diff options
Diffstat (limited to 'meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch')
| -rw-r--r-- | meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch | 44 |
1 files changed, 0 insertions, 44 deletions
diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch deleted file mode 100644 index 1a809b4f25..0000000000 --- a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch +++ /dev/null | |||
| @@ -1,44 +0,0 @@ | |||
| 1 | From e19c45d3530f1585805711e14aa4ea788e499f46 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Marcus Meissner <marcus@jet.franken.de> | ||
| 3 | Date: Wed, 8 Apr 2026 15:13:51 +0200 | ||
| 4 | Subject: [PATCH] Fixed Sony DPD Secondary Enum List Memory Leak | ||
| 5 | MIME-Version: 1.0 | ||
| 6 | Content-Type: text/plain; charset=UTF-8 | ||
| 7 | Content-Transfer-Encoding: 8bit | ||
| 8 | |||
| 9 | Finding 4: Sony DPD Secondary Enum List Memory Leak (CWE-401) — LOW | ||
| 10 | |||
| 11 | File: ptp-pack.c:884-885 | ||
| 12 | |||
| 13 | When processing a secondary enumeration list (2024+ Sony cameras), line | ||
| 14 | 884–885 overwrites dpd->FORM.Enum.SupportedValue with a new calloc() | ||
| 15 | without freeing the previous allocation from line 857. The original | ||
| 16 | array and any string values it contains are leaked. | ||
| 17 | |||
| 18 | CVE-2026-40336 | ||
| 19 | |||
| 20 | Reported-By: Sebastián Alba <sebasjosue84@gmail.com> | ||
| 21 | |||
| 22 | CVE: CVE-2026-40336 | ||
| 23 | Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/404ff02c75f3cb280196fc260a63c4d26cf1a8f6] | ||
| 24 | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> | ||
| 25 | --- | ||
| 26 | camlibs/ptp2/ptp-pack.c | 5 +++++ | ||
| 27 | 1 file changed, 5 insertions(+) | ||
| 28 | |||
| 29 | diff --git a/camlibs/ptp2/ptp-pack.c b/camlibs/ptp2/ptp-pack.c | ||
| 30 | index 7fc120d..fc51d77 100644 | ||
| 31 | --- a/camlibs/ptp2/ptp-pack.c | ||
| 32 | +++ b/camlibs/ptp2/ptp-pack.c | ||
| 33 | @@ -879,6 +879,11 @@ ptp_unpack_Sony_DPD (PTPParams *params, const unsigned char* data, PTPDeviceProp | ||
| 34 | /* check if we have a secondary list of items, this is for newer Sonys (2024) */ | ||
| 35 | if (val < 0x200) { /* if a secondary list is not provided, this will be the next property code - 0x5XXX or 0xDxxx */ | ||
| 36 | if (dpd->FormFlag == PTP_DPFF_Enumeration) { | ||
| 37 | + /* free old enum variables */ | ||
| 38 | + for (i=0;i<dpd->FORM.Enum.NumberOfValues;i++) | ||
| 39 | + ptp_free_propvalue (dpd->DataType, dpd->FORM.Enum.SupportedValue+i); | ||
| 40 | + free (dpd->FORM.Enum.SupportedValue); | ||
| 41 | + | ||
| 42 | N = dtoh16o(data, *poffset); | ||
| 43 | dpd->FORM.Enum.SupportedValue = calloc(N,sizeof(dpd->FORM.Enum.SupportedValue[0])); | ||
| 44 | if (!dpd->FORM.Enum.SupportedValue) | ||
