[rpms/coreutils] f44: fix CVE-2026-56391

[rpms/coreutils] f44: fix CVE-2026-56391

[@ 2026-08-03 7:49 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/coreutils
            Branch : f44
            Commit : a5b0a7254b4a1c5352d39f09c6f6761440011a79
            Author : Lukáš Zaoral <lzaoral@redhat.com>
            Date   : 2026-08-03T09:43:06+02:00
            Stats  : +71/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/coreutils/c/a5b0a7254b4a1c5352d39f09c6f6761440011a79?branch=f44

            Log:
            fix CVE-2026-56391

Resolves: rhbz#2507449

---
diff --git a/coreutils-9.11-CVE-2026-56391.patch b/coreutils-9.11-CVE-2026-56391.patch
new file mode 100644
index 0000000..7c4b862
--- /dev/null
+++ b/coreutils-9.11-CVE-2026-56391.patch
@@ -0,0 +1,63 @@
+From 3953e3d60edb0f23bdf367a3ccbc2282b9e00d1b Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 28 Apr 2026 11:25:00 -0700
+Subject: [PATCH] uniq: fix read overrun with -w
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* src/uniq.c (find_field): Fix typo.
+* tests/uniq/uniq.pl (add_z_variants): Test for the bug.
+
+(cherry picked from commit d64e35a8a4c0e4608321433e0d84d917e4e36371)
+---
+ THANKS.in          | 1 +
+ src/uniq.c         | 4 ++--
+ tests/uniq/uniq.pl | 3 +++
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/THANKS.in b/THANKS.in
+index 35fee75..5a2fd35 100644
+--- a/THANKS.in
++++ b/THANKS.in
+@@ -459,6 +459,7 @@ Michail Litvak                      mci@owl.openwall.com
+ Michal Politowski                   mpol@charybda.icm.edu.pl
+ Michal Svec                         msvec@suse.cz
+ Michal Trunecka                     mtruneck@redhat.com
++Michał Majchrowicz                  mmajchrowicz@afine.com
+ Michel Robitaille                   robitail@IRO.UMontreal.CA
+ Michiel Bacchiani                   bacchian@raven.bu.edu
+ Mike Castle                         dalgoda@ix.netcom.com
+diff --git a/src/uniq.c b/src/uniq.c
+index 3046359..5834596 100644
+--- a/src/uniq.c
++++ b/src/uniq.c
+@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen)
+   else
+     {
+       char *ep = lp;
+-      for (idx_t i = check_chars; 0 < i && lp < lim; i--)
+-        ep += mcel_scan (lp, lim).len;
++      for (idx_t i = check_chars; 0 < i && ep < lim; i--)
++        ep += mcel_scan (ep, lim).len;
+       len = ep - lp;
+     }
+ 
+diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl
+index b558fb3..0df7ec6 100755
+--- a/tests/uniq/uniq.pl
++++ b/tests/uniq/uniq.pl
+@@ -234,6 +234,9 @@ my @Tests =
+         "  - 'separate'\n" .
+         "  - 'both'\n" .
+         "Try '$prog --help' for more information.\n"}],
++ # Test for read buffer overrun.
++ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n";
++      ['146', '-w256', {IN  => $longline x 2}, {OUT => $longline}] },
+ );
+ 
+ # Locale related tests
+-- 
+2.55.0
+

diff --git a/coreutils.spec b/coreutils.spec
index fe8b56b..9880d97 100644
--- a/coreutils.spec
+++ b/coreutils.spec
@@ -1,7 +1,7 @@
 Summary: A set of basic GNU tools commonly used in shell scripts
 Name:    coreutils
 Version: 9.10
-Release: 4%{?dist}
+Release: 5%{?dist}
 # some used parts of gnulib are under various variants of LGPL
 License: GPL-3.0-or-later AND GFDL-1.3-no-invariants-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later
 Url:     https://www.gnu.org/software/coreutils/
@@ -40,6 +40,10 @@ Patch200: coreutils-9.10-fix-tests-hangup.patch
 # https://github.com/coreutils/coreutils/commit/a85e9182b1d173c26205dada54133cd9e9174fc1
 Patch201: coreutils-9.10-fold-xFF-truncation.patch
 
+# CVE-2026-56391 - uniq: fix read overrun with -w
+# https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371
+Patch202: coreutils-9.11-CVE-2026-56391.patch
+
 # (sb) lin18nux/lsb compliance - multibyte functionality patch
 Patch800: coreutils-i18n.patch
 
@@ -290,6 +294,9 @@ rm -f $RPM_BUILD_ROOT%{_infodir}/dir
 %license COPYING
 
 %changelog
+* Mon Aug 03 2026 Lukáš Zaoral <lzaoral@redhat.com> - 9.10-5
+- CVE-2026-56391 - uniq: fix read overrun with -w (rhbz#2507449)
+
 * Thu Jun 11 2026 Lukáš Zaoral <lzaoral@redhat.com> - 9.10-4
 - unexpand: fix heap overflows