diff --git a/wget-1.24.5-CVE-2026-58472.patch b/wget-1.24.5-CVE-2026-58472.patch new file mode 100644 index 0000000..266c265 --- /dev/null +++ b/wget-1.24.5-CVE-2026-58472.patch @@ -0,0 +1,296 @@ +From d443dde7967d5ac799f4c1b39d119da7b99e7115 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Mon, 29 Jun 2026 19:13:15 +0200 +Subject: [PATCH 1/2] * src/convert.c (html_quote_string): Fix integer+buffer + overflow + +Reported-by: TristanInSec@gmail.com +--- + src/convert.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +diff --git a/src/convert.c b/src/convert.c +index 2e5bc22..d1cbab8 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -36,6 +36,7 @@ as that of the covered work. */ + #include + #include + #include ++#include + #include "convert.h" + #include "url.h" + #include "recur.h" +@@ -1178,21 +1179,37 @@ html_quote_string (const char *s) + { + const char *b = s; + char *p, *res; +- int i; ++ size_t i; ++ int ok; + + /* Pass through the string, and count the new size. */ +- for (i = 0; *s; s++, i++) ++ for (i = 0; *s; s++) + { + if (*s == '&') +- i += 4; /* `amp;' */ ++ ok = INT_ADD_OK (i, 4, &i); /* `amp;' */ + else if (*s == '<' || *s == '>') +- i += 3; /* `lt;' and `gt;' */ ++ ok = INT_ADD_OK (i, 3, &i); /* `lt;' and `gt;' */ + else if (*s == '\"') +- i += 5; /* `quot;' */ ++ ok = INT_ADD_OK (i, 5, &i); /* `quot;' */ + else if (*s == ' ') +- i += 4; /* #32; */ ++ ok = INT_ADD_OK (i, 4, &i); /* #32; */ ++ else ++ ok = INT_ADD_OK (i, 1, &i); ++ ++ if (!ok) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } + } +- res = xmalloc (i + 1); ++ ++ if (!INT_ADD_OK (i, 1, &i)) ++ { ++ DEBUGP (("Overflow detected in html_quote_string().\n")); ++ abort(); ++ } ++ ++ res = xmalloc (i); + s = b; + for (p = res; *s; s++) + { + +From f43a702e3baa3776d06a3fffea2ef95a7fd7d943 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim=20R=C3=BChsen?= +Date: Thu, 2 Jul 2026 13:13:07 +0200 +Subject: [PATCH 2/2] Regression: Fix buffer overflow in html_quote_string() + +The regression has been introduced in commit dd692d9 and +is not part of any release. + +The tests allow the address sanitizer to find the issue. + +* src/convert.c: Fix string size calculation. +* tests/unit-tests.c: Added tests including tests for html_quote_string(). +* tests/unit-tests.h: Add definitions for the test functions. + +Reported-by: Trung Nguyen +--- + src/convert.c | 148 +++++++++++++++++++++++++++++++++++++++++++-- + tests/unit-tests.c | 4 ++ + tests/unit-tests.h | 4 ++ + 3 files changed, 152 insertions(+), 4 deletions(-) + +diff --git a/src/convert.c b/src/convert.c +index d1cbab8..386bded 100644 +--- a/src/convert.c ++++ b/src/convert.c +@@ -48,6 +48,9 @@ as that of the covered work. */ + #include "css-url.h" + #include "iri.h" + #include "xstrndup.h" ++#ifdef TESTING ++#include "../tests/unit-tests.h" ++#endif + + static struct hash_table *dl_file_url_map; + struct hash_table *dl_url_file_map; +@@ -1186,13 +1189,13 @@ html_quote_string (const char *s) + for (i = 0; *s; s++) + { + if (*s == '&') +- ok = INT_ADD_OK (i, 4, &i); /* `amp;' */ ++ ok = INT_ADD_OK (i, 4 + 1, &i); /* `amp;' */ + else if (*s == '<' || *s == '>') +- ok = INT_ADD_OK (i, 3, &i); /* `lt;' and `gt;' */ ++ ok = INT_ADD_OK (i, 3 + 1, &i); /* `lt;' and `gt;' */ + else if (*s == '\"') +- ok = INT_ADD_OK (i, 5, &i); /* `quot;' */ ++ ok = INT_ADD_OK (i, 5 + 1, &i); /* `quot;' */ + else if (*s == ' ') +- ok = INT_ADD_OK (i, 4, &i); /* #32; */ ++ ok = INT_ADD_OK (i, 4 + 1, &i); /* #32; */ + else + ok = INT_ADD_OK (i, 1, &i); + +@@ -1251,6 +1254,143 @@ html_quote_string (const char *s) + return res; + } + ++#ifdef TESTING ++ ++const char * ++test_construct_relative (void) ++{ ++ static const struct { ++ const char *basefile; ++ const char *linkfile; ++ const char *expected; ++ } test_array[] = { ++ { "foo", "bar", "bar" }, ++ { "A/foo", "A/bar", "bar" }, ++ { "A/foo", "A/B/bar", "B/bar" }, ++ { "A/X/foo", "A/Y/bar", "../Y/bar" }, ++ { "X/", "Y/bar", "../Y/bar" }, ++ { "/foo", "/bar", "bar" }, ++ { "/a/b/c", "/a/b/d", "d" }, ++ { "/a/b/c", "/a/b/c/d", "c/d" }, ++ { "/a/b/c", "/a/b/c/d/e", "c/d/e" }, ++ { "/a/b/c", "/x/y/z", "../../x/y/z" }, ++ { "a/b", "c/d", "../c/d" }, ++ { "./foo", "./bar", "bar" }, ++ }; ++ ++ for (unsigned i = 0; i < countof (test_array); ++i) ++ { ++ char *result = construct_relative (test_array[i].basefile, ++ test_array[i].linkfile); ++ mu_assert ("test_construct_relative: wrong result", ++ strcmp (result, test_array[i].expected) == 0); ++ xfree (result); ++ } ++ ++ return NULL; ++} ++ ++const char * ++test_match_except_index (void) ++{ ++ static const struct { ++ const char *s1; ++ const char *s2; ++ bool expected; ++ } test_array[] = { ++ { "foo/index.html", "foo/", true }, ++ { "foo/", "foo/index.html", true }, ++ { "foo", "foo/index.html", true }, ++ { "foo", "foo/", true }, ++ { "foo", "foo", true }, ++ { "/foo/index.html", "/foo/", true }, ++ { "/foo/", "/foo/index.html", true }, ++ { "/foo", "/foo/index.html", true }, ++ { "/foo", "/foo/", true }, ++ { "foo/bar", "foo/qux", false }, ++ { "foo/bar", "bar/foo", false }, ++ }; ++ ++ for (unsigned i = 0; i < countof (test_array); ++i) ++ { ++ bool result = match_except_index (test_array[i].s1, test_array[i].s2); ++ mu_assert ("test_match_except_index: wrong result", ++ result == test_array[i].expected); ++ } ++ ++ return NULL; ++} ++ ++const char * ++test_find_fragment (void) ++{ ++ static const struct { ++ const char *input; ++ int size; ++ bool has_fragment; ++ const char *fragment; ++ } test_array[] = { ++ { "http://example.com#section", 26, true, "#section" }, ++ { "http://example.com", 18, false, NULL }, ++ { "http://example.com?a=1#frag", 24, true, "#frag" }, ++ { "http://example.com?a=1%26#frag", 28, true, "#frag" }, ++ { "http://example.com?a=1&b=2#frag", 30, true, "#frag" }, ++ { "a#b", 3, true, "#b" }, ++ { "a", 1, false, NULL }, ++ }; ++ const char *bp, *ep; ++ ++ for (unsigned i = 0; i < countof (test_array); ++i) ++ { ++ bool result = find_fragment (test_array[i].input, ++ test_array[i].size, &bp, &ep); ++ mu_assert ("test_find_fragment: wrong result", ++ result == test_array[i].has_fragment); ++ if (test_array[i].has_fragment) ++ { ++ mu_assert ("test_find_fragment: wrong fragment", bp != NULL); ++ mu_assert ("test_find_fragment: fragment mismatch", ++ strncmp (bp, test_array[i].fragment, ++ strlen (test_array[i].fragment)) == 0 && ++ ep == test_array[i].input + test_array[i].size); ++ } ++ } ++ ++ return NULL; ++} ++ ++const char * ++test_html_quote_string (void) ++{ ++ static const struct { ++ const char *input; ++ const char *expected; ++ } test_array[] = { ++ { "hello", "hello" }, ++ { "a&b", "a&b" }, ++ { "", "<tag>" }, ++ { "\"quote\"", ""quote"" }, ++ { "space here", "space here" }, ++ { "&<>\" ", "&<>" " }, ++ { "no special", "no special" }, ++ { "&&&&", "&&&&" }, ++ { "<<>>", "<<>>" }, ++ { "" , "" }, ++ }; ++ ++ for (unsigned i = 0; i < countof (test_array); ++i) ++ { ++ char *result = html_quote_string (test_array[i].input); ++ mu_assert ("test_html_quote_string: wrong result", ++ strcmp (result, test_array[i].expected) == 0); ++ xfree (result); ++ } ++ ++ return NULL; ++} ++ ++#endif /* TESTING */ ++ + /* + * vim: et ts=2 sw=2 + */ +diff --git a/tests/unit-tests.c b/tests/unit-tests.c +index 28b9328..63b83ba 100644 +--- a/tests/unit-tests.c ++++ b/tests/unit-tests.c +@@ -68,6 +68,10 @@ all_tests(void) + #endif + mu_run_test (test_parse_netrc); + mu_run_test (test_retr_rate); ++ mu_run_test (test_construct_relative); ++ mu_run_test (test_match_except_index); ++ mu_run_test (test_find_fragment); ++ mu_run_test (test_html_quote_string); + + return NULL; + } +diff --git a/tests/unit-tests.h b/tests/unit-tests.h +index 44635f0..8cd9309 100644 +--- a/tests/unit-tests.h ++++ b/tests/unit-tests.h +@@ -64,6 +64,10 @@ const char *test_hsts_url_rewrite_congruent(void); + const char *test_hsts_read_database(void); + const char *test_parse_netrc(void); + const char *test_retr_rate(void); ++const char *test_construct_relative(void); ++const char *test_match_except_index(void); ++const char *test_find_fragment(void); ++const char *test_html_quote_string(void); + + #endif /* TEST_H */ + diff --git a/wget.spec b/wget.spec index 4b30087..c0f9f0e 100644 --- a/wget.spec +++ b/wget.spec @@ -1,7 +1,7 @@ Summary: A utility for retrieving files using the HTTP or FTP protocols Name: wget Version: 1.24.5 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-3.0-or-later AND LGPL-2.1-or-later AND GFDL-1.3-or-later Url: http://www.gnu.org/software/wget/ Source: ftp://ftp.gnu.org/gnu/wget/wget-%{version}.tar.gz @@ -10,6 +10,9 @@ Patch1: wget-1.17-path.patch Patch3: wget-1.21-metalink-man.patch Patch5: wget-1.21-CVE-2024-38428.patch Patch6: wget-1.24.5-no-nettle.patch +# https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812 +# https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2 +Patch7: wget-1.24.5-CVE-2026-58472.patch Provides: webclient Provides: bundled(gnulib) @@ -83,6 +86,10 @@ make check %{_infodir}/* %changelog +* Wed Jul 15 2026 RHEL Packaging Agent - 1.24.5-6 +- Fix integer and buffer overflow in html_quote_string() + Resolves: RHEL-210625 + * Wed Dec 11 2024 Daiki Ueno - 1.24.5-5 - Revert back to using GnuTLS as the TLS backend - Use bundled implementation of MD4 for NTLM