[Buildroot] [PATCH v2 for 2025.02.x 13/15] package/clamav: add patch for CVE-2026-20346

[Titouan Christophe]

Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
---
 ...guard-pdf-hex-string-newline-skip-98.patch | 36 +++++++++++++++++++
 package/clamav/clamav.mk                      |  3 ++
 2 files changed, 39 insertions(+)
 create mode 100644 package/clamav/0012-libclamav-guard-pdf-hex-string-newline-skip-98.patch

diff --git a/package/clamav/0012-libclamav-guard-pdf-hex-string-newline-skip-98.patch b/package/clamav/0012-libclamav-guard-pdf-hex-string-newline-skip-98.patch
new file mode 100644
index 0000000000..41607a82ee
--- /dev/null
+++ b/package/clamav/0012-libclamav-guard-pdf-hex-string-newline-skip-98.patch
@@ -0,0 +1,36 @@
+From: "Val S." <valsnyde at cisco.com>
+Date: Tue, 28 Jul 2026 09:05:37 -0400
+Subject: Libclamav: guard PDF hex string newline skip (#98)
+
+The PDF hex-string reader skips newlines immediately after the opening
+angle bracket. A malformed string can consume the remaining bounded input
+before the parser searches for the closing bracket.
+
+Return early when the bounded length is exhausted so the parser does not
+pass an underflowed length to memchr().
+
+Reported-by: Tristan (@TristanInSec)
+
+CLAM-3002
+
+---
+Upstream: https://github.com/Cisco-Talos/clamav/commit/354f71e192168b6c966c4d15122b455cbb2d6ecb
+CVE: CVE-2026-20346
+Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
+---
+ libclamav/pdf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/libclamav/pdf.c b/libclamav/pdf.c
+index 51b97a0a17..7769a6a6ec 100644
+--- a/libclamav/pdf.c
++++ b/libclamav/pdf.c
+@@ -2680,6 +2680,8 @@ static char *pdf_readstring(const char *q0, int len, const char *key, unsigned *
+             start = ++q;
+             len -= 1;
+         }
++        if (len <= 0)
++            return NULL;
+         q = memchr(q + 1, '>', len - 1);
+         if (!q)
+             return NULL;
diff --git a/package/clamav/clamav.mk b/package/clamav/clamav.mk
index a70ac71b02..aa63dbc23b 100644
--- a/package/clamav/clamav.mk
+++ b/package/clamav/clamav.mk
@@ -54,6 +54,9 @@ CLAMAV_IGNORE_CVES += CVE-2026-20345
 # 0011-libclamav-fix-pespin-rebuilt-section-size-overflow-101.patch
 CLAMAV_IGNORE_CVES += CVE-2026-20339
 
+# 0012-libclamav-guard-pdf-hex-string-newline-skip-98.patch
+CLAMAV_IGNORE_CVES += CVE-2026-20346
+
 CLAMAV_DEPENDENCIES = \
 	bzip2 \
 	host-pkgconf \
-- 
2.55.0