1 files changed, 41 insertions, 0 deletions

diff --git a/meta-oe/recipes-support/opensc/files/CVE-2025-66038.patch b/meta-oe/recipes-support/opensc/files/CVE-2025-66038.patch
new file mode 100644
index 0000000000..e5a27deae5
--- /dev/null
+++ b/meta-oe/recipes-support/opensc/files/CVE-2025-66038.patch
@@ -0,0 +1,41 @@
+From 2f5582340ac3fd2062d0f6561a13aa9b269062dd Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Tue, 18 Nov 2025 14:13:59 +0100
+Subject: [PATCH] compacttlv: Fix possible buffer overrun
+
+Fixes: GHSA-72x5-fwjx-2459
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+(cherry picked from commit a20b91adc2fc66785c0df98abc8ef456c0eaab9d)
+
+CVE: CVE-2025-66038
+Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/a20b91adc2fc66785c0df98abc8ef456c0eaab9d]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libopensc/sc.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/src/libopensc/sc.c b/src/libopensc/sc.c
+index 7c9e0d25e..eb88b9abe 100644
+--- a/src/libopensc/sc.c
++++ b/src/libopensc/sc.c
+@@ -1082,13 +1082,15 @@ const u8 *sc_compacttlv_find_tag(const u8 *buf, size_t len, u8 tag, size_t *outl
+                size_t expected_len = tag & 0x0F;
+ 
+                for (idx = 0; idx < len; idx++) {
+-                       if ((buf[idx] & 0xF0) == plain_tag && idx + expected_len < len &&
+-                           (expected_len == 0 || expected_len == (buf[idx] & 0x0F))) {
++                       u8 ctag = buf[idx] & 0xF0;
++                       size_t ctag_len = buf[idx] & 0x0F;
++                       if (ctag == plain_tag && idx + ctag_len < len &&
++                                       (expected_len == 0 || expected_len == ctag_len)) {
+                                if (outlen != NULL)
+-                                       *outlen = buf[idx] & 0x0F;
++                                       *outlen = ctag_len;
+                                return buf + (idx + 1);
+                        }
+-                       idx += (buf[idx] & 0x0F);
++                       idx += ctag_len;
+                 }
+         }
+        return NULL;