From 664db5d62c952f69f5cefe91a88ba9f107cd0b5b Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 10 Sep 2026 09:37:01 +0200 Subject: [PATCH] package/pcre2: security bump to version 10.48 https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48 Fixes the following security issues: (Security fix for specific API usage, GHSA-2p8c-ff85-vh9x) If pcre2_jit_compile() is called with options for some match modes, and then pcre2_match() is used to perform a match for a different match mode, an out-of-bounds read can occur if the match is attempted against invalid UTF input. (Security fix for pattern conversion, GHSA-q8g2-wprr-34m9) If pcre2_convert() is called on untrusted input on platforms with 32-bit size_t, an out-of-bounds heap write can occur. (Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA matching when using a heap limit; also fixed possible integer overflows which could cause under-allocation of the workspace. (Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several integer overflows while compiling patterns on 32-bit CPUs, which could cause under-allocation followed by out-of-bounds writes. (Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to prevent two out-of-bounds reads while scanning backwards through invalid UTF data with PCRE2_MATCH_INVALID_UTF. (Security fix for specific API usage, #937) Fixed a leak and later invalid free when calling the fast-path pcre2_jit_match() function with a match data object previously used with pcre2_match() and PCRE2_COPY_MATCHED_SUBJECT. (Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two uninitialised bytes from malloc() via pcre2_serialize_encode(). Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- package/pcre2/pcre2.hash | 4 ++-- package/pcre2/pcre2.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/pcre2/pcre2.hash b/package/pcre2/pcre2.hash index 17f15c0fdc..90991322a2 100644 --- a/package/pcre2/pcre2.hash +++ b/package/pcre2/pcre2.hash @@ -1,6 +1,6 @@ # Locally calculated after checking pgp signature: -# https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.bz2.sig -sha256 47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7 pcre2-10.47.tar.bz2 +# https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.48/pcre2-10.48.tar.bz2.sig +sha256 b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed pcre2-10.48.tar.bz2 # Locally computed sha256 197d8a73ffee0d6b09adba2f9c677b5f5aede24edf89258a68e48248d010d811 LICENCE.md sha256 5f216505c0f6ea3273caec89e766eef93cdeb7bbb0c429f9360116d7c938feeb deps/sljit/LICENSE diff --git a/package/pcre2/pcre2.mk b/package/pcre2/pcre2.mk index f2b5608150..ea841f482e 100644 --- a/package/pcre2/pcre2.mk +++ b/package/pcre2/pcre2.mk @@ -4,7 +4,7 @@ # ################################################################################ -PCRE2_VERSION = 10.47 +PCRE2_VERSION = 10.48 PCRE2_SITE = https://github.com/PCRE2Project/pcre2/releases/download/pcre2-$(PCRE2_VERSION) PCRE2_SOURCE = pcre2-$(PCRE2_VERSION).tar.bz2 PCRE2_LICENSE = BSD-3-Clause