mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-30 22:11:59 -09:00
cf345ac725
Backport the upstream fix for a buffer underflow in
clean_metalink_string(), together with the two required follow-up
fixes for the inverted whitespace check and missing ctype.h include.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 937e33237e)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
41 lines
1.4 KiB
Diff
41 lines
1.4 KiB
Diff
From 7b1cdecc49bc77bde220fc575c8a00386c3f3bcf Mon Sep 17 00:00:00 2001
|
|
From: ChenYanpan <chenyanpan@xfusion.com>
|
|
Date: Wed, 8 Jul 2026 12:09:55 +0800
|
|
Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix inverted
|
|
trailing-space check
|
|
|
|
37a40fcb added an `end > beg' bound guard to prevent a buffer
|
|
underflow, but accidentally flipped the condition from `isspace' to
|
|
`!isspace'. The loop therefore walked back over non-space characters
|
|
instead of trailing whitespace, collapsing any string without a
|
|
trailing newline to "". Every Metalink/HTTP resource URL was wiped,
|
|
so wget could not follow any mirror and
|
|
testenv/Test-metalink-http.py failed ("Expected file test.meta not
|
|
found"). Restore the `isspace' condition.
|
|
|
|
Copyright-paperwork-exempt: Yes
|
|
CVE: CVE-2026-58469
|
|
Upstream: https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf
|
|
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
|
|
|
|
---
|
|
src/metalink.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/metalink.c b/src/metalink.c
|
|
index 3acdc3a2..3794909f 100644
|
|
--- a/src/metalink.c
|
|
+++ b/src/metalink.c
|
|
@@ -1061,7 +1061,7 @@ clean_metalink_string (char **str)
|
|
/* If we are at the end of the string, search the first legit
|
|
character going backward. */
|
|
if (*end == '\0')
|
|
- while (end > beg && !isspace(*(end - 1)))
|
|
+ while (end > beg && isspace(*(end - 1)))
|
|
end--;
|
|
|
|
new = xmemdup0 (beg, end - beg);
|
|
--
|
|
GitLab
|
|
|