fw_update: Make tar skip files outside expected locations
tar(1) strips ".." path components, but this happens after globbing is
applied to the file parameter. This meant tar's -s replacements and the
file parameter examined different strings, meaning a specially
constructed archive could write outside the expected locations. Use
tar's documented order of -s expressions to skip everything else.
Update to 2026dgtz from https://github.com/JodaOrg/global-tz
o Canada’s Northwest Territories moved to permanent -06 on 2026-08-21.
o Obsolescent settings like TZ="EST5EDT" now conform better to POSIX.
o Colombia’s 1992-05-02 spring forward was at 00:00, not 24:00.
o Iran’s 1979-05-26 spring forward was at 00:00, not 24:00.
Check alignment of certificate CRLDPs with the CRLDP of the referring Manifest
RFC 6480, section 4.2, figure 2 illustrates how all valid products in
the same CA repository (i.e., from the same issuer, listed on the same
manifest) will point to the same CRL. For CRLDPs in manifest EE certs
alignment was already checked against the CRL location derived from
the fileList in a given manifest's eContent. Add a check to explicitly
confirm internally consistent CRLDPs in certificates as well.
OK tb@
tls_verify: do not assume ASN1_STRINGs are strings
OpenSSL 4.1 no longer NUL terminates ASN.1 strings. This is fine per se,
but the fact that they don't mention this major breaking change in their
overlong CHANGES.md is crazy. Who reads the migration guide for an update
that's supposedly backward compatible? This will cause buffer overreads
left and right.
To wit, strlen(data) is a buffer overread, so use strnlen() instead.
While it is probably possible to rewrite tls_match_name() to cope with a
bag of bytes, it gets really hairy (I think it is already hairier than
all the yaks in Tibet combined). So use the lazy way and strndup(), then
we have a string and do not need to mess with this horrible byte bashing.
The other caller of tls_match_name() already passes a string.
As jsing points out, CBS_strndup() would be the right way to fix this.
ok kenjiro jsing
rpki-client: do not provide IPAddrBlocks_{new,free}() unconditionally
After sitting on the issue for over four years, a last-minute addition to
OpenSSL 4.1 provided a somewhat incorrect version of IPAddrBlocks_new(),
and versions of IPAddrBlocks_free() ith i2d and d2i and the ASN.1 item.
Until LibreSSL provides the corresponding functions, we need this compat
code in base. After that the rfc3779.c file can move to portable where it
really belongs.
With this the rpki-client code is ready for OpenSSL 4.1, provided it uses
a fixed version of lib(re)tls.
ok claudio
rpki-client: fix valid_uri() to work with non-strings
valid_uri() takes a length parameter and should honor that. Most uris
passed are NUL terminated, but the ones coming from an ASN1_STRING are
not guaranteed to be. Calling strstr() on a non-terminated string with
no match is a buffer overread. So use memmem() instead.
This is needed for rpki-client to work with OpenSSL 4.1, who, in their
infinite disregard for downstreams chose to stop NUL-terminating ASN.1
strings. A massive breaking change in a minor release that will surely
cause lots of buffer overreads. It's also not mentioned in CHANGES.md,
only in their terrible migration guide. Of course it's been documented
since forever, but who reads OpenSSL's crappy documentation anyway?
ok claudio
Add a test, disabled for now, that tests $ORIGIN works when a program
is executed by a search of the PATH. Additional tests are needed for
other cases. okay deraadt@
Enable jumbo frames in ogx(4)ogx(4) already handles buffer chaining. Raise the MTU limit to enable
the use of jumbo frames.
Use the same maximum MTU as cnmac(4). The limit 12288 (0x3000) is
somewhat arbitrary. It could be even higher, but it is already
higher than what many other network devices are capable of.
when expanding variables with the raw modifier, apply a filtering in
both environment and mda to restrict the characters that are allowed
to pass through.
spotted by squishification at gmail.com
from gilles@
this is errata/7.9/015_smtpd.patch.sig
when expanding variables with the raw modifier, apply a filtering in
both environment and mda to restrict the characters that are allowed
to pass through.
spotted by squishification at gmail.com
from gilles@
this is errata/7.8/051_smtpd.patch.sig
when expanding variables with the raw modifier, apply a filtering in
both environment and mda to restrict the characters that are allowed
to pass through.
spotted by squishification at gmail.com
As suggested by deraadt@, split execvp(3) out of execv(3),
since the two groups of functions are sufficiently different and
the semantics and error handling of the *p* functions is sufficiently
complicated to make the combined manual page confusing.
In particular, the early sentence about "the initial argument"
was outright wrong and hard to fix without causing other problems.
This commit only does the minimum required for the split,
with no text changes yet, but it will allow subsequent improvements
in both pages.
Rather than allowing floating panes to remain outside the window and
invisible after resize, move them and resize them so they are fully
inside the window. GitHub issue 5582 from Noam Stolero.
rpki-client: change return 0 to goto out
This turns cms_parse_validate() into a single exit function and fixes
a return 0 that should have been return NULL since the last commit.
correct dma_tag_lookup() loop
drm_cd.cd_ndevs[] has pointers to drm_softc not drm_device
Currently, dma_tag_lookup() is only used by the apldcp/apldrm drivers.
At the start of the softc for both of those is struct platform_device.
If the loop doesn't match the the function argument is cast to
struct platform_device *, so the problem was not noticed.
discussed with kettenis@ and apldcp/apldrm tested on m1 mac mini
only allow an NFS server to set file type on a new vnode
Otherwise, a malicous server could aid a local user in avoiding access
controls.
This reverts nfs_subs.c rev 1.3. Which was part of a commit to fix the
use of automount with direct maps.
reported by Andrew Griffiths
from jsg@
this is errata/7.9/016_nfs.patch.sig
only allow an NFS server to set file type on a new vnode
Otherwise, a malicous server could aid a local user in avoiding access
controls.
This reverts nfs_subs.c rev 1.3. Which was part of a commit to fix the
use of automount with direct maps.
reported by Andrew Griffiths
from jsg@
this is errata/7.8/052_nfs.patch.sig
Clamp numeric arguments of terminal escape sequences to an arbitrary value of
100,000. The existing logic would happily process as many digits as provided,
which could make the values wraparound at 2**32, or be considered as negative
values if cast to a signed type, leading to incorrect processing.
Bug report by Acts1631.
from miod@
this is errata/7.9/017_wscons.patch.sig
Clamp numeric arguments of terminal escape sequences to an arbitrary value of
100,000. The existing logic would happily process as many digits as provided,
which could make the values wraparound at 2**32, or be considered as negative
values if cast to a signed type, leading to incorrect processing.
Bug report by Acts1631.
from miod@
this is errata/7.8/053_wscons.patch.sig
sys/uvm: validate anonymous object pager requests
uao_get() trusts the requested page range before allocating pages and
looking up swap slots; an invalid request can therefore allocate a page
outside the object and read beyond its swap slot array. Validate the
request before page lookup or allocation, preserving optional fault
clustering at the object boundary.
Reject nonpositive page counts and starting page indices outside the
object; require the entire range for PGO_ALLPAGES, or a centeridx within
both the request and the object otherwise. Compare against the remaining
page count in voff_t and derive pageidx from the validated firstpage,
avoiding overflow in the bounds check and unchecked narrowing.
Reported by Andrew Griffiths, thanks!
from kirill@; OK kettenis@
this is errata/7.9/018_shmat.patch.sig
