMMENDS if pcre2 is enabled
2025-03-05 22:10 [OE-core][scarthgap 00/16] Patch review Steve Sakoman
` (14 preceding siblings ...)
2025-03-05 22:11 ` [OE-core][scarthgap 15/16] ffmpeg: fix CVE-2025-0518 Steve Sakoman
@ 2025-03-05 22:11 ` Steve Sakoman
15 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-05 22:11 UTC (permalink / raw)
To: openembedded-core
From: Alexis Cellier <alexis.cellier@smile.fr>
The libpcre2 is now dlopen'ed, so it is not automatically added to the
RDEPENDS anymore. Add it to the RRECOMMENDS list (and not RDEPENDS as
systemd tags the library as "suggested").
This issue is not on master, the systemd v257 recipe uses a tool that
systemd provides to get this kind of dependencies. But this cannot be
backported to scarthgap as systemd v255 does not have this tool yet.
Cc: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Alexis Cellier <alexis.cellier@smile.fr>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/systemd/systemd_255.17.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-core/systemd/systemd_255.17.bb b/meta/recipes-core/systemd/systemd_255.17.bb
index 8f5170929f..f85ad61080 100644
--- a/meta/recipes-core/systemd/systemd_255.17.bb
+++ b/meta/recipes-core/systemd/systemd_255.17.bb
@@ -188,7 +188,7 @@ PACKAGECONFIG[oomd] = "-Doomd=true,-Doomd=false"
PACKAGECONFIG[openssl] = "-Dopenssl=true,-Dopenssl=false,openssl"
PACKAGECONFIG[p11kit] = "-Dp11kit=true,-Dp11kit=false,p11-kit"
PACKAGECONFIG[pam] = "-Dpam=true,-Dpam=false,libpam,${PAM_PLUGINS}"
-PACKAGECONFIG[pcre2] = "-Dpcre2=true,-Dpcre2=false,libpcre2"
+PACKAGECONFIG[pcre2] = "-Dpcre2=true,-Dpcre2=false,libpcre2,,libpcre2"
PACKAGECONFIG[polkit] = "-Dpolkit=true,-Dpolkit=false"
# If polkit is disabled and networkd+hostnamed are in use, enabling this option and
# using dbus-broker will allow networkd to be authorized to change the
--
2.43.0
^ permalink raw reply related [flat|nested] 17+ messages in thread