已合并
fix CVE-2026-78161 #104
hanjinpeng创建于 8月24日
fix CVE-2026-78161 #104
已合并
共 2 个文件变更+51-1
| @@ -0,0 +1,43 @@ | |||
| 1 | +Origin: https://github.com/warmcat/libwebsockets/commit/1d44554a1bb262db63ff4e240152a9deecd99054 | ||
| 2 | +From 4fbd3e84fe7465c782d8255a9e6aac9da66de99e Mon Sep 17 00:00:00 2001 | ||
| 3 | +From: Biniam F Demissie <biniamfd@gmail.com> | ||
| 4 | +Date: Mon, 6 Jul 2026 04:33:45 +0100 | ||
| 5 | +Subject: [PATCH] cbor: overflow | ||
| 6 | + | ||
| 7 | +--- | ||
| 8 | + lib/misc/lecp.c | 11 ++++++----- | ||
| 9 | + 1 file changed, 6 insertions(+), 5 deletions(-) | ||
| 10 | + | ||
| 11 | +diff --git a/lib/misc/lecp.c b/lib/misc/lecp.c | ||
| 12 | +index 4783241..63ab8d9 100644 | ||
| 13 | +--- a/lib/misc/lecp.c | ||
| 14 | ++++ b/lib/misc/lecp.c | ||
| 15 | + report_raw_cbor(struct lecp_ctx *ctx) | ||
| 16 | + if (!ctx->cbor_pos) | ||
| 17 | + return 0; | ||
| 18 | + | ||
| 19 | ++ ctx->cbor_pos = 0; /* reset BEFORE callback */ | ||
| 20 | ++ | ||
| 21 | + if (pst->cb(ctx, LECPCB_LITERAL_CBOR)) | ||
| 22 | + return 1; | ||
| 23 | + | ||
| 24 | +- ctx->cbor_pos = 0; | ||
| 25 | +- | ||
| 26 | + return 0; | ||
| 27 | + } | ||
| 28 | + | ||
| 29 | + lecp_parse(struct lecp_ctx *ctx, const uint8_t *cbor, size_t len) | ||
| 30 | + */ | ||
| 31 | + | ||
| 32 | + if (ctx->literal_cbor_report) { | ||
| 33 | ++ if (ctx->cbor_pos >= sizeof(ctx->cbor)) { | ||
| 34 | ++ if (report_raw_cbor(ctx)) | ||
| 35 | ++ goto reject_callback; | ||
| 36 | ++ } | ||
| 37 | + ctx->cbor[ctx->cbor_pos++] = c; | ||
| 38 | +- if (ctx->cbor_pos == sizeof(ctx->cbor) && | ||
| 39 | +- report_raw_cbor(ctx)) | ||
| 40 | +- goto reject_callback; | ||
| 41 | + } | ||
| 42 | + | ||
| 43 | + switch (st->s) { | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: libwebsockets | 1 | Name: libwebsockets |
| 2 | Version: 4.3.3 | 2 | Version: 4.3.3 |
| 3 | -Release: 5 | 3 | +Release: 6 |
| 4 | Summary: A lightweight C library for Websockets | 4 | Summary: A lightweight C library for Websockets |
| 5 | License: LGPLv2 and Public Domain and BSD and MIT and zlib | 5 | License: LGPLv2 and Public Domain and BSD and MIT and zlib |
| 6 | URL: https://libwebsockets.org | 6 | URL: https://libwebsockets.org |
| @@ -13,6 +13,7 @@ Patch9004: 0004-fix-the-politically-sensitive-words.patch | |||
| 13 | Patch9005: 0005-backport-CVE-2025-11677.patch | 13 | Patch9005: 0005-backport-CVE-2025-11677.patch |
| 14 | Patch9006: 0006-backport-CVE-2025-11678.patch | 14 | Patch9006: 0006-backport-CVE-2025-11678.patch |
| 15 | Patch9007: 0007-backport-CVE-2026-10650.patch | 15 | Patch9007: 0007-backport-CVE-2026-10650.patch |
| 16 | +Patch9008: 0008-backport-CVE-2026-78161.patch | ||
| 16 | 17 | ||
| 17 | BuildRequires: cmake openssl-devel zlib-devel libev-devel gcc gcc-c++ | 18 | BuildRequires: cmake openssl-devel zlib-devel libev-devel gcc gcc-c++ |
| 18 | 19 | ||
| @@ -104,6 +105,12 @@ find %{buildroot} -name '*_static.pc' -exec rm -f {} ';' | |||
| 104 | %doc changelog README.md READMEs/ | 105 | %doc changelog README.md READMEs/ |
| 105 | 106 | ||
| 106 | %changelog | 107 | %changelog |
| 108 | +* Sun Aug 23 2026 hanjinpeng <hanjinpeng@kylinos.cn> - 4.3.3-6 | ||
| 109 | +- Type:CVE | ||
| 110 | +- ID:CVE-2026-78161 | ||
| 111 | +- SUG:NA | ||
| 112 | +- DESC:fix CVE-2026-78161: out-of-bounds write in report_raw_cbor | ||
| 113 | + | ||
| 107 | * Thu Jun 04 2026 jade_t <yzd50036@gmail.com> - 4.3.3-5 | 114 | * Thu Jun 04 2026 jade_t <yzd50036@gmail.com> - 4.3.3-5 |
| 108 | - Type:bugfix | 115 | - Type:bugfix |
| 109 | - ID:NA | 116 | - ID:NA |