From 3382fbdc5eb92b747079b45c5abf6afacd3cd3df Mon Sep 17 00:00:00 2001 From: Jakub Martisko Date: Fri, 21 Aug 2026 11:09:21 +0200 Subject: [PATCH] Fix: CVE-2026-34632 Resolves: RHEL-218106 --- CVE-2026-34743-test.patch | 63 +++++++++++++++++++++++++++++++++++++++ CVE-2026-34743.patch | 59 ++++++++++++++++++++++++++++++++++++ xz.spec | 14 ++++++++- 3 files changed, 135 insertions(+), 1 deletion(-) create mode 100644 CVE-2026-34743-test.patch create mode 100644 CVE-2026-34743.patch diff --git a/CVE-2026-34743-test.patch b/CVE-2026-34743-test.patch new file mode 100644 index 0000000..30b1655 --- /dev/null +++ b/CVE-2026-34743-test.patch @@ -0,0 +1,63 @@ +From a3ea8832bec11128597c454f5d14d05ef6010e3f Mon Sep 17 00:00:00 2001 +From: Lasse Collin +Date: Sun, 29 Mar 2026 20:29:40 +0300 +Subject: [PATCH] Tests: Add a test for the lzma_index_prealloc() + + lzma_index_append() bug + +--- + tests/test_index.c | 35 +++++++++++++++++++++++++++++++++++ + 1 file changed, 35 insertions(+) + +diff --git a/tests/test_index.c b/tests/test_index.c +index ba1b978fd..50e554ffd 100644 +--- a/tests/test_index.c ++++ b/tests/test_index.c +@@ -1758,6 +1758,40 @@ test_lzma_index_buffer_decode(void) + } + + ++// With liblzma <= 5.8.2 (before the commit c8c22869e780), ++// this triggers a buffer overflow in lzma_index_append(). ++static void ++test_decode_empty_and_append(void) ++{ ++#if !defined(HAVE_ENCODERS) || !defined(HAVE_DECODERS) ++ assert_skip("Encoder or decoder support disabled"); ++#else ++ uint8_t buf[256]; ++ lzma_index *idx = lzma_index_init(NULL); ++ assert_true(idx != NULL); ++ ++ // Encode an empty Index. ++ size_t buf_size = 0; ++ assert_lzma_ret(lzma_index_buffer_encode( ++ idx, buf, &buf_size, sizeof(buf)), LZMA_OK); ++ assert_true(buf_size > 0); ++ lzma_index_end(idx, NULL); ++ idx = NULL; ++ ++ // Decode the empty Index. ++ uint64_t memlimit = MEMLIMIT; ++ size_t buf_pos = 0; ++ assert_lzma_ret(lzma_index_buffer_decode(&idx, &memlimit, NULL, ++ buf, &buf_pos, buf_size), LZMA_OK); ++ assert_uint_eq(buf_pos, buf_size); ++ ++ // Append one Record to the decoded empty idx. ++ assert_lzma_ret(lzma_index_append(idx, NULL, 55, 1), LZMA_OK); ++ lzma_index_end(idx, NULL); ++#endif ++} ++ ++ + extern int + main(int argc, char **argv) + { +@@ -1786,6 +1820,7 @@ main(int argc, char **argv) + tuktest_run(test_lzma_index_decoder); + tuktest_run(test_lzma_index_buffer_encode); + tuktest_run(test_lzma_index_buffer_decode); ++ tuktest_run(test_decode_empty_and_append); + lzma_index_end(decode_test_index, NULL); + return tuktest_end(); + } diff --git a/CVE-2026-34743.patch b/CVE-2026-34743.patch new file mode 100644 index 0000000..55c3ff2 --- /dev/null +++ b/CVE-2026-34743.patch @@ -0,0 +1,59 @@ +From c8c22869e780ff57c96b46939c3d79ff99395f87 Mon Sep 17 00:00:00 2001 +From: Lasse Collin +Date: Sun, 29 Mar 2026 19:11:21 +0300 +Subject: [PATCH] liblzma: Fix a buffer overflow in lzma_index_append() + +If lzma_index_decoder() was used to decode an Index that contained no +Records, the resulting lzma_index had an invalid internal "prealloc" +value. If lzma_index_append() was called on this lzma_index, too +little memory would be allocated and a buffer overflow would occur. + +While this combination of the API functions is meant to work, in the +real-world apps this call sequence is rare or might not exist at all. + +This bug is older than xz 5.0.0, so all stable releases are affected. + +Reported-by: GitHub user christos-spearbit +--- + src/liblzma/common/index.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c +index 6add6a683..c4aadb9b0 100644 +--- a/src/liblzma/common/index.c ++++ b/src/liblzma/common/index.c +@@ -433,6 +433,26 @@ lzma_index_prealloc(lzma_index *i, lzma_vli records) + if (records > PREALLOC_MAX) + records = PREALLOC_MAX; + ++ // If index_decoder.c calls us with records == 0, it's decoding ++ // an Index that has no Records. In that case the decoder won't call ++ // lzma_index_append() at all, and i->prealloc isn't used during ++ // the Index decoding either. ++ // ++ // Normally the first lzma_index_append() call from the Index decoder ++ // would reset i->prealloc to INDEX_GROUP_SIZE. With no Records, ++ // lzma_index_append() isn't called and the resetting of prealloc ++ // won't occur either. Thus, if records == 0, use the default value ++ // INDEX_GROUP_SIZE instead. ++ // ++ // NOTE: lzma_index_append() assumes i->prealloc > 0. liblzma <= 5.8.2 ++ // didn't have this check and could set i->prealloc = 0, which would ++ // result in a buffer overflow if the application called ++ // lzma_index_append() after decoding an empty Index. Appending ++ // Records after decoding an Index is a rare thing to do, but ++ // it is supposed to work. ++ if (records == 0) ++ records = INDEX_GROUP_SIZE; ++ + i->prealloc = (size_t)(records); + return; + } +@@ -685,6 +705,7 @@ lzma_index_append(lzma_index *i, const lzma_allocator *allocator, + ++g->last; + } else { + // We need to allocate a new group. ++ assert(i->prealloc > 0); + g = lzma_alloc(sizeof(index_group) + + i->prealloc * sizeof(index_record), + allocator); diff --git a/xz.spec b/xz.spec index f0a5b9c..0b769d0 100644 --- a/xz.spec +++ b/xz.spec @@ -7,7 +7,7 @@ Name: xz # perl-Compress-Raw-Lzma, it has a strict xz version dep Epoch: 1 Version: 5.6.2 -Release: 4%{?dist} +Release: 5%{?dist} # liblzma - 0BSD # xz{,dec}, lzma{dec,info} - 0BSD @@ -27,6 +27,13 @@ Source100: colorxzgrep.sh Source101: colorxzgrep.csh Patch1: xz-cve-2025-31115.patch +#https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 +Patch2: CVE-2026-34743.patch +#Test for the CVE-2026-34743 +#It however needs special build config to fail (it passes even without the CVE fix in our environment) +#See: https://github.com/tukaani-project/xz/issues/233 +Patch3: CVE-2026-34743-test.patch + URL: https://tukaani.org/%{name}/ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -178,6 +185,11 @@ LD_LIBRARY_PATH=$PWD/src/liblzma/.libs make check %changelog +* Fri Aug 21 2026 Jakub Martisko - 1:5.6.2-5 +- Fix: a buffer overflow in lzma_index_append() +- Add test for the issue above (needs a special build config to actually fail -> does not fail in our environemnt) +- Resolves: CVE-2026-34743 + * Tue May 13 2025 Jakub Martisko - 1:5.6.2-4 - Fix: heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115) - Resolves: RHEL-86029