[Buildroot] [git commit branch/2025.11.x] package/rtl_433: add patch for CVE-2025-34450

[Thomas Perale]

commit: https://gitlab.com/buildroot.org/buildroot/-/commit/ea81b023e82dfc4f4232a0e21bb12e1a49803065
branch: https://gitlab.com/buildroot.org/buildroot/-/tree/2025.11.x

Fixes the following vulnerability:

- CVE-2025-34450:
    merbanan/rtl_433 versions up to and including 25.02 and prior to
    commit 25e47f8 contain a stack-based buffer overflow vulnerability in
    the function parse_rfraw() located in src/rfraw.c. When processing
    crafted or excessively large raw RF input data, the application may
    write beyond the bounds of a stack buffer, resulting in memory
    corruption or a crash. This vulnerability can be exploited to cause a
    denial of service and, under certain conditions, may be leveraged for
    further exploitation depending on the execution environment and
    available mitigations.

For mroe information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-34450
  - https://github.com/merbanan/rtl_433/commit/25e47f8932f0401392ef1d3c8cc9ed5595bc894a

Signed-off-by: Thomas Perale <thomas.perale at mind.be>
Signed-off-by: Julien Olivain <ju.o at free.fr>
(cherry picked from commit 76135019544058a282ceed87e10e5d5e03ca5558)
Signed-off-by: Thomas Perale <thomas.perale at mind.be>
---
 ...2-Fix-overflow-in-rfraw-test-data-parsing.patch | 31 ++++++++++++++++++++++
 package/rtl_433/rtl_433.mk                         |  3 +++
 2 files changed, 34 insertions(+)

diff --git a/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch b/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch
new file mode 100644
index 0000000000..6446fea0ab
--- /dev/null
+++ b/package/rtl_433/0002-Fix-overflow-in-rfraw-test-data-parsing.patch
@@ -0,0 +1,31 @@
+From 25e47f8932f0401392ef1d3c8cc9ed5595bc894a Mon Sep 17 00:00:00 2001
+From: "Christian W. Zuckschwerdt" <christian at zuckschwerdt.org>
+Date: Wed, 8 Oct 2025 10:11:15 +0200
+Subject: [PATCH] Fix overflow in rfraw test data parsing (closes #3375)
+
+CVE: CVE-2025-34450
+Upstream: https://github.com/merbanan/rtl_433/commit/25e47f8932f0401392ef1d3c8cc9ed5595bc894a
+Signed-off-by: Thomas Perale <thomas.perale at mind.be>
+---
+ src/rfraw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/rfraw.c b/src/rfraw.c
+index 9f4c9780c..71a1c365d 100644
+--- a/src/rfraw.c
++++ b/src/rfraw.c
+@@ -159,9 +159,14 @@ static bool parse_rfraw(pulse_data_t *data, char const **p)
+             data->num_pulses++;
+             pulse_needed = true;
+         }
++        // abort reading if the pulse data array is full
++        if (data->num_pulses >= PD_MAX_PULSES) {
++            break;
++        }
+     }
+     //data->gap[data->num_pulses - 1] = 3000; // TODO: extend last gap?
+ 
++    // expand reapeats as long as the pulse data array has enough space
+     unsigned pkt_pulses = data->num_pulses - prev_pulses;
+     for (int i = 1; i < repeats && data->num_pulses + pkt_pulses <= PD_MAX_PULSES; ++i) {
+         memcpy(&data->pulse[data->num_pulses], &data->pulse[prev_pulses], pkt_pulses * sizeof (*data->pulse));
diff --git a/package/rtl_433/rtl_433.mk b/package/rtl_433/rtl_433.mk
index 08735be850..fc6c2bece2 100644
--- a/package/rtl_433/rtl_433.mk
+++ b/package/rtl_433/rtl_433.mk
@@ -10,6 +10,9 @@ RTL_433_LICENSE = GPL-2.0+
 RTL_433_LICENSE_FILES = COPYING
 RTL_433_CPE_ID_VALID = YES
 
+# 0002-Fix-overflow-in-rfraw-test-data-parsing.patch
+RTL_433_IGNORE_CVES += CVE-2025-34450
+
 # Force Release build to remove ASAN.
 RTL_433_CONF_OPTS = \
 	-DCMAKE_BUILD_TYPE=Release \