Compare commits

...

No commits in common. "c8" and "c8-beta" have entirely different histories.
c8 ... c8-beta

2 changed files with 2 additions and 21 deletions

View File

@ -1,14 +0,0 @@
diff --git a/src/parser_lyb.c b/src/parser_lyb.c
index 252bf77..e5bc860 100644
--- a/src/parser_lyb.c
+++ b/src/parser_lyb.c
@@ -160,6 +160,9 @@ lyb_read_string(const char *data, char **str, int with_length, struct lyb_state
}
}
+ LY_CHECK_ERR_RETURN(len + 1 == 0,
+ LOGERR(lybs->ctx, LY_EINVAL, "LYB value size overflow."), LY_EINVAL);
+
*str = malloc((len + 1) * sizeof **str);
LY_CHECK_ERR_RETURN(!*str, LOGMEM(lybs->ctx), -1);

View File

@ -8,7 +8,7 @@
Name: libyang
Version: 1.0.184
Release: 2%{?dist}
Release: 1%{?dist}
Summary: YANG data modeling language library
Url: https://github.com/CESNET/libyang
Source: %{url}/archive/libyang-%{version}.tar.gz
@ -28,8 +28,6 @@ BuildRequires: flex
BuildRequires: bison
BuildRequires: graphviz
Patch1: libyang-fix-CVE-2026-44673.patch
%package devel
Summary: Development files for libyang
Requires: %{name}%{?_isa} = %{version}-%{release}
@ -80,6 +78,7 @@ mkdir build
%build
cd build
%cmake \
%{?_smp_mflags} \
-DCMAKE_INSTALL_PREFIX:PATH=/usr \
-DCMAKE_BUILD_TYPE:String="Package" \
-DENABLE_LYD_PRIV=ON \
@ -134,10 +133,6 @@ cp -r doc/html %{buildroot}/%{_docdir}/libyang/html
%{python3_sitearch}/__pycache__/yang*
%changelog
* Tue Jun 02 2026 Michal Ruprich <mruprich@redhat.com> - 1.0.184-2
- DoS or arbitrary code execution via maliciously crafted LYB binary blob
- Resolves: RHEL-177017 - CVE-2026-44673
* Thu Jan 07 2021 Michal Ruprich <mruprich@redhat.com> - 1.0.184-1
- Resolves: #1910046 - [RFE] Rebase libyang to 1.0.184