From e0914c0ef7ad85b3f969788af8f0c49cf021c2b8 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 17 Apr 2026 14:06:41 +0200 Subject: [PATCH] package/xz: patch CVE-2026-34743 - CVE-2026-34743: XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-34743 - https://security-tracker.debian.org/tracker/CVE-2026-34743 - https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 (cherry picked from commit 724635227314010518372c5bad4d37d7c58950c1) Signed-off-by: Thomas Perale --- ...buffer-overflow-in-lzma-index-append.patch | 62 +++++++++++++++++++ package/xz/xz.mk | 5 +- 2 files changed, 66 insertions(+), 1 deletion(-) create mode 100644 package/xz/0005-liblzma-Fix-a-buffer-overflow-in-lzma-index-append.patch diff --git a/package/xz/0005-liblzma-Fix-a-buffer-overflow-in-lzma-index-append.patch b/package/xz/0005-liblzma-Fix-a-buffer-overflow-in-lzma-index-append.patch new file mode 100644 index 0000000000..034122d4f7 --- /dev/null +++ b/package/xz/0005-liblzma-Fix-a-buffer-overflow-in-lzma-index-append.patch @@ -0,0 +1,62 @@ +From c8c22869e780ff57c96b46939c3d79ff99395f87 Mon Sep 17 00:00:00 2001 +From: Lasse Collin +Date: Sun, 29 Mar 2026 19:11:21 +0300 +Subject: [PATCH] liblzma: Fix a buffer overflow in lzma_index_append() + +If lzma_index_decoder() was used to decode an Index that contained no +Records, the resulting lzma_index had an invalid internal "prealloc" +value. If lzma_index_append() was called on this lzma_index, too +little memory would be allocated and a buffer overflow would occur. + +While this combination of the API functions is meant to work, in the +real-world apps this call sequence is rare or might not exist at all. + +This bug is older than xz 5.0.0, so all stable releases are affected. + +Reported-by: GitHub user christos-spearbit +CVE: CVE-2026-34743 +Upstream: https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 +Signed-off-by: Thomas Perale +--- + src/liblzma/common/index.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c +index 6add6a683..c4aadb9b0 100644 +--- a/src/liblzma/common/index.c ++++ b/src/liblzma/common/index.c +@@ -433,6 +433,26 @@ lzma_index_prealloc(lzma_index *i, lzma_vli records) + if (records > PREALLOC_MAX) + records = PREALLOC_MAX; + ++ // If index_decoder.c calls us with records == 0, it's decoding ++ // an Index that has no Records. In that case the decoder won't call ++ // lzma_index_append() at all, and i->prealloc isn't used during ++ // the Index decoding either. ++ // ++ // Normally the first lzma_index_append() call from the Index decoder ++ // would reset i->prealloc to INDEX_GROUP_SIZE. With no Records, ++ // lzma_index_append() isn't called and the resetting of prealloc ++ // won't occur either. Thus, if records == 0, use the default value ++ // INDEX_GROUP_SIZE instead. ++ // ++ // NOTE: lzma_index_append() assumes i->prealloc > 0. liblzma <= 5.8.2 ++ // didn't have this check and could set i->prealloc = 0, which would ++ // result in a buffer overflow if the application called ++ // lzma_index_append() after decoding an empty Index. Appending ++ // Records after decoding an Index is a rare thing to do, but ++ // it is supposed to work. ++ if (records == 0) ++ records = INDEX_GROUP_SIZE; ++ + i->prealloc = (size_t)(records); + return; + } +@@ -685,6 +705,7 @@ lzma_index_append(lzma_index *i, const lzma_allocator *allocator, + ++g->last; + } else { + // We need to allocate a new group. ++ assert(i->prealloc > 0); + g = lzma_alloc(sizeof(index_group) + + i->prealloc * sizeof(index_record), + allocator); diff --git a/package/xz/xz.mk b/package/xz/xz.mk index 60c2df70ee..205ab928a7 100644 --- a/package/xz/xz.mk +++ b/package/xz/xz.mk @@ -22,7 +22,10 @@ HOST_XZ_ADD_CCACHE_DEPENDENCY = NO # 0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch # 0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch # 0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch -XZ_IGNORE_CVES = CVE-2025-31115 +XZ_IGNORE_CVES += CVE-2025-31115 + +# 0005-liblzma-Fix-a-buffer-overflow-in-lzma-index-append.patch +XZ_IGNORE_CVES += CVE-2026-34743 XZ_CONF_OPTS = \ --enable-encoders=lzma1,lzma2,delta,x86,powerpc,ia64,arm,armthumb,arm64,sparc,riscv \