news/sabnzbd: Update 5.1.2 => 5.1.3, cleanup dependencies
Changelog:
https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.3
Make some adjustments to the the test behavior so that no more tests
fail. Skips Selenium Tests, Wiki Tests and tests that do not have
necessary files in tarball. Patches permission test that behaves
differently from linux.
Results: 13345 passed, 41 skipped, 28 deselected, 2 xfailed, 1 xpassed,
8 warnings
PR: 298693
Approved by: Nicholas Kirby <nick at kirby.cx> (maintainer, timeout 7+ weeks)
Security: GHSA-q326-jpxx-jmjc
Security: GHSA-mjwj-v5mr-cmcg
Security: GHSA-rgqj-28c2-gxwp
Security: GHSA-75g3-96fr-7p2r
Security: GHSA-xrfq-jhgh-wqch
[5 lines not shown]
news/sabnzbd: Update 5.1.2 => 5.1.3, cleanup dependencies
Changelog:
https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.3
Make some adjustments to the the test behavior so that no more tests
fail. Skips Selenium Tests, Wiki Tests and tests that do not have
necessary files in tarball. Patches permission test that behaves
differently from linux.
Results: 13345 passed, 41 skipped, 28 deselected, 2 xfailed, 1 xpassed,
8 warnings
PR: 298693
Approved by: Nicholas Kirby <nick at kirby.cx> (maintainer, timeout 7+ weeks)
Security: GHSA-q326-jpxx-jmjc
Security: GHSA-mjwj-v5mr-cmcg
Security: GHSA-rgqj-28c2-gxwp
Security: GHSA-75g3-96fr-7p2r
Security: GHSA-xrfq-jhgh-wqch
[3 lines not shown]
x11/nvidia-kmod{-deve]}: Fix loading GSP firmwares for non-legacy variants
Add missing 2 firmware files to x11/nvidia-kmod/pkg-plist
and fixup x11/nvidia-kmod/Makefile not to pick them for
legacy variants that don't have them.
Bumped non-legacy variants only, as pkg for legacy variants
shouldn't be affected with this.
Co-authored by: O. Hartmann
Differential Revision: https://reviews.freebsd.org/D61364
link_elf: bounds-check the DT_HASH offset
parse_dynamic() builds the symbol hash table at ef->address + d_ptr
without checking that d_ptr lies within the mapped image, so a crafted
DT_HASH entry causes an out-of-bounds read of the hash header. Reject
the object with ENOEXEC when the header does not fit in the image.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61323
link_elf_obj: validate section name offsets
A section name offset (sh_name) indexes the section name string table
without being checked against shstrcnt, and the result is passed to
strcmp(), so a corrupt object causes an out-of-bounds read. Check that
the table is NUL-terminated and that every sh_name lies within it, in
both the preload and file paths, and reject the object with ENOEXEC.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61338
link_elf_obj: validate symbol name offsets
A symbol name offset (st_name) indexes the string table in several
places without being checked against ddbstrcnt, so a corrupt object
causes an out-of-bounds read. Check that the string table is
NUL-terminated and that every st_name lies within it, in both the
preload and file paths, and reject the object with ENOEXEC.
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61322
link_elf_obj: bounds-check e_shstrndx in link_elf_load_file()
e_shstrndx is used to index the section header array after only being
checked against zero, so a malformed object can make the linker read up
to about 64K entries past the end of shdr[]. Reject such a file with
ENOEXEC, as link_elf_link_preload() already does.
Reported by: llm-postcr
Reviewed by: kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61321
ipfilter: Remove erroneous ntohs()
The original commit was wrong. ipf_nat_builddivertmp() builds the UDP
template with the length in host byte order
M_DUP() copies that value unchanged. The old code was therefore correct.
It added fin_plen in host order and then did a single htons().
The original patch was discussed with Co-Pilot, which pointed out the
original bug. claude-opus-5-5 discovered the ntohs() error that
co-pilot suggested.
Interestingly this code had been running here for a couple of months.
Reported by: llm-postcr
Fixes: 72cc9e3766f4
ipfilter: Only recalculate the UDP header when we have one
When ipf_nat_out processes NAT_DIVERTOUT (ipnat rdr statements)
it also fixes the checksum in the UDP header. Test for a UDP header
before adjusting its length.
While we are here, the length in the UDP header must be converted
from network byte order to host byte order. Add the missing ntohs().
PR: 296944
MFC after: 3 days
libcasper: Use pdfork() for the zygote
Use pdfork(2) rather than fork(2) to fork the zygote, and close the
descriptor when the main loop terminates.
MFC after: 1 week
Sponsored by: Klara, Inc.
Sponsored by: Qualys, Inc.
Reviewed by: oshogbo
Differential Revision: https://reviews.freebsd.org/D60176
net/libpfctl: add 15.2, remove 15.0
15.0 is end-of-life, remove it from this port.
Add 15.2, which is in the process of being released.
Deliberately do not bump PORTVERSION, because we don't change existing
libpfctl versions, we only add a new supported FreeBSD version.
PR: 300134
Sponsored by: Rubicon Communications, LLC ("Netgate")
pf tests: make return.py more robust
Sometimes ICMP echo packets get lost, so send more than one during
the sanity check. This should resolve the intermittent failure of the
return.py:TestReturn::test_tcp test.
PR: 300511
Sponsored by: Rubicon Communications, LLC ("Netgate")
