Version in base suite: 3.6-5 Base version: parted_3.6-5 Target version: parted_3.6-5+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/p/parted/parted_3.6-5.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/p/parted/parted_3.6-5+deb13u1.dsc .git-dpm | 4 .gitignore | 1 changelog | 9 patches/CVE-2026-89088.and.CVE-2026-89085.patch | 228 ++++++++++++++++++++++++ patches/series | 1 5 files changed, 240 insertions(+), 3 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp_pvbcpl8/parted_3.6-5.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp_pvbcpl8/parted_3.6-5+deb13u1.dsc: no acceptable signature found diff -Nru parted-3.6/debian/.git-dpm parted-3.6/debian/.git-dpm --- parted-3.6/debian/.git-dpm 2025-02-23 17:39:45.000000000 +0000 +++ parted-3.6/debian/.git-dpm 2026-10-01 02:09:27.000000000 +0000 @@ -1,6 +1,6 @@ # see git-dpm(1) from git-dpm package -7a96e9d182e544007185af62df87e0a47dc9029d -7a96e9d182e544007185af62df87e0a47dc9029d +9aa421e2ffd46e52f54acfcf7a14cbaade790652 +9aa421e2ffd46e52f54acfcf7a14cbaade790652 8b1dfdefd31c1304a98e9df675720db83bca3c08 8b1dfdefd31c1304a98e9df675720db83bca3c08 parted_3.6.orig.tar.xz diff -Nru parted-3.6/debian/.gitignore parted-3.6/debian/.gitignore --- parted-3.6/debian/.gitignore 2025-02-23 17:39:45.000000000 +0000 +++ parted-3.6/debian/.gitignore 1970-01-01 00:00:00.000000000 +0000 @@ -1 +0,0 @@ -/files diff -Nru parted-3.6/debian/changelog parted-3.6/debian/changelog --- parted-3.6/debian/changelog 2025-02-23 17:39:45.000000000 +0000 +++ parted-3.6/debian/changelog 2026-10-01 02:09:27.000000000 +0000 @@ -1,3 +1,12 @@ +parted (3.6-5+deb13u1) trixie; urgency=medium + + * Team upload. + * debian/patches/: + - CVE-2026-89088.and.CVE-2026-89085.patch: cherry-pick from upstream to + fix CVE-2026-89088 and CVE-2026-89085. (Closes: 1148169) + + -- Carlos Henrique Lima Melara Wed, 30 Sep 2026 23:09:27 -0300 + parted (3.6-5) unstable; urgency=medium * Apply X-Style: black. diff -Nru parted-3.6/debian/patches/CVE-2026-89088.and.CVE-2026-89085.patch parted-3.6/debian/patches/CVE-2026-89088.and.CVE-2026-89085.patch --- parted-3.6/debian/patches/CVE-2026-89088.and.CVE-2026-89085.patch 1970-01-01 00:00:00.000000000 +0000 +++ parted-3.6/debian/patches/CVE-2026-89088.and.CVE-2026-89085.patch 2026-10-01 02:09:27.000000000 +0000 @@ -0,0 +1,228 @@ +From 9aa421e2ffd46e52f54acfcf7a14cbaade790652 Mon Sep 17 00:00:00 2001 +From: "Brian C. Lane" +Date: Tue, 8 Sep 2026 09:13:00 -0700 +Subject: libparted: Catch FAT metadata triggered errors + +Bad metadata can trigger a buffer overflow in fat resize code. Trigger +an assert when the sector count is too large, or malloc is called with a +size of 0 + +Adds a new test that checks to make sure that the assert is triggered. +This includes a test for deep directory traversal which should be caught +by glibc and reported as 'buffer overflow detected'. + +This also includes a check on the flag_traverse_dir dir_name length to +prevent an overflow of the 4k buffer with deeply nested directories. +Also include a test for this assertion. + +WARNING: parted should be build with debug enabled (which is the +default) this enables a large number of PED_ASSERT checks which catch +various conditions like these. + +This fixes two CVE's: + - CVE-2026-89085 - heap buffer overflow in _init_fats / fat_table_read + - CVE-2026-89088 - heap buffer overflow in duplicate_legacy_root_dir + +Origin: upstream, https://gitweb.git.savannah.gnu.org/gitweb/?p=parted.git;a=commit;h=73301c6915781c2eee66d0b1cc9d41a70bf901d6 +Bug-Debian: https://bugs.debian.org/1148169 +Last-Update: 2026-09-30 + +Patch-Name: CVE-2026-89088.and.CVE-2026-89085.patch +--- + libparted/fs/r/fat/count.c | 1 + + libparted/fs/r/fat/resize.c | 2 + + libparted/libparted.c | 1 + + tests/Makefile.am | 1 + + tests/t3001-buffer.sh | 134 ++++++++++++++++++++++++++++++++++++ + 5 files changed, 139 insertions(+) + create mode 100755 tests/t3001-buffer.sh + +diff --git a/libparted/fs/r/fat/count.c b/libparted/fs/r/fat/count.c +index e23404b2..9c97bf42 100644 +--- a/libparted/fs/r/fat/count.c ++++ b/libparted/fs/r/fat/count.c +@@ -166,6 +166,7 @@ flag_traverse_dir (FatTraverseInfo* trav_info) { + PedSector size; + + PED_ASSERT (trav_info != NULL); ++ PED_ASSERT (strlen(trav_info->dir_name) < 4083); + + strcpy (file_name, trav_info->dir_name); + file_name_start = file_name + strlen (file_name); +diff --git a/libparted/fs/r/fat/resize.c b/libparted/fs/r/fat/resize.c +index 78dede43..a6cc3851 100644 +--- a/libparted/fs/r/fat/resize.c ++++ b/libparted/fs/r/fat/resize.c +@@ -86,6 +86,8 @@ duplicate_legacy_root_dir (FatOpContext* ctx) + + PED_ASSERT (old_fs_info->root_dir_sector_count + == new_fs_info->root_dir_sector_count); ++ PED_ASSERT (old_fs_info->root_dir_sector_count <= old_fs_info->buffer_sectors); ++ PED_ASSERT (new_fs_info->root_dir_sector_count <= new_fs_info->buffer_sectors); + + if (!ped_geometry_read (ctx->old_fs->geom, old_fs_info->buffer, + old_fs_info->root_dir_offset, +diff --git a/libparted/libparted.c b/libparted/libparted.c +index 88e7eea2..9a1d9297 100644 +--- a/libparted/libparted.c ++++ b/libparted/libparted.c +@@ -245,6 +245,7 @@ ped_malloc (size_t size) + { + void* mem; + ++ PED_ASSERT(size > 0); + mem = (void*) malloc (size); + if (!mem) { + ped_exception_throw (PED_EXCEPTION_FATAL, PED_EXCEPTION_CANCEL, +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 3c1f929a..9e60aba0 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -61,6 +61,7 @@ TESTS = \ + t2500-freebsd-ufs.sh \ + t2500-probe-corrupt-hfs.sh \ + t3000-resize-fs.sh \ ++ t3001-buffer.sh \ + t3200-resize-partition.sh \ + t3200-type-change.sh \ + t3210-gpt-type-change.sh \ +diff --git a/tests/t3001-buffer.sh b/tests/t3001-buffer.sh +new file mode 100755 +index 00000000..c016f5f7 +--- /dev/null ++++ b/tests/t3001-buffer.sh +@@ -0,0 +1,134 @@ ++#!/bin/sh ++# Test buffer overflow fix in libparted/fs/r/fat/fat.c ++ ++# Copyright (C) 2026 Free Software Foundation, Inc. ++ ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++ ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++ ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++ ++. "${srcdir=.}/init.sh"; path_prepend_ ../parted . ++require_root_ ++require_scsi_debug_module_ ++require_512_byte_sector_size_ ++ ++ ++FSTYPES="" ++ ++# Is mkfs.vfat available? ++mkfs.vfat 2>&1 | grep '^Usage:' && FSTYPES="fat32 fat16" ++ ++[ -n "$FSTYPES" ] || skip_ "mkfs.vfat is not installed" ++ ++ ++ss=$sector_size_ ++ ++start=63s ++default_end=546147s ++ new_end=530144s ++ ++# create memory-backed device. Must be > 256MB+8MB ++scsi_debug_setup_ dev_size_mb=267 > dev-name || ++ skip_ 'failed to create scsi_debug device' ++dev=$(cat dev-name) ++ ++fail=0 ++ ++parted -s $dev mklabel gpt > out 2>&1 || fail=1 ++# expect no output ++compare /dev/null out || fail=1 ++ ++# ensure that the disk is large enough ++dev_n_sectors=$(parted -s $dev u s p|sed -n '2s/.* \([0-9]*\)s$/\1/p') ++device_sectors_required=$(echo $default_end | sed 's/s$//') ++# Ensure that $dev is large enough for this test ++test $device_sectors_required -le $dev_n_sectors || fail=1 ++ ++# create mount point dir ++mount_point="`pwd`/mnt" ++mkdir "$mount_point" || fail=1 ++ ++# be sure to unmount upon interrupt, failure, etc. ++cleanup_fn_() { umount "${dev}1" > /dev/null 2>&1; } ++ ++for fs_type in $FSTYPES; do ++ echo "fs_type=$fs_type" ++ ++ # create an empty $fs_type partition, cylinder aligned, size > 256 MB ++ parted -a min -s $dev mkpart p1 $start $default_end > out 2>&1 || fail=1 ++ compare /dev/null out || fail=1 ++ ++ # print partition table ++ parted -m -s $dev u s p > out 2>&1 || fail=1 ++ ++ # wait for new partition device to appear ++ wait_for_dev_to_appear_ ${dev}1 ++ ++ case $fs_type in ++ fat16) mkfs_cmd='mkfs.vfat -F 16'; fsck='fsck.vfat -v';; ++ fat32) mkfs_cmd='mkfs.vfat -F 32'; fsck='fsck.vfat -v';; ++ *) error "internal error: unhandled fs type: $fs_type";; ++ esac ++ ++ # create the file system ++ $mkfs_cmd ${dev}1 || fail=1 ++ ++ # Set a very large dir_entries value ++ # This triggeres different failures in FAT16 and FAT32, see expected output below ++ printf '\xff\xff' | dd of=${dev}1 bs=1 seek=$((0x11)) conv=notrunc ++ ++ # NOTE: shrinking is the only type of resizing that works. ++ # resize that file system to be one cylinder (8MiB) smaller ++ # NOTE: A core dump is expected here, check output to determine if it is the correct failure ++ fs-resize ${dev}1 0 $new_end > out 2>&1 ++ ++ # Include full output for debugging ++ cat out ++ ++ # FAT16 exepcts an Assert in duplicate_legacy_root_dir ++ # FAT32 expects an Assert in ped_malloc ++ case $fs_type in ++ fat16) grep "Assertion.*duplicate_legacy_root_dir" out || fail=1;; ++ fat32) grep "Assertion.*ped_malloc" out || fail=1;; ++ esac ++ ++ # create a clean file system ++ $mkfs_cmd ${dev}1 || fail=1 ++ ++ # create 500 deep directory tree that overflows the 4096 byte tmp_buffer ++ # to catch core dump in libparted/fs/r/fat/count.c flag_traverse_dir() ++ mount "${dev}1" "$mount_point" || fail=1 ++ cat /dev/null > exp ++ ( cd "$mount_point"; for d in `seq 500`; do mkdir TESTDIRR.DIR; cd TESTDIRR.DIR; done ) > out ++ compare exp out || fail=1 # Ensure no errors creating directory tree ++ umount "${dev}1" || fail=1 ++ ++ # Make sure that buffer overflow is caught ++ fs-resize ${dev}1 0 $new_end > out 2>&1 ++ ++ # Include full output for debugging ++ cat out ++ ++ # Confirm that the large dir_name was caught ++ grep "Assertion.*strlen.*flag_traverse_dir" out || fail=1 ++ ++ # Remove the partition explicitly, so that mklabel doesn't evoke a warning. ++ parted -s $dev rm 1 || fail=1 ++ ++ # Create a clean partition table for the next iteration. ++ parted -s $dev mklabel gpt > out 2>&1 || fail=1 ++ # expect no output ++ compare /dev/null out || fail=1 ++ ++done ++ ++Exit $fail diff -Nru parted-3.6/debian/patches/series parted-3.6/debian/patches/series --- parted-3.6/debian/patches/series 2025-02-23 17:39:45.000000000 +0000 +++ parted-3.6/debian/patches/series 2026-10-01 02:09:27.000000000 +0000 @@ -12,3 +12,4 @@ probe-lvs-again.patch link-libuuid.patch gcc-15.patch +CVE-2026-89088.and.CVE-2026-89085.patch