summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch')
-rw-r--r--meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch44
1 files changed, 0 insertions, 44 deletions
diff --git a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch b/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch
deleted file mode 100644
index 1a809b4f25..0000000000
--- a/meta-oe/recipes-graphics/gphoto2/libgphoto2/CVE-2026-40336.patch
+++ /dev/null
@@ -1,44 +0,0 @@
1From e19c45d3530f1585805711e14aa4ea788e499f46 Mon Sep 17 00:00:00 2001
2From: Marcus Meissner <marcus@jet.franken.de>
3Date: Wed, 8 Apr 2026 15:13:51 +0200
4Subject: [PATCH] Fixed Sony DPD Secondary Enum List Memory Leak
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9Finding 4: Sony DPD Secondary Enum List Memory Leak (CWE-401) — LOW
10
11File: ptp-pack.c:884-885
12
13When processing a secondary enumeration list (2024+ Sony cameras), line
14884–885 overwrites dpd->FORM.Enum.SupportedValue with a new calloc()
15without freeing the previous allocation from line 857. The original
16array and any string values it contains are leaked.
17
18CVE-2026-40336
19
20Reported-By: Sebastián Alba <sebasjosue84@gmail.com>
21
22CVE: CVE-2026-40336
23Upstream-Status: Backport [https://github.com/gphoto/libgphoto2/commit/404ff02c75f3cb280196fc260a63c4d26cf1a8f6]
24Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
25---
26 camlibs/ptp2/ptp-pack.c | 5 +++++
27 1 file changed, 5 insertions(+)
28
29diff --git a/camlibs/ptp2/ptp-pack.c b/camlibs/ptp2/ptp-pack.c
30index 7fc120d..fc51d77 100644
31--- a/camlibs/ptp2/ptp-pack.c
32+++ b/camlibs/ptp2/ptp-pack.c
33@@ -879,6 +879,11 @@ ptp_unpack_Sony_DPD (PTPParams *params, const unsigned char* data, PTPDeviceProp
34 /* check if we have a secondary list of items, this is for newer Sonys (2024) */
35 if (val < 0x200) { /* if a secondary list is not provided, this will be the next property code - 0x5XXX or 0xDxxx */
36 if (dpd->FormFlag == PTP_DPFF_Enumeration) {
37+ /* free old enum variables */
38+ for (i=0;i<dpd->FORM.Enum.NumberOfValues;i++)
39+ ptp_free_propvalue (dpd->DataType, dpd->FORM.Enum.SupportedValue+i);
40+ free (dpd->FORM.Enum.SupportedValue);
41+
42 N = dtoh16o(data, *poffset);
43 dpd->FORM.Enum.SupportedValue = calloc(N,sizeof(dpd->FORM.Enum.SupportedValue[0]));
44 if (!dpd->FORM.Enum.SupportedValue)