Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libyang for openSUSE:Factory checked in at 2026-10-27 16:48:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libyang (Old) and /work/SRC/openSUSE:Factory/.libyang.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libyang" Tue Oct 27 16:48:01 2026 rev:23 rq:1392773 version:3.13.6 Changes: -------- --- /work/SRC/openSUSE:Factory/libyang/libyang.changes 2026-05-28 17:29:24.789863395 +0200 +++ /work/SRC/openSUSE:Factory/.libyang.new.2252680/libyang.changes 2026-10-27 16:48:23.884067920 +0100 @@ -1,0 +2,7 @@ +Mon Oct 26 07:34:22 UTC 2026 - Petr Gajdos <[email protected]> + +- added patches + CVE-2026-115327: an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c [bsc#1286830] + * libyang-CVE-2026-115327.patch + +------------------------------------------------------------------- New: ---- libyang-CVE-2026-115327.patch ----------(New B)---------- New: CVE-2026-115327: an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c [bsc#1286830] * libyang-CVE-2026-115327.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libyang.spec ++++++ --- /var/tmp/diff_new_pack.ZF20CV/_old 2026-10-27 16:48:24.874109438 +0100 +++ /var/tmp/diff_new_pack.ZF20CV/_new 2026-10-27 16:48:24.877109564 +0100 @@ -31,6 +31,8 @@ Patch0: libyang-CVE-2026-41401.patch # CVE-2026-44673: integer overflow in `lyb_read_string()` of `src/parser_lyb.c` leads to heap buffer overflow when parsing a maliciously crafted LYB binary blob [bsc#1265330] Patch1: libyang-CVE-2026-44673.patch +# CVE-2026-115327: an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c [bsc#1286830] +Patch2: libyang-CVE-2026-115327.patch BuildRequires: cmake BuildRequires: doxygen BuildRequires: fdupes ++++++ libyang-CVE-2026-115327.patch ++++++ >From 927fce908774289a7d9c07fff5704c33965c9773 Mon Sep 17 00:00:00 2001 From: Mar <[email protected]> Date: Sat, 17 Oct 2026 01:19:20 +0200 Subject: [PATCH] parser xml BUGFIX envelope freed on error before being set lydxml_envelope() freed the caller's *envp on its error paths even when it had not been assigned yet, and lydxml_env_netconf_rpc() passed an uninitialized local for the optional "action" envelope. Create the node into a local variable, assign *envp only on success and free only the local on error. Also initialize the local. --- src/parser_xml.c | 17 +++++++++-------- tests/utests/data/test_parser_xml.c | 13 +++++++++++++ 2 files changed, 22 insertions(+), 8 deletions(-) Index: libyang-3.13.6/src/parser_xml.c =================================================================== --- libyang-3.13.6.orig/src/parser_xml.c +++ libyang-3.13.6/src/parser_xml.c @@ -1167,7 +1167,7 @@ cleanup: * @param[in] name Name of the element. * @param[in] uri URI of the element. * @param[in] value Whether a value is expected in the element. - * @param[out] evnp Parsed envelope (opaque node). + * @param[out] envp Parsed envelope (opaque node), set only on success. * @return LY_SUCCESS on success. * @return LY_ENOT if the specified element did not match. * @return LY_ERR value on error. @@ -1178,6 +1178,7 @@ lydxml_envelope(struct lyxml_ctx *xmlctx LY_ERR rc = LY_SUCCESS; const struct lyxml_ns *ns; struct lyd_attr *attr = NULL; + struct lyd_node *env = NULL; const char *prefix; size_t prefix_len; @@ -1219,22 +1220,22 @@ lydxml_envelope(struct lyxml_ctx *xmlctx /* create node */ rc = lyd_create_opaq(xmlctx->ctx, name, strlen(name), prefix, prefix_len, uri, strlen(uri), xmlctx->value, - xmlctx->ws_only ? 0 : xmlctx->value_len, NULL, LY_VALUE_XML, NULL, 0, envp); + xmlctx->ws_only ? 0 : xmlctx->value_len, NULL, LY_VALUE_XML, NULL, 0, &env); LY_CHECK_GOTO(rc, cleanup); /* assign atributes */ - ((struct lyd_node_opaq *)(*envp))->attr = attr; + ((struct lyd_node_opaq *)env)->attr = attr; attr = NULL; /* parser next element */ LY_CHECK_GOTO(rc = lyxml_ctx_next(xmlctx), cleanup); + *envp = env; + env = NULL; + cleanup: lyd_free_attr_siblings(xmlctx->ctx, attr); - if (rc) { - lyd_free_tree(*envp); - *envp = NULL; - } + lyd_free_tree(env); return rc; } @@ -1358,7 +1359,7 @@ static LY_ERR lydxml_env_netconf_rpc(struct lyxml_ctx *xmlctx, struct lyd_node **envp, uint32_t *int_opts, uint32_t *close_elem) { LY_ERR rc = LY_SUCCESS, r; - struct lyd_node *child; + struct lyd_node *child = NULL; assert(envp && !*envp); Index: libyang-3.13.6/tests/utests/data/test_parser_xml.c =================================================================== --- libyang-3.13.6.orig/tests/utests/data/test_parser_xml.c +++ libyang-3.13.6/tests/utests/data/test_parser_xml.c @@ -711,6 +711,19 @@ test_netconf_action(void **state) lyd_free_all(tree); lyd_free_all(op); + /* value in the action envelope */ + data = "<rpc message-id=\"25\" xmlns=\"urn:ietf:params:xml:ns:netconf:base:1.0\">" + "<action xmlns=\"urn:ietf:params:xml:ns:yang:1\">val</action>" + "</rpc>\n"; + assert_int_equal(LY_SUCCESS, ly_in_new_memory(data, &in)); + tree = op = NULL; + assert_int_equal(LY_EVALID, lyd_parse_op(UTEST_LYCTX, NULL, in, LYD_XML, LYD_TYPE_RPC_NETCONF, + &tree, &op)); + ly_in_free(in, 0); + CHECK_LOG_CTX("Unexpected value \"val\" in the \"action\" element.", NULL, 1); + assert_null(tree); + assert_null(op); + /* wrong namespace, element name, whatever... */ /* TODO */ }
