mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-25 19:40:35 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/clamav: add patch for CVE-2026-20214

Browse Source 
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit is contained in:
Titouan Christophe
2026-09-02 15:16:31 +02:00
committed by Raphaël Mélotte
parent 17dc1b620d
commit ab226ca758
2 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
package/clamav/0005-libclamav-fix-fsg-section-loop-underflow-51.patch Normal file
View File

@@ -0,0 +1,40 @@
From: "Val S." <valsnyde@cisco.com>
Date: Wed, 17 Jun 2026 09:25:13 -0400
Subject: Libclamav: fix FSG section loop underflow (#51)
A malformed FSG sample can leave the recovered section count at
zero in the v1.31 unpacker path. The code then allocates space for
one section entry but initializes recovered RVAs with a loop bound
that underflows, causing an out-of-bounds write past the end of the
sections array.
Fix the loop bound by iterating while t is strictly less than the
section count. This preserves the intended behavior for valid
nonzero counts and correctly performs zero iterations when no
original sections were recovered.
Credit: Trail of Bits, in collaboration with Anthropic
CLAM-2966
---
Upstream: https://github.com/Cisco-Talos/clamav/commit/042bc35d0a89d6658de30ebc8494b3532e73dcc8
CVE: CVE-2026-20214
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
libclamav/pe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libclamav/pe.c b/libclamav/pe.c
index 23f4c4ae0d..c894ec7ca8 100644
--- a/libclamav/pe.c
+++ b/libclamav/pe.c
@@ -3753,7 +3753,7 @@ int cli_scanpe(cli_ctx *ctx)
}
sections[0].rva = newedi;
- for (t = 0; t <= (uint32_t)sectcnt - 1; t++)
+ for (t = 0; t < (uint32_t)sectcnt; t++)
sections[t + 1].rva = (((support[t * 2] | (support[t * 2 + 1] << 8)) - 2) << 12) - EC32(peinfo->pe_opt.opt32.ImageBase);
if (!peinfo->sections[i + 1].rsz || !(src = fmap_need_off_once(map, peinfo->sections[i + 1].raw, ssize))) {

3
package/clamav/clamav.mk
View File

@@ -36,6 +36,9 @@ CLAMAV_IGNORE_CVES += CVE-2026-20213
# 0004-libclamav-enforce-installshield-extraction-limits-55.patch
CLAMAV_IGNORE_CVES += CVE-2026-20216
# 0005-libclamav-fix-fsg-section-loop-underflow-51.patch
CLAMAV_IGNORE_CVES += CVE-2026-20214
CLAMAV_DEPENDENCIES = \
bzip2 \
host-pkgconf \