Update to py3-rapidfuzz 3.14.6 from Chris Billingtom
## Fixed
* fix some divergences in the pure Python fallback
* fix compatibility with new Cython versions
* fixed potential out of bound access inside Editops.remove_subsequence
* fixed handling python fallback implementation of Editops.remove_subsequence
## Removed
* dropped support for Python 3.10
* dropped wheels for experimental Python 3.13 free threaded
www/librewolf: assorted port improvements, from Leah Rowe (MAINTAINER)
- sync policies.json with the one from www/mozilla-fireofx
- patch upstream mozconfig instead of maintaining a custom one in files/
should make future maintainance easier.
sys: avoid script pathname TOCTOU in exec
A readable script pathname is read twice during exec: namei() copies the
user string for vnode lookup, while exec_script_makecmds() later copies
the same user address into the synthetic interpreter argument list. The
preceding single_thread_set() excludes sibling threads from this window;
a separate process sharing writable MAP_SHARED memory remains able to
modify the pathname between reads.
The failing sequence is:
1. Setup: a process stores pathname A in writable MAP_SHARED memory and
calls fork(); the parent and child retain mappings of the same VM
object.
2. Check: the parent calls execve(2); namei() copies pathname A and
resolves vnode A, after which check_exec() verifies execution access
and reads the script header.
3. Mutation: after namei() copies A but before the script handler
rereads the user address, the child stores pathname B through its
[15 lines not shown]
PKCS7_stream: avoid out of bounds access
The inner content of SignedData is represented by a PKCS7 object, which
PKCS7_stream() assumes to be a plain data object and will thus access its
content via an ASN1_OCTET_STRING. This need not be the case after parsing.
In fact, the inner content type is essentially arbitrary.
If the inner content isn't one of the explicitly supported content types,
the fallback (via p7default_tt) will populate the union's d.other with an
ASN1_ANY which unravels to ASN1_TYPE_new() deep in the guts of tasn_dec,
allocating a 16-byte object on LP64 architectures. In that case, the
16-byte object is interpreted as an 24-byte ASN1_OCTET_STRING and if it
isn't NULL, the read+write to os->flags (a long at offset 16) is out of
bounds: os->flags | ASN1_STRING_FLAG_NDEF;
Add a check that the content is actually id-data before accessing the
d.data union member.
From Acts1631
Add test case causing an OOB access in PKCS7_stream
Test case originally from openssl/openssl#31681, exercised via a direct
call to PKCS7_stream() as in a report from Acts1631.
To be fixed in pk7_lib.c r1.33
PKCS7_stream: don't crash on omitted content
Do not access the PKCS7 content union without checking that it's actually
populated. Add NULL checks and fail. Whether that's the correct thing
to do is dubious, but since this has been broken since the "code" was
written a quarter century ago, clearly nobody ever wanted to do that.
Match OpenSSL behavior which also means more NULL checks than strictly
make sense.
CMS_stream() has very similar code, but it's not problematic in this
particular way because the content isn't OPTIONAL.
Part of a diff from Acts1631