diff --git a/SPECS/popt/CVE-2026-18743.patch b/SPECS/popt/CVE-2026-18743.patch new file mode 100644 index 00000000000..f4ca637be62 --- /dev/null +++ b/SPECS/popt/CVE-2026-18743.patch @@ -0,0 +1,98 @@ +From 69cf83407fe4851284ad7b3d6f1778ba64fe0858 Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Tue, 11 Aug 2026 11:45:44 +0300 +Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in + poptConfigFileToString() + +Fix the reallocation logic thinko, repeated twice in the function: +if we need to reallocate, the current maximum value is not interesting +in any way. Just allocate double the required size instead. + +The reproducer test is obviously closely tied to the initial buffer +size of 480 and wouldn't work with other sizes, but with the current +default this reliably crashes popt under ASAN prior to this fix. +Also , the reproducer only exercises the first of these flaws. + +Fixes: CVE-2026-18743 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/rpm-software-management/popt/commit/ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe.patch +--- + src/poptparse.c | 10 ++++------ + tests/test3-data/05.answer | 5 +++++ + tests/test3-data/05.input | 2 ++ + tests/testit.sh | 1 + + 4 files changed, 12 insertions(+), 6 deletions(-) + create mode 100644 tests/test3-data/05.answer + create mode 100644 tests/test3-data/05.input + +diff --git a/src/poptparse.c b/src/poptparse.c +index 5afc6c5..3966b87 100644 +--- a/src/poptparse.c ++++ b/src/poptparse.c +@@ -139,7 +139,6 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + char * p; + char * q; + char * x; +- size_t t; + size_t argvlen = 0; + size_t maxlinelen = sizeof(line); + size_t linelen; +@@ -186,9 +185,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + if (*q == '\0') { + /* single command line option (ie, no name=val, just name) */ + q[-1] = '\0'; /* kill off newline from fgets() call */ +- argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1); ++ argvlen += ((size_t)(q - p)) + (sizeof(" --")-1); + if (argvlen >= maxargvlen) { +- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; ++ maxargvlen = argvlen * 2; + argstr_tmp = realloc(argstr, maxargvlen); + if (argstr_tmp == NULL) { + free(argstr); +@@ -218,10 +217,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + *x = '\0'; /* null out last char if space (including fgets() NL) */ + + /* rest of line accept */ +- t = (size_t)(x - p); +- argvlen += t + (sizeof("' --='")-1); ++ argvlen += ((size_t)(x - p) + sizeof("' --='")-1); + if (argvlen >= maxargvlen) { +- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; ++ maxargvlen = argvlen * 2; + argstr_tmp = realloc(argstr, maxargvlen); + if (argstr_tmp == NULL) { + free(argstr); +diff --git a/tests/test3-data/05.answer b/tests/test3-data/05.answer +new file mode 100644 +index 0000000..37b7fb8 +--- /dev/null ++++ b/tests/test3-data/05.answer +@@ -0,0 +1,5 @@ ++single string: ' --aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa --bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' ++popt array: size=2 ++'--aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' ++'--bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' ++ +diff --git a/tests/test3-data/05.input b/tests/test3-data/05.input +new file mode 100644 +index 0000000..2508292 +--- /dev/null ++++ b/tests/test3-data/05.input +@@ -0,0 +1,2 @@ ++aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ++bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb +diff --git a/tests/testit.sh b/tests/testit.sh +index 04713f5..5d7f1e0 100755 +--- a/tests/testit.sh ++++ b/tests/testit.sh +@@ -179,6 +179,7 @@ fi + run_diff test3 "test3 - 1" test3-data/01.input test3-data/01.answer + run_diff test3 "test3 - 2" test3-data/02.input test3-data/02.answer + run_diff test3 "test3 - 3" test3-data/03.input test3-data/03.answer ++run_diff test3 "test3 - 5" test3-data/05.input test3-data/05.answer + + echo "" + echo "Passed." +-- +2.45.4 + diff --git a/SPECS/popt/popt.spec b/SPECS/popt/popt.spec index b512ab651ca..cef5f1f156f 100644 --- a/SPECS/popt/popt.spec +++ b/SPECS/popt/popt.spec @@ -1,13 +1,14 @@ Summary: Programs to parse command-line options Name: popt Version: 1.19 -Release: 1%{?dist} +Release: 2%{?dist} License: MIT URL: https://github.com/rpm-software-management/popt Group: Applications/System Vendor: Microsoft Corporation Distribution: Azure Linux Source0: http://ftp.rpm.org/popt/releases/popt-1.x/%{name}-%{version}.tar.gz +Patch0: CVE-2026-18743.patch %description The popt package contains the popt libraries which are used by some programs to parse command-line options. @@ -28,6 +29,7 @@ These are the additional language files of popt. %prep %setup -q +%patch 0 -p1 %build %configure \ --disable-silent-rules @@ -59,6 +61,9 @@ make %{?_smp_mflags} check %defattr(-,root,root) %changelog +* Mon Sep 07 2026 Azure Linux Security Servicing Account - 1.19-2 +- Patch for CVE-2026-18743 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 1.19-1 - Auto-upgrade to 1.19 - Azure Linux 3.0 - package upgrades diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index ab23fc49b10..a753d996328 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -85,9 +85,9 @@ libtool-2.4.7-2.azl3.aarch64.rpm flex-2.6.4-7.azl3.aarch64.rpm flex-devel-2.6.4-7.azl3.aarch64.rpm bison-3.8.2-1.azl3.aarch64.rpm -popt-1.19-1.azl3.aarch64.rpm -popt-devel-1.19-1.azl3.aarch64.rpm -popt-lang-1.19-1.azl3.aarch64.rpm +popt-1.19-2.azl3.aarch64.rpm +popt-devel-1.19-2.azl3.aarch64.rpm +popt-lang-1.19-2.azl3.aarch64.rpm sqlite-3.44.0-4.azl3.aarch64.rpm sqlite-devel-3.44.0-4.azl3.aarch64.rpm sqlite-libs-3.44.0-4.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 800d6b5d657..b684b50ffc2 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -85,9 +85,9 @@ libtool-2.4.7-2.azl3.x86_64.rpm flex-2.6.4-7.azl3.x86_64.rpm flex-devel-2.6.4-7.azl3.x86_64.rpm bison-3.8.2-1.azl3.x86_64.rpm -popt-1.19-1.azl3.x86_64.rpm -popt-devel-1.19-1.azl3.x86_64.rpm -popt-lang-1.19-1.azl3.x86_64.rpm +popt-1.19-2.azl3.x86_64.rpm +popt-devel-1.19-2.azl3.x86_64.rpm +popt-lang-1.19-2.azl3.x86_64.rpm sqlite-3.44.0-4.azl3.x86_64.rpm sqlite-devel-3.44.0-4.azl3.x86_64.rpm sqlite-libs-3.44.0-4.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 5c76040f5af..81b2560323c 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -519,10 +519,10 @@ pkgconf-2.0.2-1.azl3.aarch64.rpm pkgconf-debuginfo-2.0.2-1.azl3.aarch64.rpm pkgconf-m4-2.0.2-1.azl3.noarch.rpm pkgconf-pkg-config-2.0.2-1.azl3.aarch64.rpm -popt-1.19-1.azl3.aarch64.rpm -popt-debuginfo-1.19-1.azl3.aarch64.rpm -popt-devel-1.19-1.azl3.aarch64.rpm -popt-lang-1.19-1.azl3.aarch64.rpm +popt-1.19-2.azl3.aarch64.rpm +popt-debuginfo-1.19-2.azl3.aarch64.rpm +popt-devel-1.19-2.azl3.aarch64.rpm +popt-lang-1.19-2.azl3.aarch64.rpm procps-ng-4.0.4-1.azl3.aarch64.rpm procps-ng-debuginfo-4.0.4-1.azl3.aarch64.rpm procps-ng-devel-4.0.4-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index aa069acfd2e..0f4bfa7b733 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -527,10 +527,10 @@ pkgconf-2.0.2-1.azl3.x86_64.rpm pkgconf-debuginfo-2.0.2-1.azl3.x86_64.rpm pkgconf-m4-2.0.2-1.azl3.noarch.rpm pkgconf-pkg-config-2.0.2-1.azl3.x86_64.rpm -popt-1.19-1.azl3.x86_64.rpm -popt-debuginfo-1.19-1.azl3.x86_64.rpm -popt-devel-1.19-1.azl3.x86_64.rpm -popt-lang-1.19-1.azl3.x86_64.rpm +popt-1.19-2.azl3.x86_64.rpm +popt-debuginfo-1.19-2.azl3.x86_64.rpm +popt-devel-1.19-2.azl3.x86_64.rpm +popt-lang-1.19-2.azl3.x86_64.rpm procps-ng-4.0.4-1.azl3.x86_64.rpm procps-ng-debuginfo-4.0.4-1.azl3.x86_64.rpm procps-ng-devel-4.0.4-1.azl3.x86_64.rpm