Star0
12
Code
Code
Issues
Pull Requests1
Discussion
Wiki
Analysis
Star0
12
Closed
[sync] PR-71: fix CVE-2026-96674,CVE-2026-96675 #76
openeuler-ci-botAdd on Sep 28Closed at Oct 8
[sync] PR-71: fix CVE-2026-96674,CVE-2026-96675 #76
Closed
openeuler-ci-botAdd on Sep 28Closed at Oct 8
Merged fromsync-pr71-master-to-openEuler-26.09-DevStationintoopenEuler-26.09-DevStation
Total: 3 files changed+109-1
Malsa-lib.spec+6-1
@@ -3,7 +3,7 @@
3%define version_alsa_tplg 1.2.5.13%define version_alsa_tplg 1.2.5.1
4Name: alsa-lib4Name: alsa-lib
5Version: %{version_alsa_lib}5Version: %{version_alsa_lib}
6-Release: 26+Release: 3
7Summary: the user space library that developers compile ALSA applications against7Summary: the user space library that developers compile ALSA applications against
8 8 
9License: LGPL-2.1-or-later9License: LGPL-2.1-or-later
@@ -15,6 +15,8 @@ Source10: asound.conf
15 15 
16Patch1: alsa-lib-1.2.5.1-sw.patch16Patch1: alsa-lib-1.2.5.1-sw.patch
17Patch6000: backport-CVE-2026-90781.patch17Patch6000: backport-CVE-2026-90781.patch
18+Patch6001: backport-CVE-2026-96674.patch
19+Patch6002: backport-CVE-2026-96675.patch
18 20 
19BuildRequires: autoconf, automake, libtool, doxygen21BuildRequires: autoconf, automake, libtool, doxygen
20 22 
@@ -129,6 +131,9 @@ tar xvjf %{S:2} -C %{buildroot}/%{_datadir}/alsa --strip-components=1 "alsa-topo
129%{_datadir}/alsa/topology131%{_datadir}/alsa/topology
130 132 
131%changelog133%changelog
134+* Fri Sep 25 2026 zhengzongmin <zhengzongmin@xfusion.com> - 1.2.16.1-3
135+- fix CVE-2026-96674,CVE-2026-96675
136+ 
132* Tue Sep 15 2026 wangxiao <wangxiao184@qq.com> - 1.2.16.1-2137* Tue Sep 15 2026 wangxiao <wangxiao184@qq.com> - 1.2.16.1-2
133- fix CVE-2026-90781138- fix CVE-2026-90781
134 139 
Abackport-CVE-2026-96674.patch+68-0
@@ -0,0 +1,68 @@
1+From ece3e32e7bed80faaff2a9594a79f1f751d5bdca Mon Sep 17 00:00:00 2001
2+From: Harsh Raj Singhania <raj.harshraut@gmail.com>
3+Date: Sat, 19 Sep 2026 10:40:37 +0530
4+Subject: [PATCH] alsa-lib: harden UCM, conf parser, topology and PCM plugins
5+ against malformed input
6+ 
7+A5 (topology ctl, src/topology/ctl.c): size2 = x->size + x->priv.size is
8+ computed in uint32_t arithmetic and can wrap on a 64-bit host, bypassing
9+ the subsequent bounds check. Fix: pre-check for overflow then cast to
10+ size_t before addition. Affects tplg_decode_control_mixer/enum/bytes
11+ (three sites). CWE-190.
12+ 
13+All six code-path changes verified standalone against f84cd4c with
14+proof-of-concept programs.
15+ 
16+Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
17+ 
18+---
19+ src/topology/ctl.c | 21 ++++++++++++++++++---
20+ 1 file changed, 18 insertions(+), 3 deletions(-)
21+ 
22+diff --git a/src/topology/ctl.c b/src/topology/ctl.c
23+index 322c461..93a09f1 100644
24+--- a/src/topology/ctl.c
25++++ b/src/topology/ctl.c
26+@@ -1315,7 +1315,12 @@ next:
27+ }
28+ INIT_LIST_HEAD(&heap);
29+ mc = bin;
30+- size2 = mc->size + mc->priv.size;
31++ if (mc->priv.size > size || mc->size > size - mc->priv.size) {
32++ snd_error(TOPOLOGY, "mixer: element sizes overflow (%d, priv %d)",
33++ mc->size, mc->priv.size);
34++ return -EINVAL;
35++ }
36++ size2 = (size_t)mc->size + (size_t)mc->priv.size;
37+ if (size2 > size) {
38+ snd_error(TOPOLOGY, "mixer: wrong element size (%d, priv %d)",
39+ mc->size, mc->priv.size);
40+@@ -1419,7 +1424,12 @@ next:
41+ }
42+ INIT_LIST_HEAD(&heap);
43+ ec = bin;
44+- size2 = ec->size + ec->priv.size;
45++ if (ec->priv.size > size || ec->size > size - ec->priv.size) {
46++ snd_error(TOPOLOGY, "enum: element sizes overflow (%d, priv %d)",
47++ ec->size, ec->priv.size);
48++ return -EINVAL;
49++ }
50++ size2 = (size_t)ec->size + (size_t)ec->priv.size;
51+ if (size2 > size) {
52+ snd_error(TOPOLOGY, "enum: wrong element size (%d, priv %d)",
53+ ec->size, ec->priv.size);
54+@@ -1510,7 +1520,12 @@ next:
55+ return -EINVAL;
56+ }
57+ bc = bin;
58+- size2 = bc->size + bc->priv.size;
59++ if (bc->priv.size > size || bc->size > size - bc->priv.size) {
60++ snd_error(TOPOLOGY, "bytes: element sizes overflow (%d, priv %d)",
61++ bc->size, bc->priv.size);
62++ return -EINVAL;
63++ }
64++ size2 = (size_t)bc->size + (size_t)bc->priv.size;
65+ if (size2 > size) {
66+ snd_error(TOPOLOGY, "bytes: wrong element size (%d, priv %d)",
67+ bc->size, bc->priv.size);
68+ 
Abackport-CVE-2026-96675.patch+35-0
@@ -0,0 +1,35 @@
1+From ece3e32e7bed80faaff2a9594a79f1f751d5bdca Mon Sep 17 00:00:00 2001
2+From: Harsh Raj Singhania <raj.harshraut@gmail.com>
3+Date: Sat, 19 Sep 2026 10:40:37 +0530
4+Subject: [PATCH] alsa-lib: harden UCM, conf parser, topology and PCM plugins
5+ against malformed input
6+ 
7+A8 (PCM multi, src/pcm/pcm_multi.c): two assert() calls fire on sparse
8+ channel binding maps (gaps between bindings leave sidxs[i]==-1), causing
9+ SIGABRT in debug builds and OOB reads under NDEBUG; replace with explicit
10+ -EINVAL returns. CWE-617.
11+ 
12+Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
13+ 
14+---
15+ src/pcm/pcm_multi.c | 6 ++++--
16+ 1 file changed, 4 insertions(+), 2 deletions(-)
17+ 
18+diff --git a/src/pcm/pcm_multi.c b/src/pcm/pcm_multi.c
19+index 121c4c2..dc4f919 100644
20+--- a/src/pcm/pcm_multi.c
21++++ b/src/pcm/pcm_multi.c
22+@@ -1121,8 +1121,10 @@ int snd_pcm_multi_open(snd_pcm_t **pcmp, const char *name,
23+ }
24+ for (i = 0; i < channels_count; ++i) {
25+ snd_pcm_multi_channel_t *bind = &multi->channels[i];
26+- assert(sidxs[i] < (int)slaves_count);
27+- assert(schannels[i] < schannels_count[sidxs[i]]);
28++ if (sidxs[i] < 0 || sidxs[i] >= (int)slaves_count) {
29++ SNDERR("multi: ch %d invalid slave idx %d", i, sidxs[i]); return -EINVAL; }
30++ if (schannels[i] >= schannels_count[sidxs[i]]) {
31++ SNDERR("multi: ch %d channel %d out of range", i, schannels[i]); return -EINVAL; }
32+ bind->slave_idx = sidxs[i];
33+ bind->slave_channel = schannels[i];
34+ if (sidxs[i] < 0)
35+