summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-navigation
diff options
context:
space:
mode:
authorAnkur Tyagi <ankur.tyagi85@gmail.com>2026-01-17 22:45:30 +1300
committerAnuj Mittal <anuj.mittal@oss.qualcomm.com>2026-01-19 12:15:45 +0530
commit85f404194e154696800e06c7122da772dd4a7f08 (patch)
tree6c586ce0e1519ad1cb49dc844b7eab21d1e23f58 /meta-oe/recipes-navigation
parent600a42c435851035a9f596cc2d890ea5d01d61c0 (diff)
downloadmeta-openembedded-85f404194e154696800e06c7122da772dd4a7f08.tar.gz
gpsd: patch CVE-2025-67268
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67268 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Diffstat (limited to 'meta-oe/recipes-navigation')
-rw-r--r--meta-oe/recipes-navigation/gpsd/gpsd/CVE-2025-67268.patch214
-rw-r--r--meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb1
2 files changed, 215 insertions, 0 deletions
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2025-67268.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2025-67268.patch
new file mode 100644
index 0000000000..132ca70a77
--- /dev/null
+++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2025-67268.patch
@@ -0,0 +1,214 @@
1From c0ed640a755884bd62fd09d21b72f18825539353 Mon Sep 17 00:00:00 2001
2From: "Gary E. Miller" <gem@rellim.com>
3Date: Tue, 2 Dec 2025 19:36:04 -0800
4Subject: [PATCH] drivers/driver_nmea2000.c: Fix issue 356, skyview buffer
5 overrun.
6
7CVE: CVE-2025-67268
8Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4?view=inline]
9Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
10---
11 drivers/driver_nmea2000.c | 77 ++++++++++++++++++++++++---------------
12 1 file changed, 48 insertions(+), 29 deletions(-)
13
14diff --git a/drivers/driver_nmea2000.c b/drivers/driver_nmea2000.c
15index 66959f02d..a3b89a082 100644
16--- a/drivers/driver_nmea2000.c
17+++ b/drivers/driver_nmea2000.c
18@@ -12,11 +12,11 @@
19 * Message contents can be had from canboat/analyzer:
20 * analyzer -explain
21 *
22- * This file is Copyright 2012 by the GPSD project
23+ * This file is Copyright by the GPSD project
24 * SPDX-License-Identifier: BSD-2-clause
25 */
26
27-#include "../include/gpsd_config.h" /* must be before all includes */
28+#include "../include/gpsd_config.h" // must be before all includes
29
30 #if defined(NMEA2000_ENABLE)
31
32@@ -68,7 +68,7 @@ typedef struct PGN
33
34 #if LOG_FILE
35 FILE *logFile = NULL;
36-#endif /* of if LOG_FILE */
37+#endif // of if LOG_FILE
38
39 extern bool __attribute__ ((weak)) gpsd_add_device(const char *device_name,
40 bool flag_nowait);
41@@ -89,12 +89,12 @@ static int scale_int(int32_t var, const int64_t factor)
42 static void print_data(struct gps_context_t *context,
43 unsigned char *buffer, int len, PGN *pgn)
44 {
45- if ((libgps_debuglevel >= LOG_IO) != 0) {
46- int l1, l2, ptr;
47+ if (LOG_IO <= libgps_debuglevel) {
48+ int l1;
49 char bu[128];
50
51- ptr = 0;
52- l2 = sprintf(&bu[ptr], "got data:%6u:%3d: ", pgn->pgn, len);
53+ int ptr = 0;
54+ int l2 = sprintf(&bu[ptr], "got data:%6u:%3d: ", pgn->pgn, len);
55 ptr += l2;
56 for (l1=0;l1<len;l1++) {
57 if (((l1 % 20) == 0) && (l1 != 0)) {
58@@ -276,7 +276,7 @@ static gps_mask_t hnd_127258(unsigned char *bu, int len, PGN *pgn,
59 struct gps_device_t *session)
60 {
61 print_data(session->context, bu, len, pgn);
62- /* FIXME? Get magnetic variation */
63+ // FIXME? Get magnetic variation
64 GPSD_LOG(LOG_DATA, &session->context->errout,
65 "pgn %6d(%3d):\n", pgn->pgn, session->driver.nmea2000.unit);
66 return(0);
67@@ -358,7 +358,7 @@ static gps_mask_t hnd_126992(unsigned char *bu, int len, PGN *pgn,
68 {
69 // uint8_t sid;
70 // uint8_t source;
71- uint64_t usecs; /* time in us */
72+ uint64_t usecs; // time in us
73
74 print_data(session->context, bu, len, pgn);
75 GPSD_LOG(LOG_DATA, &session->context->errout,
76@@ -434,6 +434,7 @@ static gps_mask_t hnd_129540(unsigned char *bu, int len, PGN *pgn,
77 struct gps_device_t *session)
78 {
79 int l1;
80+ int expected_len;
81
82 print_data(session->context, bu, len, pgn);
83 GPSD_LOG(LOG_DATA, &session->context->errout,
84@@ -441,24 +442,39 @@ static gps_mask_t hnd_129540(unsigned char *bu, int len, PGN *pgn,
85
86 session->driver.nmea2000.sid[2] = bu[0];
87 session->gpsdata.satellites_visible = (int)bu[2];
88+ if (MAXCHANNELS <= session->gpsdata.satellites_visible) {
89+ // Handle a CVE for overrunning skyview[]
90+ GPSD_LOG(LOG_WARN, &session->context->errout,
91+ "pgn %6d(%3d): Too many sats %d\n",
92+ pgn->pgn, session->driver.nmea2000.unit,
93+ session->gpsdata.satellites_visible);
94+ session->gpsdata.satellites_visible = MAXCHANNELS;
95+ }
96+ expected_len = 3 + (12 * session->gpsdata.satellites_visible);
97+ if (len != expected_len) {
98+ GPSD_LOG(LOG_WARN, &session->context->errout,
99+ "pgn %6d(%3d): wrong length %d s/b %d\n",
100+ pgn->pgn, session->driver.nmea2000.unit,
101+ len, expected_len);
102+ return 0;
103+ }
104
105 memset(session->gpsdata.skyview, '\0', sizeof(session->gpsdata.skyview));
106 for (l1=0;l1<session->gpsdata.satellites_visible;l1++) {
107- int svt;
108- double azi, elev, snr;
109-
110- elev = getles16(bu, 3+12*l1+1) * 1e-4 * RAD_2_DEG;
111- azi = getleu16(bu, 3+12*l1+3) * 1e-4 * RAD_2_DEG;
112- snr = getles16(bu, 3+12*l1+5) * 1e-2;
113+ int offset = 3 + (12 * l1);
114+ double elev = getles16(bu, offset + 1) * 1e-4 * RAD_2_DEG;
115+ double azi = getleu16(bu, offset + 3) * 1e-4 * RAD_2_DEG;
116+ double snr = getles16(bu, offset + 5) * 1e-2;
117
118- svt = (int)(bu[3+12*l1+11] & 0x0f);
119+ int svt = (int)(bu[offset + 11] & 0x0f);
120
121- session->gpsdata.skyview[l1].elevation = (short) (round(elev));
122- session->gpsdata.skyview[l1].azimuth = (short) (round(azi));
123+ session->gpsdata.skyview[l1].elevation = elev;
124+ session->gpsdata.skyview[l1].azimuth = azi;
125 session->gpsdata.skyview[l1].ss = snr;
126- session->gpsdata.skyview[l1].PRN = (short)bu[3+12*l1+0];
127+ session->gpsdata.skyview[l1].PRN = (int16_t)bu[offset];
128 session->gpsdata.skyview[l1].used = false;
129- if ((svt == 2) || (svt == 5)) {
130+ if ((2 == svt) ||
131+ (5 == svt)) {
132 session->gpsdata.skyview[l1].used = true;
133 }
134 }
135@@ -588,7 +604,7 @@ static gps_mask_t hnd_129029(unsigned char *bu, int len, PGN *pgn,
136 struct gps_device_t *session)
137 {
138 gps_mask_t mask;
139- uint64_t usecs; /* time in us */
140+ uint64_t usecs; // time in us
141
142 print_data(session->context, bu, len, pgn);
143 GPSD_LOG(LOG_DATA, &session->context->errout,
144@@ -675,7 +691,7 @@ static gps_mask_t hnd_129038(unsigned char *bu, int len, PGN *pgn,
145 (unsigned int)ais_direction((unsigned int)getleu16(bu, 21), 1.0);
146 ais->type1.turn = ais_turn_rate((int)getles16(bu, 23));
147 ais->type1.status = (unsigned int) ((bu[25] >> 0) & 0x0f);
148- ais->type1.maneuver = 0; /* Not transmitted ???? */
149+ ais->type1.maneuver = 0; // Not transmitted ????
150 decode_ais_channel_info(bu, len, 163, session);
151
152 return(ONLINE_SET | AIS_SET);
153@@ -730,8 +746,9 @@ static gps_mask_t hnd_129039(unsigned char *bu, int len, PGN *pgn,
154
155 /*
156 * PGN 129040: AIS Class B Extended Position Report
157+ *
158+ * No test case for this message at the moment
159 */
160-/* No test case for this message at the moment */
161 static gps_mask_t hnd_129040(unsigned char *bu, int len, PGN *pgn,
162 struct gps_device_t *session)
163 {
164@@ -978,7 +995,7 @@ static gps_mask_t hnd_129794(unsigned char *bu, int len, PGN *pgn,
165 date2.tm_year+1900,
166 ais->type5.hour,
167 ais->type5.minute);
168-#endif /* of #if NMEA2000_DEBUG_AIS */
169+#endif // end of #if NMEA2000_DEBUG_AIS
170 decode_ais_channel_info(bu, len, 592, session);
171 return(ONLINE_SET | AIS_SET);
172 }
173@@ -988,8 +1005,9 @@ static gps_mask_t hnd_129794(unsigned char *bu, int len, PGN *pgn,
174
175 /*
176 * PGN 129798: AIS SAR Aircraft Position Report
177+ *
178+ * No test case for this message at the moment
179 */
180-/* No test case for this message at the moment */
181 static gps_mask_t hnd_129798(unsigned char *bu, int len, PGN *pgn,
182 struct gps_device_t *session)
183 {
184@@ -1016,8 +1034,8 @@ static gps_mask_t hnd_129798(unsigned char *bu, int len, PGN *pgn,
185 ais->type9.alt = (unsigned int) (getleu64(bu, 21)/1000000);
186 ais->type9.regional = (unsigned int) ((bu[29] >> 0) & 0xff);
187 ais->type9.dte = (unsigned int) ((bu[30] >> 0) & 0x01);
188-/* ais->type9.spare = (bu[30] >> 1) & 0x7f; */
189- ais->type9.assigned = 0; /* Not transmitted ???? */
190+// ais->type9.spare = (bu[30] >> 1) & 0x7f;
191+ ais->type9.assigned = 0; // Not transmitted ????
192 decode_ais_channel_info(bu, len, 163, session);
193
194 return(ONLINE_SET | AIS_SET);
195@@ -1028,8 +1046,9 @@ static gps_mask_t hnd_129798(unsigned char *bu, int len, PGN *pgn,
196
197 /*
198 * PGN 129802: AIS Safety Related Broadcast Message
199+ *
200+ * No test case for this message at the moment
201 */
202-/* No test case for this message at the moment */
203 static gps_mask_t hnd_129802(unsigned char *bu, int len, PGN *pgn,
204 struct gps_device_t *session)
205 {
206@@ -1043,7 +1062,7 @@ static gps_mask_t hnd_129802(unsigned char *bu, int len, PGN *pgn,
207 if (decode_ais_header(session->context, bu, len, ais, 0x3fffffff) != 0) {
208 int l;
209
210-/* ais->type14.channel = (bu[ 5] >> 0) & 0x1f; */
211+// ais->type14.channel = (bu[ 5] >> 0) & 0x1f;
212 for (l=0;l<36;l++) {
213 ais->type14.text[l] = (char) bu[6+l];
214 }
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb
index a755e39ed4..3833b4179b 100644
--- a/meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb
+++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.24.bb
@@ -7,6 +7,7 @@ PROVIDES = "virtual/gpsd"
7 7
8SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ 8SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \
9 file://gpsd.init \ 9 file://gpsd.init \
10 file://CVE-2025-67268.patch \
10 " 11 "
11SRC_URI[sha256sum] = "00ee13f615655284874a661be13553abe66128e6deb5cd648af9bc0cb345fe5c" 12SRC_URI[sha256sum] = "00ee13f615655284874a661be13553abe66128e6deb5cd648af9bc0cb345fe5c"
12 13
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-21 19:43:52 +0000