Skip to content

[AutoPR- Security] Patch popt for CVE-2026-18743 [LOW] #18734

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Azure Linux Security Servicing Account (azurelinux-security) wants to merge 1 commit into
base: 3.0-dev
Choose a base branch
from
Draft

[AutoPR- Security] Patch popt for CVE-2026-18743 [LOW] #18734

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
98 changes: 98 additions & 0 deletions SPECS/popt/CVE-2026-18743.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
From 69cf83407fe4851284ad7b3d6f1778ba64fe0858 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Tue, 11 Aug 2026 11:45:44 +0300
Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in
poptConfigFileToString()

Fix the reallocation logic thinko, repeated twice in the function:
if we need to reallocate, the current maximum value is not interesting
in any way. Just allocate double the required size instead.

The reproducer test is obviously closely tied to the initial buffer
size of 480 and wouldn't work with other sizes, but with the current
default this reliably crashes popt under ASAN prior to this fix.
Also , the reproducer only exercises the first of these flaws.

Fixes: CVE-2026-18743
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: https://github.com/rpm-software-management/popt/commit/ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe.patch
---
src/poptparse.c | 10 ++++------
tests/test3-data/05.answer | 5 +++++
tests/test3-data/05.input | 2 ++
tests/testit.sh | 1 +
4 files changed, 12 insertions(+), 6 deletions(-)
create mode 100644 tests/test3-data/05.answer
create mode 100644 tests/test3-data/05.input

diff --git a/src/poptparse.c b/src/poptparse.c
index 5afc6c5..3966b87 100644
--- a/src/poptparse.c
+++ b/src/poptparse.c
@@ -139,7 +139,6 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
char * p;
char * q;
char * x;
- size_t t;
size_t argvlen = 0;
size_t maxlinelen = sizeof(line);
size_t linelen;
@@ -186,9 +185,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
if (*q == '\0') {
/* single command line option (ie, no name=val, just name) */
q[-1] = '\0'; /* kill off newline from fgets() call */
- argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1);
+ argvlen += ((size_t)(q - p)) + (sizeof(" --")-1);
if (argvlen >= maxargvlen) {
- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2;
+ maxargvlen = argvlen * 2;
argstr_tmp = realloc(argstr, maxargvlen);
if (argstr_tmp == NULL) {
free(argstr);
@@ -218,10 +217,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
*x = '\0'; /* null out last char if space (including fgets() NL) */

/* rest of line accept */
- t = (size_t)(x - p);
- argvlen += t + (sizeof("' --='")-1);
+ argvlen += ((size_t)(x - p) + sizeof("' --='")-1);
if (argvlen >= maxargvlen) {
- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2;
+ maxargvlen = argvlen * 2;
argstr_tmp = realloc(argstr, maxargvlen);
if (argstr_tmp == NULL) {
free(argstr);
diff --git a/tests/test3-data/05.answer b/tests/test3-data/05.answer
new file mode 100644
index 0000000..37b7fb8
--- /dev/null
+++ b/tests/test3-data/05.answer
@@ -0,0 +1,5 @@
+single string: ' --aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa --bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
+popt array: size=2
+'--aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+'--bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
+
diff --git a/tests/test3-data/05.input b/tests/test3-data/05.input
new file mode 100644
index 0000000..2508292
--- /dev/null
+++ b/tests/test3-data/05.input
@@ -0,0 +1,2 @@
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
diff --git a/tests/testit.sh b/tests/testit.sh
index 04713f5..5d7f1e0 100755
--- a/tests/testit.sh
+++ b/tests/testit.sh
@@ -179,6 +179,7 @@ fi
run_diff test3 "test3 - 1" test3-data/01.input test3-data/01.answer
run_diff test3 "test3 - 2" test3-data/02.input test3-data/02.answer
run_diff test3 "test3 - 3" test3-data/03.input test3-data/03.answer
+run_diff test3 "test3 - 5" test3-data/05.input test3-data/05.answer

echo ""
echo "Passed."
--
2.45.4

7 changes: 6 additions & 1 deletion SPECS/popt/popt.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,14 @@
Summary: Programs to parse command-line options
Name: popt
Version: 1.19
Release: 1%{?dist}
Release: 2%{?dist}
License: MIT
URL: https://github.com/rpm-software-management/popt
Group: Applications/System
Vendor: Microsoft Corporation
Distribution: Azure Linux
Source0: http://ftp.rpm.org/popt/releases/popt-1.x/%{name}-%{version}.tar.gz
Patch0: CVE-2026-18743.patch
%description
The popt package contains the popt libraries which are used by
some programs to parse command-line options.
Expand All @@ -28,6 +29,7 @@ These are the additional language files of popt.

%prep
%setup -q
%patch 0 -p1
%build
%configure \
--disable-silent-rules
Expand Down Expand Up @@ -59,6 +61,9 @@ make %{?_smp_mflags} check
%defattr(-,root,root)

%changelog
* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.19-2
- Patch for CVE-2026-18743

* Mon Oct 16 2023 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 1.19-1
- Auto-upgrade to 1.19 - Azure Linux 3.0 - package upgrades

Expand Down
6 changes: 3 additions & 3 deletions toolkit/resources/manifests/package/pkggen_core_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,9 +85,9 @@ libtool-2.4.7-2.azl3.aarch64.rpm
flex-2.6.4-7.azl3.aarch64.rpm
flex-devel-2.6.4-7.azl3.aarch64.rpm
bison-3.8.2-1.azl3.aarch64.rpm
popt-1.19-1.azl3.aarch64.rpm
popt-devel-1.19-1.azl3.aarch64.rpm
popt-lang-1.19-1.azl3.aarch64.rpm
popt-1.19-2.azl3.aarch64.rpm
popt-devel-1.19-2.azl3.aarch64.rpm
popt-lang-1.19-2.azl3.aarch64.rpm
sqlite-3.44.0-4.azl3.aarch64.rpm
sqlite-devel-3.44.0-4.azl3.aarch64.rpm
sqlite-libs-3.44.0-4.azl3.aarch64.rpm
Expand Down
6 changes: 3 additions & 3 deletions toolkit/resources/manifests/package/pkggen_core_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,9 +85,9 @@ libtool-2.4.7-2.azl3.x86_64.rpm
flex-2.6.4-7.azl3.x86_64.rpm
flex-devel-2.6.4-7.azl3.x86_64.rpm
bison-3.8.2-1.azl3.x86_64.rpm
popt-1.19-1.azl3.x86_64.rpm
popt-devel-1.19-1.azl3.x86_64.rpm
popt-lang-1.19-1.azl3.x86_64.rpm
popt-1.19-2.azl3.x86_64.rpm
popt-devel-1.19-2.azl3.x86_64.rpm
popt-lang-1.19-2.azl3.x86_64.rpm
sqlite-3.44.0-4.azl3.x86_64.rpm
sqlite-devel-3.44.0-4.azl3.x86_64.rpm
sqlite-libs-3.44.0-4.azl3.x86_64.rpm
Expand Down
8 changes: 4 additions & 4 deletions toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,10 +519,10 @@ pkgconf-2.0.2-1.azl3.aarch64.rpm
pkgconf-debuginfo-2.0.2-1.azl3.aarch64.rpm
pkgconf-m4-2.0.2-1.azl3.noarch.rpm
pkgconf-pkg-config-2.0.2-1.azl3.aarch64.rpm
popt-1.19-1.azl3.aarch64.rpm
popt-debuginfo-1.19-1.azl3.aarch64.rpm
popt-devel-1.19-1.azl3.aarch64.rpm
popt-lang-1.19-1.azl3.aarch64.rpm
popt-1.19-2.azl3.aarch64.rpm
popt-debuginfo-1.19-2.azl3.aarch64.rpm
popt-devel-1.19-2.azl3.aarch64.rpm
popt-lang-1.19-2.azl3.aarch64.rpm
procps-ng-4.0.4-1.azl3.aarch64.rpm
procps-ng-debuginfo-4.0.4-1.azl3.aarch64.rpm
procps-ng-devel-4.0.4-1.azl3.aarch64.rpm
Expand Down
8 changes: 4 additions & 4 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -527,10 +527,10 @@ pkgconf-2.0.2-1.azl3.x86_64.rpm
pkgconf-debuginfo-2.0.2-1.azl3.x86_64.rpm
pkgconf-m4-2.0.2-1.azl3.noarch.rpm
pkgconf-pkg-config-2.0.2-1.azl3.x86_64.rpm
popt-1.19-1.azl3.x86_64.rpm
popt-debuginfo-1.19-1.azl3.x86_64.rpm
popt-devel-1.19-1.azl3.x86_64.rpm
popt-lang-1.19-1.azl3.x86_64.rpm
popt-1.19-2.azl3.x86_64.rpm
popt-debuginfo-1.19-2.azl3.x86_64.rpm
popt-devel-1.19-2.azl3.x86_64.rpm
popt-lang-1.19-2.azl3.x86_64.rpm
procps-ng-4.0.4-1.azl3.x86_64.rpm
procps-ng-debuginfo-4.0.4-1.azl3.x86_64.rpm
procps-ng-devel-4.0.4-1.azl3.x86_64.rpm
Expand Down
Loading