mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 08:14:09 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/wget: fix CVE-2026-58470

Browse Source 
Backport the upstream fix for integer overflows while parsing
Content-Range headers, together with the follow-up fix using
strtoll() for wgint values.

Backport to: 2025.02.x

Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 89485adb29)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
This commit is contained in:
Stefan Müller
2026-08-20 09:40:40 +00:00
committed by Titouan Christophe
parent cf345ac725
commit 2a99d1d195
3 changed files with 132 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
package/wget/0005-src-http.c-parse_content_range-Fix-integer-overflow.patch Normal file
View File

@@ -0,0 +1,80 @@
From 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
Date: Mon, 29 Jun 2026 18:57:54 +0200
Subject: [PATCH] * src/http.c (parse_content_range): Fix integer overflow
Reported-by: TristanInSec@gmail.com
CVE: CVE-2026-58470
Upstream: https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
---
src/http.c | 35 ++++++++++++++++++++++++-----------
1 file changed, 24 insertions(+), 11 deletions(-)
diff --git a/src/http.c b/src/http.c
index 61d83df1..f447c7f7 100644
--- a/src/http.c
+++ b/src/http.c
@@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
wgint *last_byte_ptr, wgint *entity_length_ptr)
{
wgint num;
+ char *end;
/* Ancient versions of Netscape proxy server, presumably predating
rfc2068, sent out `Content-Range' without the "bytes"
@@ -932,27 +933,39 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
}
if (!c_isdigit (*hdr))
return false;
- for (num = 0; c_isdigit (*hdr); hdr++)
- num = 10 * num + (*hdr - '0');
- if (*hdr != '-' || !c_isdigit (*(hdr + 1)))
+
+ errno = 0;
+ num = strtol(hdr, &end, 10);
+ if (errno == ERANGE)
+ return false;
+ hdr = end;
+
+ if (*hdr++ != '-' || !c_isdigit (*hdr))
return false;
*first_byte_ptr = num;
- ++hdr;
- for (num = 0; c_isdigit (*hdr); hdr++)
- num = 10 * num + (*hdr - '0');
- if (*hdr != '/')
+
+ errno = 0;
+ num = strtol(hdr, &end, 10);
+ if (errno == ERANGE)
+ return false;
+ hdr = end;
+
+ if (*hdr++ != '/')
return false;
*last_byte_ptr = num;
- if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*'))
+ if (!(c_isdigit (*hdr) || *hdr == '*'))
return false;
if (*last_byte_ptr < *first_byte_ptr)
return false;
- ++hdr;
if (*hdr == '*')
num = -1;
else
- for (num = 0; c_isdigit (*hdr); hdr++)
- num = 10 * num + (*hdr - '0');
+ {
+ errno = 0;
+ num = strtol(hdr, NULL, 10);
+ if (errno == ERANGE)
+ return false;
+ }
*entity_length_ptr = num;
if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1)
return false;
--
GitLab

48
package/wget/0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch Normal file
View File

@@ -0,0 +1,48 @@
From 01ff771caac1958662ca8665eed2021ec386a7af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
Date: Wed, 12 Aug 2026 19:45:21 +0200
Subject: [PATCH] * src/http.c (parse_content_range): Use strtoll instead of
strtol.
CVE: CVE-2026-58470
Upstream: https://gitlab.com/gnuwget/wget/-/commit/01ff771caac1958662ca8665eed2021ec386a7af
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
---
src/http.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/http.c b/src/http.c
index e5e75ee6..8170a43c 100644
--- a/src/http.c
+++ b/src/http.c
@@ -949,7 +949,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
return false;
errno = 0;
- num = strtol(hdr, &end, 10);
+ num = strtoll(hdr, &end, 10);
if (errno == ERANGE)
return false;
hdr = end;
@@ -959,7 +959,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
*first_byte_ptr = num;
errno = 0;
- num = strtol(hdr, &end, 10);
+ num = strtoll(hdr, &end, 10);
if (errno == ERANGE)
return false;
hdr = end;
@@ -976,7 +976,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
else
{
errno = 0;
- num = strtol(hdr, NULL, 10);
+ num = strtoll(hdr, NULL, 10);
if (errno == ERANGE)
return false;
}
--
GitLab

4
package/wget/wget.mk
View File

@@ -17,6 +17,10 @@ WGET_CPE_ID_VENDOR = gnu
# 0004-src-metalink.c-Include-ctype.h.patch
WGET_IGNORE_CVES += CVE-2026-58469
# 0005-src-http.c-parse_content_range-Fix-integer-overflow.patch
# 0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch
WGET_IGNORE_CVES += CVE-2026-58470
ifeq ($(BR2_PACKAGE_LIBPSL),y)
WGET_CONF_OPTS += --with-libpsl
WGET_DEPENDENCIES += libpsl