BSD Commit Log Search

   Update to dos2unix-7.5.7 from David Uhden Collado.

   Update to py3-astropy-iers-data-0.2026.8.31.0.57.9.

   KNF, mostly spaces

   Do not leak temporary commands when expanding aliases, from Jeong, Heon.

   Do not allow popups for control clients, from Noam Stolero.

   Layout cell can be replaced by unzoom, fixes use after free. From Uzair
   Aftab.

   Do not try to append zero size cells, from Uzair Aftab.

   Clear stale marks when a search regex fails to compile, GitHub issue
   5547 from Uzair Aftab.

   VT100_EMUL_ARG_CLAMP should be 100,000, matching the intent and
   SUN_EMUL_ARG_CLAMP.

   "please fix" miod@

   import shared headers from llvm's libc that will be used by the libcxx update

   Update to py3-rapidfuzz 3.14.6 from Chris Billingtom

   ## Fixed
   * fix some divergences in the pure Python fallback
   * fix compatibility with new Cython versions
   * fixed potential out of bound access inside Editops.remove_subsequence
   * fixed handling python fallback implementation of Editops.remove_subsequence

   ## Removed
   * dropped support for Python 3.10
   * dropped wheels for experimental Python 3.13 free threaded

   Update to exiv2-0.28.9.

   Update to nautilus-50.3.

   Update to libspectrum-1.6.4.

   pkcs7test: missing article

   pkcs7test: add an empty line

   spelling; ok tb@

   Close mtx_wantipl race in mtx_leave

   ok kettenis@, looks correct to deraadt@

   Reported-by: syzbot+bf11bb99176436b58ec5 at syzkaller.appspotmail.com

   spelling; ok dv@

   spelling; ok ratchov@ job@

   spelling; ok tb@

   update ipython to 9.17.0 and drop maintainer

   www/librewolf: assorted port improvements, from Leah Rowe (MAINTAINER)

   - sync policies.json with the one from www/mozilla-fireofx
   - patch upstream mozconfig instead of maintaining a custom one in files/

   should make future maintainance easier.

   sys: avoid script pathname TOCTOU in exec

   A readable script pathname is read twice during exec: namei() copies the
   user string for vnode lookup, while exec_script_makecmds() later copies
   the same user address into the synthetic interpreter argument list. The
   preceding single_thread_set() excludes sibling threads from this window;
   a separate process sharing writable MAP_SHARED memory remains able to
   modify the pathname between reads.

   The failing sequence is:

   1. Setup: a process stores pathname A in writable MAP_SHARED memory and
      calls fork(); the parent and child retain mappings of the same VM
      object.
   2. Check: the parent calls execve(2); namei() copies pathname A and
      resolves vnode A, after which check_exec() verifies execution access
      and reads the script header.
   3. Mutation: after namei() copies A but before the script handler
      rereads the user address, the child stores pathname B through its

    [15 lines not shown]

   add lua 5.5 support

   ok sthen@

   lua 5.4: do what it says on the tin

   import lua 5.5 which will be needed for Hyprland

   ok sthen@

   PKCS7_stream: avoid out of bounds access

   The inner content of SignedData is represented by a PKCS7 object, which
   PKCS7_stream() assumes to be a plain data object and will thus access its
   content via an ASN1_OCTET_STRING. This need not be the case after parsing.
   In fact, the inner content type is essentially arbitrary.

   If the inner content isn't one of the explicitly supported content types,
   the fallback (via p7default_tt) will populate the union's d.other with an
   ASN1_ANY which unravels to ASN1_TYPE_new() deep in the guts of tasn_dec,
   allocating a 16-byte object on LP64 architectures. In that case, the
   16-byte object is interpreted as an 24-byte ASN1_OCTET_STRING and if it
   isn't NULL, the read+write to os->flags (a long at offset 16) is out of
   bounds: os->flags | ASN1_STRING_FLAG_NDEF;

   Add a check that the content is actually id-data before accessing the
   d.data union member.

   From Acts1631

   Add test case causing an OOB access in PKCS7_stream

   Test case originally from openssl/openssl#31681, exercised via a direct
   call to PKCS7_stream() as in a report from Acts1631.
   To be fixed in pk7_lib.c r1.33

   PKCS7_stream: don't crash on omitted content

   Do not access the PKCS7 content union without checking that it's actually
   populated. Add NULL checks and fail. Whether that's the correct thing
   to do is dubious, but since this has been broken since the "code" was
   written a quarter century ago, clearly nobody ever wanted to do that.
   Match OpenSSL behavior which also means more NULL checks than strictly
   make sense.

   CMS_stream() has very similar code, but it's not problematic in this
   particular way because the content isn't OPTIONAL.

   Part of a diff from Acts1631