[Buildroot] [PATCH] package/libconfuse: bump to version 3.4
From: Michael Fischer <hidden>
Date: 2026-09-08 08:39:44
Subsystem:
the rest · Maintainer:
Linus Torvalds
The backported fix is dropped, as 3.4 ships it:
0001-Fix-163-unterminated-username-used-with-getpwnam.patch
-> upstream commit d73777c2c356, released in 3.4
With the patch gone, LIBCONFUSE_IGNORE_CVES is no longer needed either.
3.4 also fixes three robustness defects that carry no CVE:
#180 isspace() argument fix, could crash the lexer
#182 stack exhaustion from deeply nested sections
#187 null dereference on an empty comment with CFGF_COMMENTS
Signed-off-by: Michael Fischer <redacted>
---
...rminated-username-used-with-getpwnam.patch | 43 -------------------
package/libconfuse/libconfuse.hash | 4 +-
package/libconfuse/libconfuse.mk | 5 +--
3 files changed, 2 insertions(+), 50 deletions(-)
delete mode 100644 package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
diff --git a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
deleted file mode 100644
index 44e15468ac..0000000000
--- a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
+++ /dev/null@@ -1,43 +0,0 @@ -From d73777c2c3566fb2647727bb56d9a2295b81669b Mon Sep 17 00:00:00 2001 -From: Joachim Wiberg <troglobit@gmail.com> -Date: Fri, 2 Sep 2022 16:12:46 +0200 -Subject: [PATCH] Fix #163: unterminated username used with getpwnam() - -Signed-off-by: Joachim Wiberg <troglobit@gmail.com> - -CVE: CVE-2022-40320 -Upstream: https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b -Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> ---- - src/confuse.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/src/confuse.c b/src/confuse.c -index 6d1fdbd..05566b5 100644 ---- a/src/confuse.c -+++ b/src/confuse.c -@@ -1894,18 +1894,20 @@ DLLIMPORT char *cfg_tilde_expand(const char *filename) - passwd = getpwuid(geteuid()); - file = filename + 1; - } else { -- /* ~user or ~user/path */ -- char *user; -+ char *user; /* ~user or ~user/path */ -+ size_t len; - - file = strchr(filename, '/'); - if (file == 0) - file = filename + strlen(filename); - -- user = malloc(file - filename); -+ len = file - filename - 1; -+ user = malloc(len + 1); - if (!user) - return NULL; - -- strncpy(user, filename + 1, file - filename - 1); -+ strncpy(user, &filename[1], len); -+ user[len] = 0; - passwd = getpwnam(user); - free(user); - }
diff --git a/package/libconfuse/libconfuse.hash b/package/libconfuse/libconfuse.hash
index bb968f7a52..19453828d8 100644
--- a/package/libconfuse/libconfuse.hash
+++ b/package/libconfuse/libconfuse.hash@@ -1,5 +1,3 @@ -# From https://github.com/martinh/libconfuse/releases/download/v3.3/confuse-3.3.tar.xz.md5 -md5 a183cef2cecdd3783436ff8de500d274 confuse-3.3.tar.xz # Locally computed -sha256 1dd50a0320e135a55025b23fcdbb3f0a81913b6d0b0a9df8cc2fdf3b3dc67010 confuse-3.3.tar.xz +sha256 36bfa3928f9c323914c7c8317e8722cb22f41db69d7c9d4c24b4689fa955445d confuse-3.4.tar.xz sha256 dc3ff4b62f851dd2e94a151061ffeb7d28ddfc880a442068dc5283dbaa927306 LICENSE
diff --git a/package/libconfuse/libconfuse.mk b/package/libconfuse/libconfuse.mk
index fff684a55b..ac3866f746 100644
--- a/package/libconfuse/libconfuse.mk
+++ b/package/libconfuse/libconfuse.mk@@ -4,7 +4,7 @@ # ################################################################################ -LIBCONFUSE_VERSION = 3.3 +LIBCONFUSE_VERSION = 3.4 LIBCONFUSE_SOURCE = confuse-$(LIBCONFUSE_VERSION).tar.xz LIBCONFUSE_SITE = https://github.com/libconfuse/libconfuse/releases/download/v$(LIBCONFUSE_VERSION) LIBCONFUSE_INSTALL_STAGING = YES
@@ -14,8 +14,5 @@ LIBCONFUSE_LICENSE_FILES = LICENSE LIBCONFUSE_CPE_ID_VALID = YES LIBCONFUSE_DEPENDENCIES = $(TARGET_NLS_DEPENDENCIES) -# 0001-Fix-163-unterminated-username-used-with-getpwnam.patch -LIBCONFUSE_IGNORE_CVES += CVE-2022-40320 - $(eval $(autotools-package)) $(eval $(host-autotools-package))
--
2.43.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot