From fa8b0440b9494b0f44376bd9b178c66ee0ae120f Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Wed, 2 Sep 2026 15:16:33 +0200 Subject: [PATCH] package/clamav: add patch for CVE-2026-20215 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Titouan Christophe Signed-off-by: Raphaël Mélotte --- ...v-fix-7z-substream-count-overflow-53.patch | 40 +++++++++++++++++++ package/clamav/clamav.mk | 3 ++ 2 files changed, 43 insertions(+) create mode 100644 package/clamav/0007-libclamav-fix-7z-substream-count-overflow-53.patch diff --git a/package/clamav/0007-libclamav-fix-7z-substream-count-overflow-53.patch b/package/clamav/0007-libclamav-fix-7z-substream-count-overflow-53.patch new file mode 100644 index 0000000000..b8e80bec16 --- /dev/null +++ b/package/clamav/0007-libclamav-fix-7z-substream-count-overflow-53.patch @@ -0,0 +1,40 @@ +From: "Val S." +Date: Thu, 18 Jun 2026 16:44:09 -0400 +Subject: Libclamav: fix 7z substream count overflow (#53) + +A malformed 7z archive can force SzReadSubStreamsInfo() to sum +folder substream counts in a UInt32 accumulator until the total +wraps. The parser then allocates arrays using the wrapped smaller +count and later writes past the end of those buffers while filling +substream size metadata. + +Fix the parser by rejecting archives whose total unpack-stream +count would overflow UInt32 before the count is accumulated. This +preserves the existing parsing flow while preventing the +under-allocation that leads to the heap overflow. + +Credit: Trail of Bits, in collaboration with Anthropic + +CLAM-2967 + +--- +Upstream: https://github.com/Cisco-Talos/clamav/commit/615f5f327861d5be57d7963c103ee1996657e544 +CVE: CVE-2026-20215 +Signed-off-by: Titouan Christophe +--- + libclamav/7z/7zIn.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/libclamav/7z/7zIn.c b/libclamav/7z/7zIn.c +index 13e89bfa13..646c4a1a1c 100644 +--- a/libclamav/7z/7zIn.c ++++ b/libclamav/7z/7zIn.c +@@ -768,6 +768,8 @@ static SRes SzReadSubStreamsInfo( + UInt32 numStreams; + RINOK(SzReadNumber32(sd, &numStreams)); + folders[i].NumUnpackStreams = numStreams; ++ if (*numUnpackStreams > UINT32_MAX - numStreams) ++ return SZ_ERROR_FAIL; + *numUnpackStreams += numStreams; + } + continue; diff --git a/package/clamav/clamav.mk b/package/clamav/clamav.mk index 8e5d9278cc..45588d40ad 100644 --- a/package/clamav/clamav.mk +++ b/package/clamav/clamav.mk @@ -42,6 +42,9 @@ CLAMAV_IGNORE_CVES += CVE-2026-20214 # 0006-fix-alz-parser-robustness-and-scan-coverage-63.patch CLAMAV_IGNORE_CVES += CVE-2026-20243 +# 0007-libclamav-fix-7z-substream-count-overflow-53.patch +CLAMAV_IGNORE_CVES += CVE-2026-20215 + CLAMAV_DEPENDENCIES = \ bzip2 \ host-pkgconf \