From 11f509d1d27b845c3fad1468cd8c80b0972dd9e7 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 12 May 2026 11:31:14 +0200 Subject: [PATCH] package/lcms2: patch CVE-2026-41254, CVE-2026-42798 - CVE-2026-41254: Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-41254 - https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0 - https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc - CVE-2026-42798: Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-42798 - https://github.com/mm2/Little-CMS/commit/6a686019825a89b715d16671f18d049523354176 (cherry picked from commit c409050184c743ebcf65640cc8eb5c56cc9f570e) Signed-off-by: Thomas Perale --- ...001-Fix-integer-overflow-in-CubeSize.patch | 28 ++++++++++++++ package/lcms2/0002-check-overflow.patch | 34 +++++++++++++++++ ...e-integer-overflow-in-LUT-allocation.patch | 38 +++++++++++++++++++ package/lcms2/lcms2.mk | 7 ++++ 4 files changed, 107 insertions(+) create mode 100644 package/lcms2/0001-Fix-integer-overflow-in-CubeSize.patch create mode 100644 package/lcms2/0002-check-overflow.patch create mode 100644 package/lcms2/0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch diff --git a/package/lcms2/0001-Fix-integer-overflow-in-CubeSize.patch b/package/lcms2/0001-Fix-integer-overflow-in-CubeSize.patch new file mode 100644 index 0000000000..84ccf4142b --- /dev/null +++ b/package/lcms2/0001-Fix-integer-overflow-in-CubeSize.patch @@ -0,0 +1,28 @@ +From da6110b1d14abc394633a388209abd5ebedd7ab0 Mon Sep 17 00:00:00 2001 +From: Marti Maria +Date: Thu, 19 Feb 2026 09:07:20 +0100 +Subject: [PATCH] Fix integer overflow in CubeSize() + +Thanks to @zerojackyi for reporting + +CVE: CVE-2026-41254 +Upstream: https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0 +Signed-off-by: Thomas Perale +--- + src/cmslut.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/cmslut.c b/src/cmslut.c +index 10891486..b2452090 100644 +--- a/src/cmslut.c ++++ b/src/cmslut.c +@@ -460,7 +460,8 @@ void EvaluateCLUTfloatIn16(const cmsFloat32Number In[], cmsFloat32Number Out[], + static + cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b) + { +- cmsUInt32Number rv, dim; ++ cmsUInt32Number dim; ++ cmsUInt64Number rv; + + _cmsAssert(Dims != NULL); + diff --git a/package/lcms2/0002-check-overflow.patch b/package/lcms2/0002-check-overflow.patch new file mode 100644 index 0000000000..4524db88fc --- /dev/null +++ b/package/lcms2/0002-check-overflow.patch @@ -0,0 +1,34 @@ +From e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc Mon Sep 17 00:00:00 2001 +From: Marti Maria +Date: Thu, 12 Mar 2026 22:57:35 +0100 +Subject: [PATCH] check for overflow + +Thanks to Guanni Qu for detecting & reporting the issue + +CVE: CVE-2026-41254 +Upstream: https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc +Signed-off-by: Thomas Perale +--- + src/cmslut.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/cmslut.c b/src/cmslut.c +index a60baf98..65c935fc 100644 +--- a/src/cmslut.c ++++ b/src/cmslut.c +@@ -468,12 +468,12 @@ cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b) + for (rv = 1; b > 0; b--) { + + dim = Dims[b-1]; +- if (dim <= 1) return 0; // Error +- +- rv *= dim; ++ if (dim <= 1) return 0; + + // Check for overflow + if (rv > UINT_MAX / dim) return 0; ++ ++ rv *= dim; + } + + // Again, prevent overflow diff --git a/package/lcms2/0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch b/package/lcms2/0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch new file mode 100644 index 0000000000..d53c3ad7f2 --- /dev/null +++ b/package/lcms2/0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch @@ -0,0 +1,38 @@ +From 6a686019825a89b715d16671f18d049523354176 Mon Sep 17 00:00:00 2001 +From: Marti Maria +Date: Thu, 19 Feb 2026 08:48:50 +0100 +Subject: [PATCH] Fix for ParseCube integer overflow in LUT allocation + +thanks to @zerojackyi for reporting + + +CVE: CVE-2026-42798 +Upstream: https://github.com/mm2/Little-CMS/commit/6a686019825a89b715d16671f18d049523354176 +[thomas: backport to 2.16] +Signed-off-by: Thomas Perale +--- + src/cmscgats.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/src/cmscgats.c b/src/cmscgats.c +index 252db22d..3d819fad 100644 +--- a/src/cmscgats.c ++++ b/src/cmscgats.c +@@ -3128,7 +3128,16 @@ cmsBool ParseCube(cmsIT8* cube, cmsStage** Shaper, cmsStage** CLUT, char title[] + + if (lut_size > 0) { + +- int nodes = lut_size * lut_size * lut_size; ++ int nodes; ++ ++ /** ++ * Professional LUT‑generation tools (e.g., Nobe LutBake) list 65×65×65 as their highest supported size. ++ */ ++ if (lut_size > 65) ++ return SynError(cube, "LUT size '%d' is over maximum of 65", lut_size); ++ ++ nodes = lut_size * lut_size * lut_size; ++ + + cmsFloat32Number* lut_table = _cmsMalloc(cube->ContextID, nodes * 3 * sizeof(cmsFloat32Number)); + if (lut_table == NULL) return FALSE; diff --git a/package/lcms2/lcms2.mk b/package/lcms2/lcms2.mk index 92aeff8890..474e1a9de3 100644 --- a/package/lcms2/lcms2.mk +++ b/package/lcms2/lcms2.mk @@ -14,6 +14,13 @@ LCMS2_INSTALL_STAGING = YES # tiff is only used by tificc sample LCMS2_CONF_OPTS = --without-tiff +# 0001-Fix-integer-overflow-in-CubeSize.patch +# 0002-check-overflow.patch +LCMS2_IGNORE_CVES += CVE-2026-41254 + +# 0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch +LCMS2_IGNORE_CVES += CVE-2026-42798 + ifeq ($(BR2_PACKAGE_JPEG),y) LCMS2_CONF_OPTS += --with-jpeg LCMS2_DEPENDENCIES += jpeg