From e89f7be0853836908226e1df746fe07ef7c46769 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Tue, 21 Apr 2026 13:16:10 -0700 Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20infloop=20on=20null=20ranges?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Problem reported by Michał Majchrowicz. * src/patch.c (locate_hunk): Don’t attempt to optimize matches of a null range. Instead, apply all the checks we apply to non-null ranges. CVE: CVE-2026-56289 Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9] (cherry picked from commit faba04ef4f2b410257f76c1b9dc85e350929c4b9) Signed-off-by: Hetvi Thakar --- src/patch.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/patch.c b/src/patch.c index e4d0524..1e7dfdc 100644 --- a/src/patch.c +++ b/src/patch.c @@ -1166,9 +1166,6 @@ locate_hunk (idx_t fuzz) ptrdiff_t max_offset = MAX (max_pos_offset, max_neg_offset); ptrdiff_t min_offset; - if (!pat_lines) /* null range matches always */ - return first_guess; - /* Do not try lines <= 0. */ if (first_guess <= max_neg_offset) max_neg_offset = first_guess - 1;