2 files changed, 80 insertions, 0 deletions
diff --git a/meta/recipes-extended/wget/wget/CVE-2024-38428.patch b/meta/recipes-extended/wget/wget/CVE-2024-38428.patch
new file mode 100644
index 0000000000..ed99a05464
--- /dev/null
+++ b/meta/recipes-extended/wget/wget/CVE-2024-38428.patch
@@ -0,0 +1,79 @@
+From ed0c7c7e0e8f7298352646b2fd6e06a11e242ace Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
+Date: Sun, 2 Jun 2024 12:40:16 +0200
+Subject: Properly re-implement userinfo parsing (rfc2396)
+* src/url.c (url_skip_credentials): Properly re-implement userinfo parsing (rfc2396)
+The reason why the implementation is based on RFC 2396, an outdated standard,
+is that the whole file is based on that RFC, and mixing standard here might be
+dangerous.
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace]
+CVE: CVE-2024-38428
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/url.c | 40 ++++++++++++++++++++++++++++++++++------
+ 1 file changed, 34 insertions(+), 6 deletions(-)
+diff --git a/src/url.c b/src/url.c
+index 69e948b..07c3bc8 100644
+--- a/src/url.c
+++ b/src/url.c
+@@ -41,6 +41,7 @@ as that of the covered work.  */
+ #include "url.h"
+ #include "host.h"  /* for is_valid_ipv6_address */
+ #include "c-strcase.h"
+#include "c-ctype.h"
+ 
+ #ifdef HAVE_ICONV
+ # include <iconv.h>
+@@ -526,12 +527,39 @@ scheme_leading_string (enum url_scheme scheme)
+ static const char *
+ url_skip_credentials (const char *url)
+ {
+-  /* Look for '@' that comes before terminators, such as '/', '?',
+-     '#', or ';'.  */
+-  const char *p = (const char *)strpbrk (url, "@/?#;");
+-  if (!p || *p != '@')
+-    return url;
+-  return p + 1;
+  /*
+   * This whole file implements https://www.rfc-editor.org/rfc/rfc2396 .
+   * RFC 2396 is outdated since 2005 and needs a rewrite or a thorough re-visit.
+   *
+   * The RFC says
+   * server        = [ [ userinfo "@" ] hostport ]
+   * userinfo      = *( unreserved | escaped | ";" | ":" | "&" | "=" | "+" | "$" | "," )
+   * unreserved    = alphanum | mark
+   * mark          = "-" | "_" | "." | "!" | "~" | "*" | "'" | "(" | ")"
+   */
+  static const char *allowed = "-_.!~*'();:&=+$,";
+
+  for (const char *p = url; *p; p++)
+    {
+      if (c_isalnum(*p))
+        continue;
+
+      if (strchr(allowed, *p))
+        continue;
+
+      if (*p == '%' && c_isxdigit(p[1]) && c_isxdigit(p[2]))
+        {
+          p += 2;
+          continue;
+        }
+
+      if (*p == '@')
+        return p + 1;
+
+      break;
+    }
+
+  return url;
+ }
+ 
+ /* Parse credentials contained in [BEG, END).  The region is expected
+-- 
+cgit v1.1
diff --git a/meta/recipes-extended/wget/wget_1.21.4.bb b/meta/recipes-extended/wget/wget_1.21.4.bb
index 1d31b0116d..bc65a8f7c8 100644
--- a/meta/recipes-extended/wget/wget_1.21.4.bb
+++ b/meta/recipes-extended/wget/wget_1.21.4.bb
@@ -1,5 +1,6 @@
 SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
           file://0002-improve-reproducibility.patch \
+           file://CVE-2024-38428.patch \
          "
 SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c"

diff --git a/meta/recipes-extended/wget/wget/CVE-2024-38428.patch b/meta/recipes-extended/wget/wget/CVE-2024-38428.patch new file mode 100644 index 0000000000..ed99a05464 --- /dev/null +++ b/meta/recipes-extended/wget/wget/CVE-2024-38428.patch
@@ -0,0 +1,79 @@
		1	From ed0c7c7e0e8f7298352646b2fd6e06a11e242ace Mon Sep 17 00:00:00 2001
		2	From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
		3	Date: Sun, 2 Jun 2024 12:40:16 +0200
		4	Subject: Properly re-implement userinfo parsing (rfc2396)
		5
		6	* src/url.c (url_skip_credentials): Properly re-implement userinfo parsing (rfc2396)
		7
		8	The reason why the implementation is based on RFC 2396, an outdated standard,
		9	is that the whole file is based on that RFC, and mixing standard here might be
		10	dangerous.
		11
		12	Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace]
		13	CVE: CVE-2024-38428
		14	Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
		15	---
		16	src/url.c \| 40 ++++++++++++++++++++++++++++++++++------
		17	1 file changed, 34 insertions(+), 6 deletions(-)
		18
		19	diff --git a/src/url.c b/src/url.c
		20	index 69e948b..07c3bc8 100644
		21	--- a/src/url.c
		22	+++ b/src/url.c
		23	@@ -41,6 +41,7 @@ as that of the covered work. */
		24	#include "url.h"
		25	#include "host.h" /* for is_valid_ipv6_address */
		26	#include "c-strcase.h"
		27	+#include "c-ctype.h"
		28
		29	#ifdef HAVE_ICONV
		30	# include <iconv.h>
		31	@@ -526,12 +527,39 @@ scheme_leading_string (enum url_scheme scheme)
		32	static const char *
		33	url_skip_credentials (const char *url)
		34	{
		35	- /* Look for '@' that comes before terminators, such as '/', '?',
		36	- '#', or ';'. */
		37	- const char p = (const char )strpbrk (url, "@/?#;");
		38	- if (!p \|\| *p != '@')
		39	- return url;
		40	- return p + 1;
		41	+ /*
		42	+ * This whole file implements https://www.rfc-editor.org/rfc/rfc2396 .
		43	+ * RFC 2396 is outdated since 2005 and needs a rewrite or a thorough re-visit.
		44	+ *
		45	+ * The RFC says
		46	+ * server = [ [ userinfo "@" ] hostport ]
		47	+ * userinfo = *( unreserved \| escaped \| ";" \| ":" \| "&" \| "=" \| "+" \| "$" \| "," )
		48	+ * unreserved = alphanum \| mark
		49	+ * mark = "-" \| "_" \| "." \| "!" \| "~" \| "*" \| "'" \| "(" \| ")"
		50	+ */
		51	+ static const char allowed = "-_.!~'();:&=+$,";
		52	+
		53	+ for (const char p = url; p; p++)
		54	+ {
		55	+ if (c_isalnum(*p))
		56	+ continue;
		57	+
		58	+ if (strchr(allowed, *p))
		59	+ continue;
		60	+
		61	+ if (*p == '%' && c_isxdigit(p[1]) && c_isxdigit(p[2]))
		62	+ {
		63	+ p += 2;
		64	+ continue;
		65	+ }
		66	+
		67	+ if (*p == '@')
		68	+ return p + 1;
		69	+
		70	+ break;
		71	+ }
		72	+
		73	+ return url;
		74	}
		75
		76	/* Parse credentials contained in [BEG, END). The region is expected
		77	--
		78	cgit v1.1
		79


diff --git a/meta/recipes-extended/wget/wget_1.21.4.bb b/meta/recipes-extended/wget/wget_1.21.4.bb index 1d31b0116d..bc65a8f7c8 100644 --- a/meta/recipes-extended/wget/wget_1.21.4.bb +++ b/meta/recipes-extended/wget/wget_1.21.4.bb
@@ -1,5 +1,6 @@
1	SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \	1	SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
2	file://0002-improve-reproducibility.patch \	2	file://0002-improve-reproducibility.patch \
		3	file://CVE-2024-38428.patch \
3	"	4	"
4		5
5	SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c"	6	SRC_URI[sha256sum] = "81542f5cefb8faacc39bbbc6c82ded80e3e4a88505ae72ea51df27525bcde04c"