vmd(8): reject empty IMSG_VMDOP_LOAD messages from clients.
Reject empty values (either zero bytes or a single NUL) to prevent
zero-sized allocations, out-of-bounds write of a NUL byte, and
incorrectly triggering a reload event.
Report and original diff by Andrew Griffiths.
ok hshoexer@, mlarkin@
astromenace: mark BROKEN-sparc64. Build hangs for hours.
KILLED: games/astromenace(build) stuck at 64% frozen for 8 HOURS!
seen in bulks by claudio and kmos
Limit the range of deltas added to the queue.
Instead of storing all deltas larger then our minimum serial number
store only deltas that are either in the range
[min_serial ... min_serial + MAX_RRDP_DELTAS]
or
[current serial - MAX_RRDP_DELTAS ... current serial]
where current serial is the newest announced RRDP serial.
The two ranges normally overlap but if they don't then it limits the
number of elements in the delta queue to 2 * MAX_RRDP_DELTAS.
The first range is used to validate the hashes stored in the RRDP state
file against the notification.xml contents. The second range covers the
deltas we are willing to walk to sync the repo -- it also is the new set
of delta hashes that will be stored in the state file.
Reported by Xin Wang
OK tb@
Adjust bad_addr to also validate that the prefixlen uses a sensible value.
Someone found a way to push a bad prefixlen into a eigrp datagram and that
results in an overflow since the prefixlen is used to know how much data
to use.
This was sitting in my tree for too long
update to ugrep-7.8.3, from Brad
lzma patch was synced upstream, configure.ac no longer relevant
tested on aarch64, amd64 and i386 - also is likely to fix build on armv7
update to ergo-2.19.1, from Lydia Sobot (maintainer)
- Fixed users being able to bypass account email verification or account
suspension
- Fixed incorrect permissions controls for message redaction
- Fixed blind SSRF attacks against internal IPs via webpush extension
rpc: fix the svc_request() dispatch() callback signature
The prototype in rpc/svc.h already has the correct signature. Match this
in the function definition, the sc_dispatch() member in struct svc_callout,
and in the manual, fixing the documented return type from int to void in
one place.
ok claudio
