Backport security fixes from zlib 1.4
From the 9 security fixes listed in
https://github.com/madler/zlib/releases/tag/v1.4
we already have the fix for CVE-2026-85091 in 8.0.
The remaining 8 of these are cherry-picked here for userland, 6 of which
also affect the kernel. That required a bit of fiddling due to our patches
(#ifdef SMALL, size for ZFREE in the kernel).
There is an oob write of 32k and various other oob accesses, some info
leaks and a cloexec carelessness.
looks good to deraadt
In detail this is:
deflate.c, hunks 1 and 2:
[109 lines not shown]
x11/xfce4/xfce4.port.mk: migrate SITES_GIT to DIST_TUPLE
easily allows to test ports from random XFCE_COMMIT upstream hashes.
Point SITES.gitlab at https://gitlab.xfce.org.
no port in the portstree uses XFCE_COMMIT anyway.
x11/xfce4/xfce4.port.mk: only do the autogen.sh dance if CONFIGURE_STYLE != meson
will allow meson ports to use XFCE_COMMIT, and anyway autohell will
slowly disappear from all xfce ports..
Remove the byte copies of the built-in curve parameters
The built-in curve parameters are now in two places, in ec_curve.c
as byte strings and in ec_curve_tables.h as the static groups.
ec_curve_list now holds only each curve's comment, NID and static
group. ec_group_is_builtin_curve() compares a group with the static
groups using EC_GROUP_cmp() and the seed, instead of comparing byte
encodings.
ok tb@
Make the built-in EC groups copies of static templates
So while beating on the cost of decoding X509 certificates and
attempting to find out where things were expensive. P256 lept out
and bit me. It was appallingly slower to deal with a P256 public
key than other things. and it was dominating the cost of an X509
parse, due to it rolling the group from scratch, every time.
Building a built-in group at runtime was most of the cost of decoding
an EC key, which hits every EC key in libcrypto and libssl, including
certificate keys and ECDHE.
So of course I looked at Boring, which made everything static.
EC_GROUP_new_by_curve_name() now copies a static EC_GROUP whose curve
parameters, Montgomery context and generator are precomputed constants
shared by every copy. The constants have 64-bit and 32-bit word
versions. EC_GROUP_free() leaves the shared data alone, EC_GROUP_dup()
of a built-in group copies only the group itself, and
[28 lines not shown]
