x509_verify: cache extensions before allocating chain
Avoid allocating current_chain before extension caching can fail, so the
failure path needs no chain cleanup.
Drop the misleading OUT_OF_MEM error assignment. The common error path
supplies UNSPECIFIED.
pointed out by tb@
ok tb@ beck@
update to 1.30.6; fixes multiple CVEs; from Mark Patruck
- buffer overflow vulnerability when using alias with rewrite
(CVE-2026-15176)
- buffer overflow vulnerability when evaluating string expressions
with variables (CVE-2026-93479)
- request body injection vulnerability in HTTP/3 (CVE-2026-95101)
- session forgery vulnerability when using TLS session ticket key
rotation (CVE-2026-97629)
- use-after-free vulnerability when using ngx_http_ssi_module with
AIO (CVE-2026-97205)
update to 1.30.6; fixes multiple CVEs; from Mark Patruck
- buffer overflow vulnerability when using alias with rewrite
(CVE-2026-15176)
- buffer overflow vulnerability when evaluating string expressions
with variables (CVE-2026-93479)
- request body injection vulnerability in HTTP/3 (CVE-2026-95101)
- session forgery vulnerability when using TLS session ticket key
rotation (CVE-2026-97629)
- use-after-free vulnerability when using ngx_http_ssi_module with
AIO (CVE-2026-97205)
privdrop to _ypbind. The late use of daemon() until YP binding succeeds
(to wait in the rc script, but also allow ^C if the admin wants to fix
a mess) was a problem. Now it opens a pipe[], forks the parent which
does half of daemon up front, the remaining parts happen upon binding
success. If the parent gets tty signals, it must forward to the child
who has already called setsid(). unveils and pledges have been moved around.
tested by jmatthew
uhidev: the report size when doing USB_GET_REPORT could exceed the size
of ucr_data. Check that report size doesn't exceed ucr_data, preventing
heap overflow. Also for USB_SET_REPORT.
From Acts1631
"looks correct" deraadt@
