From ddf78734c2f2afca8b3743d0c01e9115b7f49ba7 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Wed, 16 Sep 2026 11:57:44 +0800 Subject: [PATCH] Fix CVE-2026-85234: out-of-bounds read/write in the in.tftpd remap engine --- tftp-5.2-CVE-2026-85234.patch | 68 +++++++++++++++++++++++++++++++++++ tftp.spec | 8 ++++- 2 files changed, 75 insertions(+), 1 deletion(-) create mode 100644 tftp-5.2-CVE-2026-85234.patch diff --git a/tftp-5.2-CVE-2026-85234.patch b/tftp-5.2-CVE-2026-85234.patch new file mode 100644 index 0000000..3a25092 --- /dev/null +++ b/tftp-5.2-CVE-2026-85234.patch @@ -0,0 +1,68 @@ +From 4b493532f5ce052a1c124acd0661233ec7918327 Mon Sep 17 00:00:00 2001 +From: H. Peter Anvin +Date: Tue, 11 Nov 2025 18:16:18 -0800 +Subject: [PATCH] remap: fix out-of-bounds access in genmatchstring() + +Backport of the security-relevant part of upstream commit +4b493532f5ce052a1c124acd0661233ec7918327 ("remap: add label/jump +support, tidy up the code and documentation"). + +genmatchstring() derived the prefix/suffix lengths directly from the +pmatch array. An inverted remap rule ("~") that aborts ("a") with a +non-empty custom error message reaches it with the pmatch array cleared +out to -1 (rewrite_string()), so pmatch[0].rm_so == -1 was handed to +memcpy() as a size -- an out-of-bounds read/write (CVE-2026-85234). + +Handle the "no match" case the same way the upstream MATCHONLY case is +handled: expand the pattern on its own, and never use the negative +offsets as sizes or indices. + +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) +--- + tftpd/remap.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/tftpd/remap.c b/tftpd/remap.c +index 1e7abe7..9a67684 100644 +--- a/tftpd/remap.c ++++ b/tftpd/remap.c +@@ -66,12 +66,23 @@ static int genmatchstring(char *string, const char *pattern, + int n, mlen, sublen; + int endbytes; + +- /* Get section before match; note pmatch[0] is the whole match */ +- endbytes = strlen(input) - pmatch[0].rm_eo; +- len = pmatch[0].rm_so + endbytes; +- if (string) { +- memcpy(string, input, pmatch[0].rm_so); +- string += pmatch[0].rm_so; ++ /* ++ * If there is no match -- in particular when an inverted rule has ++ * cleared out the pmatch array -- the pattern is expanded on its ++ * own. The negative offsets must never be used as sizes or ++ * indices, or we end up with an out-of-bounds read/write. ++ */ ++ if (pmatch[0].rm_so == -1) { ++ endbytes = 0; ++ len = 0; ++ } else { ++ /* Get section before match; note pmatch[0] is the whole match */ ++ endbytes = strlen(input) - pmatch[0].rm_eo; ++ len = pmatch[0].rm_so + endbytes; ++ if (string) { ++ memcpy(string, input, pmatch[0].rm_so); ++ string += pmatch[0].rm_so; ++ } + } + + /* Transform matched section */ +@@ -142,7 +153,8 @@ static int genmatchstring(char *string, const char *pattern, + + /* Copy section after match */ + if (string) { +- memcpy(string, input + pmatch[0].rm_eo, endbytes); ++ if (endbytes) ++ memcpy(string, input + pmatch[0].rm_eo, endbytes); + string[endbytes] = '\0'; + } + diff --git a/tftp.spec b/tftp.spec index b79be1c..ee7cc76 100644 --- a/tftp.spec +++ b/tftp.spec @@ -1,13 +1,15 @@ Summary: The client for the Trivial File Transfer Protocol (TFTP) Name: tftp Version: 5.2 -Release: 6%{?dist} +Release: 7%{?dist} License: BSD URL: http://www.kernel.org/pub/software/network/tftp/ Source0: http://www.kernel.org/pub/software/network/tftp/tftp-hpa/tftp-hpa-%{version}.tar.bz2 Source1: tftp.socket Source2: tftp.service +Patch0001: tftp-5.2-CVE-2026-85234.patch + Patch3000: tftp-0.40-remap.patch Patch3001: tftp-hpa-0.39-tzfix.patch Patch3002: tftp-0.42-tftpboot.patch @@ -85,6 +87,10 @@ install -p -m 644 %SOURCE2 ${RPM_BUILD_ROOT}%{_unitdir} %{_mandir}/man8/* %changelog +* Wed Sep 16 2026 PkgAgent Robot - 5.2-7 +- [Type] security +- [DESC] Fix CVE-2026-85234: out-of-bounds read/write in the in.tftpd remap engine + * Thu Sep 26 2024 OpenCloudOS Release Engineering - 5.2-6 - Rebuilt for clarifying the packages requirement in BaseOS and AppStream -- Gitee