Backport security fixes from zlib 1.4
From the 9 security fixes listed in
https://github.com/madler/zlib/releases/tag/v1.4
we already have the fix for CVE-2026-85091 in 8.0.
The remaining 8 of these are cherry-picked here for userland, 6 of which
also affect the kernel. That required a bit of fiddling due to our patches
(#ifdef SMALL, size for ZFREE in the kernel).
There is an oob write of 32k and various other oob accesses, some info
leaks and a cloexec carelessness.
from tb@; looks good to deraadt@
In detail this is:
deflate.c, hunks 1 and 2:
[111 lines not shown]
Backport security fixes from zlib 1.4
From the 9 security fixes listed in
https://github.com/madler/zlib/releases/tag/v1.4
we already have the fix for CVE-2026-85091 in 8.0.
The remaining 8 of these are cherry-picked here for userland, 6 of which
also affect the kernel. That required a bit of fiddling due to our patches
(#ifdef SMALL, size for ZFREE in the kernel).
There is an oob write of 32k and various other oob accesses, some info
leaks and a cloexec carelessness.
from tb@; looks good to deraadt@
In detail this is:
deflate.c, hunks 1 and 2:
[111 lines not shown]
Backport security fixes from zlib 1.4
From the 9 security fixes listed in
https://github.com/madler/zlib/releases/tag/v1.4
we already have the fix for CVE-2026-85091 in 8.0.
The remaining 8 of these are cherry-picked here for userland, 6 of which
also affect the kernel. That required a bit of fiddling due to our patches
(#ifdef SMALL, size for ZFREE in the kernel).
There is an oob write of 32k and various other oob accesses, some info
leaks and a cloexec carelessness.
from tb@; looks good to deraadt@
In detail this is:
deflate.c, hunks 1 and 2:
[111 lines not shown]
zlib: fix buffer overwrite in non-blocking gzwrite
Upstream commit df84af25
from tb@
Backport security fixes from zlib 1.4
From the 9 security fixes listed in
https://github.com/madler/zlib/releases/tag/v1.4
we already have the fix for CVE-2026-85091 in 8.0.
The remaining 8 of these are cherry-picked here for userland, 6 of which
also affect the kernel. That required a bit of fiddling due to our patches
(#ifdef SMALL, size for ZFREE in the kernel).
There is an oob write of 32k and various other oob accesses, some info
leaks and a cloexec carelessness.
from tb@; looks good to deraadt@
In detail this is:
deflate.c, hunks 1 and 2:
commit 1e4178b27f458904d3d2e2256a831708912e8b1a
Author: Jason Gross <jason at theorem.dev>
Date: Mon Nov 2 20:43:28 2026 +0000
[73 lines not shown]
Use client source port instead of remote proxy port to unbreak PROXY sending
https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
2.1. Human-readable header format (Version 1)
A valid v1 header for 2001:db8::1/1234 to example.com/80 would be
PROXY TCP6 2001:db8::1 2606:4700:10::6814:179a 1234 80
but "forward to ... port 3128 proxy-protocol v1" would send
PROXY TCP6 2001:db8::1 2606:4700:10::6814:179a 1234 3128
Fix both v1 and v2; tested against HAProxy "bind ... accept-proxy".
"ok christoph" (code author)
OK op
ec_curve_tables: silence a noisy MSVC warning
Explicitly clear the upper bits of n0 on LP32 so that we don't see
D:\a\portable\portable\crypto\ec\ec_curve_tables.h(1310,8): warning C4310: cast truncates constant value [D:\a\portable\portable\build\crypto\crypto_obj.vcxproj]
(compiling source file '../../crypto/ec/ec_curve.c')
on (almost?) every line using EC_CURVE_N0() on 32-bit Windows.
Portable regress is happy: https://github.com/libressl/portable/pull/1464
ok beck
automatically load the DTB for the new Qualcomm based
Thinkpad T14s Gen 7 and Yoga Slim laptops.
Also add the 32bit DMA limit for the newer gen systems.
OK kettenis@ tobhe@
simplify fetchname
it's a bit too complex and prevents further changes to this routine.
divide the "path extraction" from the stripping.
survived a bulk build by kirill@, thanks!
okay kirill@
8 years ago, I had a brainfart moment and put an mbuf pkthdr flag into
m_pkthdr.pf.tag instead of m_pkthdr.pf.flags - and nobody noticed, until
acts-1631 came. fix it. ok sashan
freeradius: disable setting of X509_V_FLAG_USE_DELTAS
beck is going to throw an error in the verifier if that flag is set, so it
is no longer harmless to set it.
ok sthen (maintainer)
