mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-27 20:40:34 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/lcms2: patch CVE-2026-41254, CVE-2026-42798

Browse Source 
- CVE-2026-41254:
    Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in
    cmslut.c because the overflow check is performed after the
    multiplication.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-41254
 - da6110b1d1
 - e0641b1828

- CVE-2026-42798:
    Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer
    overflow in ParseCube in cmscgats.c.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-42798
 - 6a68601982

(cherry picked from commit c409050184)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-05-12 11:31:14 +02:00
parent f55a6134b7
commit 11f509d1d2
4 changed files with 107 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
package/lcms2/0001-Fix-integer-overflow-in-CubeSize.patch Normal file
View File

@@ -0,0 +1,28 @@
From da6110b1d14abc394633a388209abd5ebedd7ab0 Mon Sep 17 00:00:00 2001
From: Marti Maria <marti.maria@littlecms.com>
Date: Thu, 19 Feb 2026 09:07:20 +0100
Subject: [PATCH] Fix integer overflow in CubeSize()
Thanks to @zerojackyi for reporting
CVE: CVE-2026-41254
Upstream: https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/cmslut.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/cmslut.c b/src/cmslut.c
index 10891486..b2452090 100644
--- a/src/cmslut.c
+++ b/src/cmslut.c
@@ -460,7 +460,8 @@ void EvaluateCLUTfloatIn16(const cmsFloat32Number In[], cmsFloat32Number Out[],
static
cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
{
- cmsUInt32Number rv, dim;
+ cmsUInt32Number dim;
+ cmsUInt64Number rv;
_cmsAssert(Dims != NULL);

34
package/lcms2/0002-check-overflow.patch Normal file
View File

@@ -0,0 +1,34 @@
From e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc Mon Sep 17 00:00:00 2001
From: Marti Maria <marti.maria@littlecms.com>
Date: Thu, 12 Mar 2026 22:57:35 +0100
Subject: [PATCH] check for overflow
Thanks to Guanni Qu for detecting & reporting the issue
CVE: CVE-2026-41254
Upstream: https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/cmslut.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/cmslut.c b/src/cmslut.c
index a60baf98..65c935fc 100644
--- a/src/cmslut.c
+++ b/src/cmslut.c
@@ -468,12 +468,12 @@ cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
for (rv = 1; b > 0; b--) {
dim = Dims[b-1];
- if (dim <= 1) return 0; // Error
-
- rv *= dim;
+ if (dim <= 1) return 0;
// Check for overflow
if (rv > UINT_MAX / dim) return 0;
+
+ rv *= dim;
}
// Again, prevent overflow

38
package/lcms2/0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch Normal file
View File

@@ -0,0 +1,38 @@
From 6a686019825a89b715d16671f18d049523354176 Mon Sep 17 00:00:00 2001
From: Marti Maria <marti.maria@littlecms.com>
Date: Thu, 19 Feb 2026 08:48:50 +0100
Subject: [PATCH] Fix for ParseCube integer overflow in LUT allocation
thanks to @zerojackyi for reporting
CVE: CVE-2026-42798
Upstream: https://github.com/mm2/Little-CMS/commit/6a686019825a89b715d16671f18d049523354176
[thomas: backport to 2.16]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/cmscgats.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/src/cmscgats.c b/src/cmscgats.c
index 252db22d..3d819fad 100644
--- a/src/cmscgats.c
+++ b/src/cmscgats.c
@@ -3128,7 +3128,16 @@ cmsBool ParseCube(cmsIT8* cube, cmsStage** Shaper, cmsStage** CLUT, char title[]
if (lut_size > 0) {
- int nodes = lut_size * lut_size * lut_size;
+ int nodes;
+
+ /**
+ * Professional LUT‑generation tools (e.g., Nobe LutBake) list 65×65×65 as their highest supported size.
+ */
+ if (lut_size > 65)
+ return SynError(cube, "LUT size '%d' is over maximum of 65", lut_size);
+
+ nodes = lut_size * lut_size * lut_size;
+
cmsFloat32Number* lut_table = _cmsMalloc(cube->ContextID, nodes * 3 * sizeof(cmsFloat32Number));
if (lut_table == NULL) return FALSE;

7
package/lcms2/lcms2.mk
View File

@@ -14,6 +14,13 @@ LCMS2_INSTALL_STAGING = YES
# tiff is only used by tificc sample
LCMS2_CONF_OPTS = --without-tiff
# 0001-Fix-integer-overflow-in-CubeSize.patch
# 0002-check-overflow.patch
LCMS2_IGNORE_CVES += CVE-2026-41254
# 0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch
LCMS2_IGNORE_CVES += CVE-2026-42798
ifeq ($(BR2_PACKAGE_JPEG),y)
LCMS2_CONF_OPTS += --with-jpeg
LCMS2_DEPENDENCIES += jpeg