Use unsigned int for the length variable when traversing the others array.
Doing this in all places now after fixing an overflow in attr_optadd().
OK tb@ deraadt@
More new QML dependencies
ecm_find_qmlmodule(org.kde.prison REQUIRED)
ecm_find_qmlmodule(org.kde.kitemmodels REQUIRED)
ecm_find_qmlmodule(org.kde.kcmutils REQUIRED)
Spotted by tb (again), thanks
A collection of AI-assisted reports come from Frank Denis, which says that
the YP getgrent code when doing YP operations has a group of buffer
mismanagement issues which in the reports are labelled 'high severity'.
This fixes the buffer checks.
The big question to ask is this: Is a malicious YP server going to
send you messages that exercise a buffer overflow codepath, or are
they going to send you perfectly correct messages containing wrong group members?
The old-school ypserv model was that you run ypserv on a "trusted network"
segment, which today is laughable but it matched operations in that era.
(Our) new operational model is that ypbind is reached with a custom system call
and provides trusted path to a an on-host ypserv, which is more likely to be
the ypldap(8) LDAP schema to YP protocol converter.
If a YP server is broken and sending bad messages, THIS code is the least
of your worries. High severity? No.
ok millert jmatthew
A collection of AI-assisted reports come from Frank Denis, which says that
the YP getpwent code when doing YP operations has a group of buffer
mismanagement issues which in the reports are labelled 'high severity'.
This fixes the buffer checks.
In reality, the memory being operated on is always a full page so the
overflow onto unmanagement memory is hard to see as a risk.
The big question to ask is this: Is a malicious YP server going to
send you messages that exercise a buffer overflow codepath, or are
they going to send you perfectly correct messages containing :0:0: ?
The old-school ypserv model was that you run ypserv on a "trusted network"
segment, which today is laughable but it matched operations in that era.
(Our) new operational model is that ypbind is reached with a custom system call
and provides trusted path to a an on-host ypserv, which is more likely to be
the ypldap(8) LDAP schema to YP protocol converter.
If a YP server is broken and sending bad messages, THIS code is the least
of your worries. High severity? No.
ok millert jmatthew
In session_graceful_restart() also arm the SessionDown timer
session_graceful_restart() does more or less the same as session_down()
and therefor needs to arm the SessionDown timer and on top of that
update stats.last_updown. The interval for the SessionDown timer needs
to depend on the graceful restart timer, since that one needs to fire
first.
OK tb@
net/wormhole-willian: update to version 1.0.8.
Apparently this fixes the riscv64 build also.
Diff from "mischief <mischief at offblast.org>". OK sthen@.
Thanks both.
wayland/fnott: Tweak description
The project homepage advertises that fnott works for *wlroots-based*
Wayland compositors, however it works with others as well
Add checks for invalid dir count and max size for readdir/readdirplus.
A zero count or max size value is now rejected early instead of
relying on VOP_GETATTR to return an error. Also verify that the
max size after rounding up to a multiple of DIRBLKSIZ is positive.
A negative value would turn into a large allocation, causing the
malloc() to fail.
From an LLM bug report. With help from miod@ and kirill@.
from millert@
this is errata/7.7/041_nfs.patch.sig
