d/patches: Add post-release patch to fix offset validation

This is an out-of-bounds read when downloading from a malicious/crafted
ostree repository, but is not believed to be practically exploitable
for anything worse than a crash (denial-of-service).

diff --git a/debian/patches/series b/debian/patches/series
index 78a4e0547fbb9feebe11efa44337bcd1ba1df821..af70199f5165a139e87d7a2b67f95e08fcda80c1 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
 debian/Skip-test-pull-repeated-during-CI.patch
 debian/test-sysroot-Skip-on-s390x-by-default.patch
 debian/Skip-test-admin-deploy-uboot.sh-on-s390x.patch
+static-delta-validate-bspatch-payload-offset-and-length.patch

diff --git a/debian/patches/static-delta-validate-bspatch-payload-offset-and-length.patch b/debian/patches/static-delta-validate-bspatch-payload-offset-and-length.patch
new file mode 100644 (file)
index 0000000..136cd78
--- /dev/null
+++ b/debian/patches/static-delta-validate-bspatch-payload-offset-and-length.patch
@@ -0,0 +1,23 @@
+From: Zibran Khan <kali834x@gmail.com>
+Date: Wed, 19 Aug 2026 19:33:11 +0530
+Subject: static-delta: validate bspatch payload offset and length
+
+Origin: https://github.com/ostreedev/ostree/pull/3647
+Applied-upstream: 2026.5, commit:84ca25e8a09da15fb96b81e87a5778b6db7dd05f
+---
+ src/libostree/ostree-repo-static-delta-processing.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/libostree/ostree-repo-static-delta-processing.c b/src/libostree/ostree-repo-static-delta-processing.c
+index 5fcec2d..99a87c6 100644
+--- a/src/libostree/ostree-repo-static-delta-processing.c
++++ b/src/libostree/ostree-repo-static-delta-processing.c
+@@ -403,6 +403,8 @@ dispatch_bspatch (OstreeRepo *repo, StaticDeltaExecutionState *state, GCancellab
+     return FALSE;
+   if (!read_varuint64 (state, &length, error))
+     return FALSE;
++  if (!validate_ofs (state, offset, length, error))
++    return FALSE;
+ 
+   if (state->stats_only)
+     return TRUE; /* Early return */