From 854ca25d2c8dfb8719d4a7f66e396e4c8be9baae Mon Sep 17 00:00:00 2001 From: deepin-ci-robot Date: Fri, 17 Jul 2026 13:01:21 +0800 Subject: [PATCH 1/2] fix(cve): CVE-2026-5928 - libio: Fix ungetwc operating on byte stream [BZ #33998] CVE: CVE-2026-5928 (high) - libio: Fix ungetwc operating on byte stream [BZ #33998]. When _IO_wdefault_pbackfail attempts to push back one character, it accidentally compares the wchar to push back with the last char from byte stream, instead of wide stream. Under specific coding, attacker may exploit this to leak information. Upstream: https://github.com/bminor/glibc/commit/ef3bfb5f910011f3780cb06aa47e730035f53285 Co-authored-by: CVE Backport Agent Generated-By: qwen3.6-35b --- debian/changelog | 6 ++ debian/patches/CVE-2026-5928.patch | 95 ++++++++++++++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 102 insertions(+) create mode 100644 debian/patches/CVE-2026-5928.patch diff --git a/debian/changelog b/debian/changelog index 9132438b..319c03c9 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +glibc (2.38-6deepin26) unstable; urgency=medium + + * fix(cve): CVE-2026-5928 + + -- deepin-ci-robot Fri, 17 Jul 2026 13:01:20 +0800 + glibc (2.38-6deepin25) unstable; urgency=medium * Fix mark cpuinfo feature tests xfail in pbuilder. diff --git a/debian/patches/CVE-2026-5928.patch b/debian/patches/CVE-2026-5928.patch new file mode 100644 index 00000000..08afab33 --- /dev/null +++ b/debian/patches/CVE-2026-5928.patch @@ -0,0 +1,95 @@ +Description: CVE-2026-5928 - 安全修复 +Author: Rocket Ma +Origin: https://github.com/bminor/glibc/commit/ef3bfb5f910011f3780cb06aa47e730035f53285 +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-5928 +Last-Update: 2026-05-02 +--- + +diff --git a/libio/Makefile b/libio/Makefile +index 287ec113..206421c3 100644 +--- a/libio/Makefile ++++ b/libio/Makefile +@@ -75,7 +75,7 @@ tests = tst_swprintf tst_wprintf tst_swscanf tst_wscanf tst_getwc tst_putwc \ + tst-freopen bug-rewind bug-rewind2 bug-ungetc bug-fseek \ + tst-mmap-eofsync tst-mmap-fflushsync bug-mmap-fflush \ + tst-mmap2-eofsync tst-mmap-offend bug-fopena+ bug-wfflush \ +- bug-ungetc2 bug-ftell bug-ungetc3 bug-ungetc4 tst-fopenloc2 \ ++ bug-wgenops-bz33998 bug-ungetc2 bug-ftell bug-ungetc3 bug-ungetc4 tst-fopenloc2 \ + tst-memstream1 tst-memstream2 tst-memstream3 tst-memstream4 \ + tst-wmemstream1 tst-wmemstream2 tst-wmemstream3 tst-wmemstream4 \ + tst-wmemstream5 bug-memstream1 bug-wmemstream1 \ +diff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c +new file mode 100644 +index 00000000..cc4067da +--- /dev/null ++++ b/libio/bug-wgenops-bz33998.c +@@ -0,0 +1,54 @@ ++/* Regression test for ungetwc operating on byte stream (BZ #33998) ++ Copyright (C) 2026 The GNU Toolchain Authors. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include "support/temp_file.h" ++#include "support/xstdio.h" ++#include "support/xunistd.h" ++#include ++#include ++#include ++#include ++#include ++#include ++ ++static int ++do_test (void) ++{ ++ char *filename; ++ int fd = create_temp_file ("tst-bz33998-", &filename); ++ TEST_VERIFY (fd != -1); ++ xwrite (fd, "A", sizeof ("A")); // write "A\0" by design ++ xclose (fd); ++ ++ FILE *fp = xfopen (filename, "r+"); ++ TEST_COMPARE (getwc (fp), L'A'); ++ /* If the bug is fixed, then ungetwc should not touch byte stream. ++ If the bug is not fixed, ungetwc firstly match last read char, L'A', ++ failed, then the pbackfail branch, matching last read char in byte ++ stream, that is, '\0' (initialized when setup wide stream). */ ++ char *old_read_ptr = fp->_IO_read_ptr; ++ TEST_COMPARE (ungetwc (L'\0', fp), L'\0'); ++ TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr); ++ ++ xfclose (fp); ++ free (filename); ++ ++ return 0; ++} ++ ++#include +diff --git a/libio/wgenops.c b/libio/wgenops.c +index 4a278802..c593debe 100644 +--- a/libio/wgenops.c ++++ b/libio/wgenops.c +@@ -108,8 +108,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c) + { + if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base + && !_IO_in_backup (fp) +- && (wint_t) fp->_IO_read_ptr[-1] == c) +- --fp->_IO_read_ptr; ++ && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c) ++ --fp->_wide_data->_IO_read_ptr; + else + { + /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/ diff --git a/debian/patches/series b/debian/patches/series index 48af7f16..47ee24e3 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -183,3 +183,4 @@ resolv-Check-hostname-for-validity-CVE-2026-4438.patch # Fix CVE-2026-4046 iconvdata-Use-pending-character-state-in-IBM1390-IBM1399-character-sets-CVE-2026-4046.patch +CVE-2026-5928.patch From a2eaff1984b3017793cd16f7ee4e33b967244fde Mon Sep 17 00:00:00 2001 From: deepin-ci-robot Date: Tue, 21 Jul 2026 01:09:49 +0800 Subject: [PATCH 2/2] fix(cve): CVE-2026-5450 - stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE: CVE-2026-5450 (critical) - 修复 scanf %mc 格式符中的缓冲区溢出漏洞（BZ #34008） Upstream: https://sourceware.org/git/glibc.git/commit/1a74f82eedaf0987eda1f522121e6a48fac502e7 Co-authored-by: hudeng Generated-By: qwen3.6-35b --- debian/changelog | 6 ++ debian/patches/CVE-2026-5450.patch | 115 +++++++++++++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 122 insertions(+) create mode 100644 debian/patches/CVE-2026-5450.patch diff --git a/debian/changelog b/debian/changelog index 319c03c9..cd163320 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +glibc (2.38-6deepin27) unstable; urgency=medium + + * fix(cve): CVE-2026-5450 + + -- deepin-ci-robot Tue, 21 Jul 2026 01:09:49 +0800 + glibc (2.38-6deepin26) unstable; urgency=medium * fix(cve): CVE-2026-5928 diff --git a/debian/patches/CVE-2026-5450.patch b/debian/patches/CVE-2026-5450.patch new file mode 100644 index 00000000..be430fda --- /dev/null +++ b/debian/patches/CVE-2026-5450.patch @@ -0,0 +1,115 @@ +Description: CVE-2026-5450 - 安全修复 +Author: Rocket Ma +Origin: https://sourceware.org/git/glibc.git/commit/1a74f82eedaf0987eda1f522121e6a48fac502e7 +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-5450 +Last-Update: 2026-04-17 +--- + +diff --git a/stdio-common/Makefile b/stdio-common/Makefile +index 049d6722..2e925a18 100644 +--- a/stdio-common/Makefile ++++ b/stdio-common/Makefile +@@ -263,6 +263,7 @@ tests := \ + tst-vfprintf-width-i18n \ + tst-vfprintf-width-prec \ + tst-vfprintf-width-prec-alloc \ ++ tst-vfscanf-bz34008 \ + tst-wc-printf \ + tstdiomisc \ + tstgetln \ +@@ -395,6 +396,9 @@ tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \ + tst-vfprintf-width-prec-ENV = \ + MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \ + LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so ++tst-vfscanf-bz34008-ENV = \ ++ MALLOC_CHECK_=3 \ ++ LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so + tst-printf-bz25691-ENV = \ + MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \ + LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so +diff --git a/stdio-common/tst-vfscanf-bz34008.c b/stdio-common/tst-vfscanf-bz34008.c +new file mode 100644 +index 00000000..48371c8a +--- /dev/null ++++ b/stdio-common/tst-vfscanf-bz34008.c +@@ -0,0 +1,48 @@ ++/* Regression test for vfscanf %Nmc out-of-bound write (BZ #34008) ++ Copyright (C) 2026 The GNU Toolchain Authors. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include "malloc/mcheck.h" ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define WIDTH 0x410 ++#define SCANFSTR "%1040mc" ++static int ++do_test (void) ++{ ++ mcheck_pedantic (NULL); ++ char *input = malloc (WIDTH + 1); ++ TEST_VERIFY (input != NULL); ++ memset (input, 'A', WIDTH); ++ input[WIDTH] = '\0'; ++ ++ char *buf = NULL; ++ TEST_VERIFY (sscanf (input, SCANFSTR, &buf) != -1); ++ TEST_VERIFY (buf != NULL); ++ ++ free (buf); ++ free (input); ++ return 0; ++} ++ ++#include +diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c +index 9b1197d7..5aff1c4f 100644 +--- a/stdio-common/vfscanf-internal.c ++++ b/stdio-common/vfscanf-internal.c +@@ -805,8 +805,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + { + /* Enlarge the buffer. */ + size_t newsize +- = strsize +- + (strsize >= width ? width - 1 : strsize); ++ = strsize + (strsize >= width ? width : strsize); + + str = (char *) realloc (*strptr, newsize); + if (str == NULL) +@@ -877,7 +876,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + && wstr == (wchar_t *) *strptr + strsize) + { + size_t newsize +- = strsize + (strsize > width ? width - 1 : strsize); ++ = strsize + (strsize >= width ? width : strsize); + /* Enlarge the buffer. */ + wstr = (wchar_t *) realloc (*strptr, + newsize * sizeof (wchar_t)); +@@ -932,7 +931,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + && wstr == (wchar_t *) *strptr + strsize) + { + size_t newsize +- = strsize + (strsize > width ? width - 1 : strsize); ++ = strsize + (strsize >= width ? width : strsize); + /* Enlarge the buffer. */ + wstr = (wchar_t *) realloc (*strptr, + newsize * sizeof (wchar_t)); diff --git a/debian/patches/series b/debian/patches/series index 47ee24e3..ebc38d91 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -184,3 +184,4 @@ resolv-Check-hostname-for-validity-CVE-2026-4438.patch # Fix CVE-2026-4046 iconvdata-Use-pending-character-state-in-IBM1390-IBM1399-character-sets-CVE-2026-4046.patch CVE-2026-5928.patch +CVE-2026-5450.patch