mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
0f2bd03f9a
Fixes the following vulnerabilities: GLIBC-SA-2026-0009: =================== scanf %mc off-by-one heap buffer overflow Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow. The bug is in the buffer growth formula in __vfscanf_internal, which under-allocates by one byte during realloc expansion, allowing a controlled single-byte overwrite past the end of the heap buffer. The impact is limited by the fact that to execute the overwrite you need both user controlled input data and a specific choice of maximum width that yields a smaller than needed allocation. The latter point has to take into account malloc's particular chunk size rounding process. The "%[width]mc" format specifier does not appear to have notable use in major Linux-based OS distributions, due to which the real world impact may be limited to bespoke use cases. CVE-Id: CVE-2026-5450 GLIBC-SA-2026-0010: =================== Potential buffer under-read in ungetwc Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. CVE-Id: CVE-2026-5928 https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/ git shortlog b676adadbc1f5fb2f31bc484a7628cca89ae6f22.. DJ Delorie (1): stdio-common: Allow partially-filled %mc buffers [BZ #12701] Florian Weimer (1): iconv: Suppress intermediate errors with //TRANSLIT (bug 34236) Maciej W. Rozycki (2): support: Implement 'xfmemopen' for seamless 'fmemopen' use stdio-common: Reject insufficient character data in scanf [BZ #12701] Rocket Ma (2): libio: Fix ungetwc operating on byte stream [BZ #33998] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches