BSD Commit Log Search

   net/netpipes - unbreak build on llvm 22

   Distfile has been moved. Feedback from tb@

   Update to libxkbcommon-1.13.2.

   Update to libical-4.0.2.

   Update to netatalk-4.5.0.

   Update to libgphoto-2.5.34.

   www/sope: fix build with llvm 22

   change some types to fix -Wincompatible-pointer-types warnings turned
   errors with 22, and put a -Wno-error=incompatible-pointer-types on the
   one i have no idea how to fix. Objective-C definitely is a weird language...

   avoid strlen(NULL) crash if an X11 channel was created before the
   x11-req SSH_MSG_CHANNEL_REQUEST was sent. Reported by Ben Perry via
   GHPR679

   DNS0x20[1] can randomise the case of domain names returned by lookup
   to force some more uniqueness in queries to reduce the likelihood
   of spoofing attacks succeeding.

   Normally this should be hidden from the user by the resolver, but
   in some cases it can leak through. When it does, it can mess up
   ssh's CanonicalizePermittedCNAMEs.

   Fix this by forcing the name we received from the system resolver to
   lowercase.

   bz3966, report and fix by Martin D Kealey

   [1] https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00

   Update clementine to 1.4.1pl76

   geo/qgis: update to 4.0.3

   disallow use of the copy-data extension to read and write to
   the same inode simultaneously; reported by Qifan Zhang of Palo
   Alto Networks; ok markus@

   Fix two separate one-byte out-of-cound reads

   1) if a server sent an empty reply to a SSH2_FXP_REALPATH request
   2) if a batch command used the full 2048 byte buffer but ended in a
      literal backslash character

   Both reported by Zhenpeng (Leo) Lin from depthfirst

   ok markus@

   DisableForwarding=yes didn't override PermitTunnel=yes

   Reported independently by Huzaifa Sidhpurwala of Redhat and Marko
   Jevtic; ok markus@

   make the transport protocol stricter by disconnecting if the peer
   sends non-KEX messages during a key re-exchange.

   Previously an evil peer could continue sending non-KEX messages
   without penalty, causing memory to be wasted up until the
   connection terminated or the server/client hit a OOM limit.

   reported by Marko Jevtic; ok markus@

   stricter validation of the transport state passed from the
   unprivileged preauth sshd-auth process to the user-privileged
   postauth sshd-session process.

   These are harmless unless an attacker had an exploit for sshd-auth
   in which case they could be used for post-auth memory DoS or to
   crash you own session in a new and exciting way.

   Reported by bylee3 and Kayky Vinicius

   ok markus

   Enforce a maximum size for usernames in agent key use constraints

   Along with the match_pattern() performance change that was just
   committed this avoids a denial-of-service where an agent client could
   waste CPU on an agent by sending user constraints with lots of
   wildcards.

   Reported by Huzaifa Sidhpurwala of Redhat

   ok markus

   fix client use-after-free on error path if cipher_init() fails;
   reported by Qualys Security Advisory Team, ok markus@

   flesh out match_pattern() tests, including a new comparison test of
   the new NFA-based implementation against the original one for all
   possible combinations of short inputs and patterns constructed from
   a small dictionary of possibilities.

   Replace the old recursive match_pattern() with an implementation
   that uses a NFA for matching. This avoids the exponential worst-
   case behaviour for the old implementation.

   ok markus@

   unbreak build on llvm 22

   fix build with llvm22, thanks to tb@ who figured this out

   unbreak build on llvm 22

   unbreak build on llvm 22

   - take maintainer
   - update to 2.3.1
   - remove duplicate index.html from DOCS1

   sysutils/whowatch: fix build with llvm22

   Fix a type error in a configure snippet that broke with LLVM 22.
   While here, sync up some prototypes to eliminate a slew of warnings.

   update mboxgrep to 0.7.13

   still builds on llvm 22, but project has switched from pcre to pcre2.

   unbreak build on llvm 22 by updating to git head

   audio/libgpod: llvm22 build fix, from Ariadne Conill via Alpine Linux

   Fix build with llvm 22.

   mlt7: add clang-module like the other clang-scan-deps consumers

   Building with the newer nettle, aide now also needs stdalign.h

   Move to ports-gcc on sparc64 to fix the build