From: Simon McVittie Date: Thu, 20 Aug 2026 18:02:07 +0000 (+0100) Subject: d/patches: Add post-release patch to fix offset validation X-Git-Tag: archive/raspbian/2026.4-1+rpi1^2~7 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=e8b46b73b501921e6e74ca82910abf7a6f076b7e;p=ostree.git d/patches: Add post-release patch to fix offset validation This is an out-of-bounds read when downloading from a malicious/crafted ostree repository, but is not believed to be practically exploitable for anything worse than a crash (denial-of-service). --- diff --git a/debian/patches/series b/debian/patches/series index 78a4e054..af70199f 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1,4 @@ debian/Skip-test-pull-repeated-during-CI.patch debian/test-sysroot-Skip-on-s390x-by-default.patch debian/Skip-test-admin-deploy-uboot.sh-on-s390x.patch +static-delta-validate-bspatch-payload-offset-and-length.patch diff --git a/debian/patches/static-delta-validate-bspatch-payload-offset-and-length.patch b/debian/patches/static-delta-validate-bspatch-payload-offset-and-length.patch new file mode 100644 index 00000000..136cd782 --- /dev/null +++ b/debian/patches/static-delta-validate-bspatch-payload-offset-and-length.patch @@ -0,0 +1,23 @@ +From: Zibran Khan +Date: Wed, 19 Aug 2026 19:33:11 +0530 +Subject: static-delta: validate bspatch payload offset and length + +Origin: https://github.com/ostreedev/ostree/pull/3647 +Applied-upstream: 2026.5, commit:84ca25e8a09da15fb96b81e87a5778b6db7dd05f +--- + src/libostree/ostree-repo-static-delta-processing.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/libostree/ostree-repo-static-delta-processing.c b/src/libostree/ostree-repo-static-delta-processing.c +index 5fcec2d..99a87c6 100644 +--- a/src/libostree/ostree-repo-static-delta-processing.c ++++ b/src/libostree/ostree-repo-static-delta-processing.c +@@ -403,6 +403,8 @@ dispatch_bspatch (OstreeRepo *repo, StaticDeltaExecutionState *state, GCancellab + return FALSE; + if (!read_varuint64 (state, &length, error)) + return FALSE; ++ if (!validate_ofs (state, offset, length, error)) ++ return FALSE; + + if (state->stats_only) + return TRUE; /* Early return */