From 1aab8da63b8cd55fa88bda5dad08e5e157ae82f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= <lzaoral@redhat.com>
Date: Wed, 29 Jul 2026 16:34:28 +0200
Subject: [PATCH] uniq: fix CVE-2026-56391

Resolves: RHEL-216790
---
 coreutils-CVE-2026-56391.patch | 47 ++++++++++++++++++++++++++++++++++
 coreutils.spec                 | 10 +++++++-
 2 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 coreutils-CVE-2026-56391.patch

diff --git a/coreutils-CVE-2026-56391.patch b/coreutils-CVE-2026-56391.patch
new file mode 100644
index 0000000..f9cde68
--- /dev/null
+++ b/coreutils-CVE-2026-56391.patch
@@ -0,0 +1,47 @@
+From d64e35a8a4c0e4608321433e0d84d917e4e36371 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 28 Apr 2026 11:25:00 -0700
+Subject: [PATCH] uniq: fix read overrun with -w
+
+Problem reported by Michał Majchrowicz.
+* src/uniq.c (find_field): Fix typo.
+* tests/uniq/uniq.pl (add_z_variants): Test for the bug.
+
+(cherry picked from commit d64e35a8a4c0e4608321433e0d84d917e4e36371)
+---
+ src/uniq.c         | 4 ++--
+ tests/uniq/uniq.pl | 3 +++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/uniq.c b/src/uniq.c
+index abaf9e0..d46002b 100644
+--- a/src/uniq.c
++++ b/src/uniq.c
+@@ -267,8 +267,8 @@ find_field (struct linebuffer const *line, idx_t *plen)
+   else
+     {
+       char *ep = lp;
+-      for (idx_t i = check_chars; 0 < i && lp < lim; i--)
+-        ep += mcel_scan (lp, lim).len;
++      for (idx_t i = check_chars; 0 < i && ep < lim; i--)
++        ep += mcel_scan (ep, lim).len;
+       len = ep - lp;
+     }
+ 
+diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl
+index a61f264..eba919e 100755
+--- a/tests/uniq/uniq.pl
++++ b/tests/uniq/uniq.pl
+@@ -234,6 +234,9 @@ my @Tests =
+         "  - 'separate'\n" .
+         "  - 'both'\n" .
+         "Try '$prog --help' for more information.\n"}],
++ # Test for read buffer overrun.
++ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n";
++      ['146', '-w256', {IN  => $longline x 2}, {OUT => $longline}] },
+ );
+ 
+ # Locale related tests
+-- 
+2.55.0
+
diff --git a/coreutils.spec b/coreutils.spec
index e1c2497..99b7738 100644
--- a/coreutils.spec
+++ b/coreutils.spec
@@ -1,7 +1,7 @@
 Summary: A set of basic GNU tools commonly used in shell scripts
 Name:    coreutils
 Version: 9.5
-Release: 12%{?dist}
+Release: 13%{?dist}
 # some used parts of gnulib are under various variants of LGPL
 License: GPL-3.0-or-later AND GFDL-1.3-no-invariants-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later
 Url:     https://www.gnu.org/software/coreutils/
@@ -77,6 +77,10 @@ Patch108: coreutils-CVE-2025-5278.patch
 # upstream commit: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=955360a66c99bdd9ac3688519a8b521b06958fd3
 Patch109: coreutils-9.5-cp-acl-preserve-mode.patch
 
+# CVE-2026-56391 - uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input
+# https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371
+Patch110: coreutils-CVE-2026-56391.patch
+
 # (sb) lin18nux/lsb compliance - multibyte functionality patch
 Patch800: coreutils-i18n.patch
 
@@ -309,6 +313,10 @@ rm -f $RPM_BUILD_ROOT%{_infodir}/dir
 %license COPYING
 
 %changelog
+* Wed Jul 29 2026 Lukáš Zaoral <lzaoral@redhat.com> - 9.5-13
+- uniq: fix CVE-2026-56391 (RHEL-216790)
+  - fix buffer overrun in multibyte locales
+
 * Wed Jun 10 2026 Lukáš Zaoral <lzaoral@redhat.com> - 9.5-12
 - unexpand: fix heap overflow when a wide blank overshoots a tab stop (RHEL-152110)