Skip to content

Commit 3f85931

Browse files
azurelinux-securityKanishk Bansal
authored and
AkarshHCL
committed
[AutoPR- Security] Patch xz for CVE-2026-34743 [LOW] (microsoft#16451)
Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com> Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
1 parent cb0ecfc commit 3f85931

File tree

6 files changed

+91
-19
lines changed

6 files changed

+91
-19
lines changed

‎SPECS/xz/CVE-2026-34743.patch‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
From c34a1e28809d781ec77ebcae1b2d13e8d09bc329 Mon Sep 17 00:00:00 2001
2+
From: Lasse Collin <lasse.collin@tukaani.org>
3+
Date: Sun, 29 Mar 2026 19:11:21 +0300
4+
Subject: [PATCH] liblzma: Fix a buffer overflow in lzma_index_append()
5+
6+
If lzma_index_decoder() was used to decode an Index that contained no
7+
Records, the resulting lzma_index had an invalid internal "prealloc"
8+
value. If lzma_index_append() was called on this lzma_index, too
9+
little memory would be allocated and a buffer overflow would occur.
10+
11+
While this combination of the API functions is meant to work, in the
12+
real-world apps this call sequence is rare or might not exist at all.
13+
14+
This bug is older than xz 5.0.0, so all stable releases are affected.
15+
16+
Reported-by: GitHub user christos-spearbit
17+
(cherry picked from commit c8c22869e780ff57c96b46939c3d79ff99395f87)
18+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
19+
Upstream-reference: https://github.com/tukaani-project/xz/commit/8538443d08591693a8c61f3a03656650f39c7c32.patch
20+
---
21+
src/liblzma/common/index.c | 21 +++++++++++++++++++++
22+
1 file changed, 21 insertions(+)
23+
24+
diff --git a/src/liblzma/common/index.c b/src/liblzma/common/index.c
25+
index 97cc9f9..e44dacc 100644
26+
--- a/src/liblzma/common/index.c
27+
+++ b/src/liblzma/common/index.c
28+
@@ -434,6 +434,26 @@ lzma_index_prealloc(lzma_index *i, lzma_vli records)
29+
if (records > PREALLOC_MAX)
30+
records = PREALLOC_MAX;
31+
32+
+ // If index_decoder.c calls us with records == 0, it's decoding
33+
+ // an Index that has no Records. In that case the decoder won't call
34+
+ // lzma_index_append() at all, and i->prealloc isn't used during
35+
+ // the Index decoding either.
36+
+ //
37+
+ // Normally the first lzma_index_append() call from the Index decoder
38+
+ // would reset i->prealloc to INDEX_GROUP_SIZE. With no Records,
39+
+ // lzma_index_append() isn't called and the resetting of prealloc
40+
+ // won't occur either. Thus, if records == 0, use the default value
41+
+ // INDEX_GROUP_SIZE instead.
42+
+ //
43+
+ // NOTE: lzma_index_append() assumes i->prealloc > 0. liblzma <= 5.8.2
44+
+ // didn't have this check and could set i->prealloc = 0, which would
45+
+ // result in a buffer overflow if the application called
46+
+ // lzma_index_append() after decoding an empty Index. Appending
47+
+ // Records after decoding an Index is a rare thing to do, but
48+
+ // it is supposed to work.
49+
+ if (records == 0)
50+
+ records = INDEX_GROUP_SIZE;
51+
+
52+
i->prealloc = (size_t)(records);
53+
return;
54+
}
55+
@@ -680,6 +700,7 @@ lzma_index_append(lzma_index *i, const lzma_allocator *allocator,
56+
++g->last;
57+
} else {
58+
// We need to allocate a new group.
59+
+ assert(i->prealloc > 0);
60+
g = lzma_alloc(sizeof(index_group)
61+
+ i->prealloc * sizeof(index_record),
62+
allocator);
63+
--
64+
2.45.4
65+

‎SPECS/xz/xz.spec‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
Summary: Programs for compressing and decompressing files
22
Name: xz
33
Version: 5.4.4
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
URL: https://tukaani.org/xz
66
License: GPLv2+ and GPLv3+ and LGPLv2+
77
Group: Applications/File
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
1010
Source0: https://tukaani.org/xz/%{name}-%{version}.tar.xz
1111
Patch0: CVE-2025-31115.patch
12+
Patch1: CVE-2026-34743.patch
1213
Provides: xz-lzma-compat = %{version}-%{release}
1314
Provides: lzma = %{version}-%{release}
1415
Requires: xz-libs = %{version}-%{release}
@@ -94,10 +95,13 @@ make %{?_smp_mflags} check
9495
%{_mandir}/uk/man1/*
9596

9697
%files devel
98+
%license COPYING COPYING.GPLv2
9799
%{_includedir}/lzma.h
98100
%{_includedir}/lzma/*.h
99101
%{_libdir}/pkgconfig/liblzma.pc
100102
%{_libdir}/liblzma.so
103+
%exclude %{_defaultdocdir}/%{name}-%{version}/COPYING
104+
%exclude %{_defaultdocdir}/%{name}-%{version}/COPYING.GPLv2
101105
%{_defaultdocdir}/%{name}-%{version}/*
102106

103107
%files libs
@@ -107,6 +111,9 @@ make %{?_smp_mflags} check
107111
%defattr(-,root,root)
108112

109113
%changelog
114+
* Fri Apr 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 5.4.4-3
115+
- Patch for CVE-2026-34743
116+
110117
* Tue Apr 1 2025 Jon Slobodzian <joslobo@microsoft.com> - 5.4.4-2
111118
- Patch for CVE-2025-31115
112119

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,10 @@ util-linux-2.40.2-3.azl3.aarch64.rpm
7474
util-linux-devel-2.40.2-3.azl3.aarch64.rpm
7575
util-linux-libs-2.40.2-3.azl3.aarch64.rpm
7676
tar-1.35-2.azl3.aarch64.rpm
77-
xz-5.4.4-2.azl3.aarch64.rpm
78-
xz-devel-5.4.4-2.azl3.aarch64.rpm
79-
xz-lang-5.4.4-2.azl3.aarch64.rpm
80-
xz-libs-5.4.4-2.azl3.aarch64.rpm
77+
xz-5.4.4-3.azl3.aarch64.rpm
78+
xz-devel-5.4.4-3.azl3.aarch64.rpm
79+
xz-lang-5.4.4-3.azl3.aarch64.rpm
80+
xz-libs-5.4.4-3.azl3.aarch64.rpm
8181
zstd-1.5.5-2.azl3.aarch64.rpm
8282
zstd-devel-1.5.5-2.azl3.aarch64.rpm
8383
zstd-libs-1.5.5-2.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,10 @@ util-linux-2.40.2-3.azl3.x86_64.rpm
7474
util-linux-devel-2.40.2-3.azl3.x86_64.rpm
7575
util-linux-libs-2.40.2-3.azl3.x86_64.rpm
7676
tar-1.35-2.azl3.x86_64.rpm
77-
xz-5.4.4-2.azl3.x86_64.rpm
78-
xz-devel-5.4.4-2.azl3.x86_64.rpm
79-
xz-lang-5.4.4-2.azl3.x86_64.rpm
80-
xz-libs-5.4.4-2.azl3.x86_64.rpm
77+
xz-5.4.4-3.azl3.x86_64.rpm
78+
xz-devel-5.4.4-3.azl3.x86_64.rpm
79+
xz-lang-5.4.4-3.azl3.x86_64.rpm
80+
xz-libs-5.4.4-3.azl3.x86_64.rpm
8181
zstd-1.5.5-2.azl3.x86_64.rpm
8282
zstd-devel-1.5.5-2.azl3.x86_64.rpm
8383
zstd-libs-1.5.5-2.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -606,11 +606,11 @@ util-linux-lang-2.40.2-3.azl3.aarch64.rpm
606606
util-linux-libs-2.40.2-3.azl3.aarch64.rpm
607607
which-2.21-8.azl3.aarch64.rpm
608608
which-debuginfo-2.21-8.azl3.aarch64.rpm
609-
xz-5.4.4-2.azl3.aarch64.rpm
610-
xz-debuginfo-5.4.4-2.azl3.aarch64.rpm
611-
xz-devel-5.4.4-2.azl3.aarch64.rpm
612-
xz-lang-5.4.4-2.azl3.aarch64.rpm
613-
xz-libs-5.4.4-2.azl3.aarch64.rpm
609+
xz-5.4.4-3.azl3.aarch64.rpm
610+
xz-debuginfo-5.4.4-3.azl3.aarch64.rpm
611+
xz-devel-5.4.4-3.azl3.aarch64.rpm
612+
xz-lang-5.4.4-3.azl3.aarch64.rpm
613+
xz-libs-5.4.4-3.azl3.aarch64.rpm
614614
zip-3.0-6.azl3.aarch64.rpm
615615
zip-debuginfo-3.0-6.azl3.aarch64.rpm
616616
zlib-1.3.2-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -614,11 +614,11 @@ util-linux-lang-2.40.2-3.azl3.x86_64.rpm
614614
util-linux-libs-2.40.2-3.azl3.x86_64.rpm
615615
which-2.21-8.azl3.x86_64.rpm
616616
which-debuginfo-2.21-8.azl3.x86_64.rpm
617-
xz-5.4.4-2.azl3.x86_64.rpm
618-
xz-debuginfo-5.4.4-2.azl3.x86_64.rpm
619-
xz-devel-5.4.4-2.azl3.x86_64.rpm
620-
xz-lang-5.4.4-2.azl3.x86_64.rpm
621-
xz-libs-5.4.4-2.azl3.x86_64.rpm
617+
xz-5.4.4-3.azl3.x86_64.rpm
618+
xz-debuginfo-5.4.4-3.azl3.x86_64.rpm
619+
xz-devel-5.4.4-3.azl3.x86_64.rpm
620+
xz-lang-5.4.4-3.azl3.x86_64.rpm
621+
xz-libs-5.4.4-3.azl3.x86_64.rpm
622622
zip-3.0-6.azl3.x86_64.rpm
623623
zip-debuginfo-3.0-6.azl3.x86_64.rpm
624624
zlib-1.3.2-1.azl3.x86_64.rpm

0 commit comments

Comments
 (0)