package/dash: add patch for CVE-2026-31323

The vulnerability description is not disclosed yet.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 7e24f892f6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>

package/dash/0002-fix-CVE-2026-31323.patch

@@ -0,0 +1,42 @@
+From 0034bfe185d3d875cebace8cb3ca5c9dabf9e0f3 Mon Sep 17 00:00:00 2001
+From: Muchen Hou <996029583@qq.com>
+Date: Mon, 13 Apr 2026 10:28:29 +0800
+Subject: arith: Fix CVE-2026-31323 INTMAX_MIN / -1 overflow
+
+Division and remainder currently guard against division by zero, but not
+against the signed overflow case INTMAX_MIN / -1. On affected systems
+this can trigger SIGFPE during arithmetic expansion.
+
+Add an explicit guard before evaluating division or remainder.
+
+Signed-off-by: Muchen Hou <996029583@qq.com>
+
+Merge the overflow check with the zero division check.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+
+CVE: CVE-2026-31323
+Upstream: https://git.kernel.org/pub/scm/utils/dash/dash.git/commit/?h=601bc50bfc2858ab7a9ec327fe4e33a9c4877759&id=0034bfe185d3d875cebace8cb3ca5c9dabf9e0f3
+Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
+---
+ src/arith_yacc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/arith_yacc.c b/src/arith_yacc.c
+index 1a087c3..b978ef0 100644
+--- a/src/arith_yacc.c
++++ b/src/arith_yacc.c
+@@ -98,8 +98,8 @@ static intmax_t do_binop(int op, intmax_t a, intmax_t b)
+ 	default:
+ 	case ARITH_REM:
+ 	case ARITH_DIV:
+-		if (!b)
+-			yyerror("division by zero");
++		if (!b || (a == INTMAX_MIN && b == -1))
++			yyerror("division error");
+ 		return op == ARITH_REM ? a % b : a / b;
+ 	case ARITH_MUL:
+ 		return a * b;
+-- 
+cgit 1.3-korg
+

package/dash/dash.mk

@@ -13,6 +13,9 @@ DASH_AUTORECONF = YES
 
 DASH_CPE_ID_VENDOR = dash
 
+# 0002-fix-CVE-2026-31323.patch
+DASH_IGNORE_CVES += CVE-2026-31323
+
 # dash does not build in parallel
 DASH_MAKE = $(MAKE1)