mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 08:14:09 -09:00
11f509d1d2
- CVE-2026-41254:
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in
cmslut.c because the overflow check is performed after the
multiplication.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-41254
- da6110b1d1
- e0641b1828
- CVE-2026-42798:
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer
overflow in ParseCube in cmscgats.c.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42798
- 6a68601982
(cherry picked from commit c409050184)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
29 lines
898 B
Diff
29 lines
898 B
Diff
From da6110b1d14abc394633a388209abd5ebedd7ab0 Mon Sep 17 00:00:00 2001
|
|
From: Marti Maria <marti.maria@littlecms.com>
|
|
Date: Thu, 19 Feb 2026 09:07:20 +0100
|
|
Subject: [PATCH] Fix integer overflow in CubeSize()
|
|
|
|
Thanks to @zerojackyi for reporting
|
|
|
|
CVE: CVE-2026-41254
|
|
Upstream: https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/cmslut.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/cmslut.c b/src/cmslut.c
|
|
index 10891486..b2452090 100644
|
|
--- a/src/cmslut.c
|
|
+++ b/src/cmslut.c
|
|
@@ -460,7 +460,8 @@ void EvaluateCLUTfloatIn16(const cmsFloat32Number In[], cmsFloat32Number Out[],
|
|
static
|
|
cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
|
|
{
|
|
- cmsUInt32Number rv, dim;
|
|
+ cmsUInt32Number dim;
|
|
+ cmsUInt64Number rv;
|
|
|
|
_cmsAssert(Dims != NULL);
|
|
|