Proposed editorconfig-core update for CVE-2026-40489 in bullseye
Hi,
I prepared a proposed bullseye-security update for editorconfig-core for
CVE-2026-40489.
I noticed editorconfig-core is currently listed in dla-needed.txt for
CVE-2026-40489, which is a regression of the previous CVE-2023-0341 fix.
The issue is tracked as #1134338.
I also sent this debdiff to #1134338:
https://bugs.debian.org/1134338
The proposed update is from 0.12.1-1.1+deb11u1 to 0.12.1-1.1+deb11u2. It
backports the upstream fixing commit:
https://github.com/editorconfig/editorconfig-core-c/commit/5159be88ad50641d9843289adda791ba300421ff
The upstream advisory is:
https://github.com/editorconfig/editorconfig-core-c/security/advisories/GHSA-97xg-vrcq-254h
Validation performed:
* dpkg-source -b completed successfully
* clean bullseye pbuilder binary build completed successfully
* lintian on the resulting .changes only reported pre-existing packaging
issues such as obsolete Vcs fields and manpage groff warnings
I am not claiming the DLA, but I would be happy to adjust the patch or
testing if this is useful to the LTS team.
The debdiff is attached.
Regards,
James
diff -Nru editorconfig-core-0.12.1/debian/changelog editorconfig-core-0.12.1/debian/changelog
--- editorconfig-core-0.12.1/debian/changelog 2024-11-29 21:03:02.000000000 +0000
+++ editorconfig-core-0.12.1/debian/changelog 2026-04-20 14:02:57.000000000 +0000
@@ -1,3 +1,10 @@
+editorconfig-core (0.12.1-1.1+deb11u2) bullseye-security; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2026-40489: Fix stack-based buffer overflow in ec_glob.
+
+ -- James Montgomery <james_montgomery@disroot.org> Mon, 20 Apr 2026 14:02:57 +0000
+
editorconfig-core (0.12.1-1.1+deb11u1) bullseye-security; urgency=medium
* Non-maintainer upload by the LTS Team.
diff -Nru editorconfig-core-0.12.1/debian/patches/CVE-2026-40489.patch editorconfig-core-0.12.1/debian/patches/CVE-2026-40489.patch
--- editorconfig-core-0.12.1/debian/patches/CVE-2026-40489.patch 1970-01-01 00:00:00.000000000 +0000
+++ editorconfig-core-0.12.1/debian/patches/CVE-2026-40489.patch 2026-04-20 14:02:57.000000000 +0000
@@ -0,0 +1,31 @@
+commit 5159be88ad50641d9843289adda791ba300421ff
+Author: Hong Xu <hong@topbug.net>
+Date: Tue Apr 14 23:11:39 2026 -0700
+
+ Merge commit from fork
+
+ Completes the buffer-overflow fix from #87, which bounded writes into
+ `pcre_str` but left the initial `strcpy` of `pattern` into `l_pattern`
+ at the top of `ec_glob` unguarded. Sufficiently long patterns smash the
+ stack before any of the bounds-checked code runs.
+
+ Fix CVE-2026-40489
+
+Index: editorconfig-core-0.12.1/src/lib/ec_glob.c
+===================================================================
+--- editorconfig-core-0.12.1.orig/src/lib/ec_glob.c
++++ editorconfig-core-0.12.1/src/lib/ec_glob.c
+@@ -96,8 +96,12 @@ int ec_glob(const char *pattern, const c
+ _Bool are_brace_paired;
+ UT_array * nums; /* number ranges */
+ int ret = 0;
++ size_t pattern_len = strlen(pattern);
+
+- strcpy(l_pattern, pattern);
++ /* Reject patterns that would overflow l_pattern in the copy below. */
++ if (pattern_len >= sizeof(l_pattern))
++ return -1;
++ memcpy(l_pattern, pattern, pattern_len + 1);
+ p_pcre = pcre_str + 1;
+ pcre_str_end = pcre_str + 2 * PATTERN_MAX;
+
diff -Nru editorconfig-core-0.12.1/debian/patches/series editorconfig-core-0.12.1/debian/patches/series
--- editorconfig-core-0.12.1/debian/patches/series 2024-11-28 15:06:22.000000000 +0000
+++ editorconfig-core-0.12.1/debian/patches/series 2026-04-20 14:02:57.000000000 +0000
@@ -6,4 +6,4 @@
CVE-2023-0341.patch
CVE-2024-53849-1.patch
CVE-2024-53849-2.patch
-
+CVE-2026-40489.patch
Reply to: