BSD Commit Log Search

   reject CR and LF in argv-derived fields before starting the SMTP dialogue

   enqueue interpolates the sender, recipients and DSN options straight into
   MAIL FROM / RCPT TO command lines.  an embedded CR or LF split the command
   boundary and injected additional SMTP commands over the local session, so
   refuse any such field up front.

   from Andrew Griffiths (fixed by me), ok op@

   free the copied envelope on the smarthost lookup failure path

   mta_on_smarthost() frees the malloc'd envelope on success, but the
   smarthost == NULL branch tempfailed the message and returned without
   freeing it, leaking a struct envelope per failed lookup.

   from Andrew Griffiths, ok op@

   free mda_subaddress in mda_envelope_free()

   mda_envelope() duplicates the subaddress with xstrdup() when present but
   mda_envelope_free() never released it, leaking one bounded string per
   subaddressed local delivery.

   from Andrew Griffiths, ok op@

   use inflateEnd() to tear down the inflate stream in uncompress_gzip_chunk()

   the decompression path sets up the stream with inflateInit2() but the
   cleanup block called deflateEnd(), mismatching the zlib inflate/deflate
   APIs and leaking the stream state on every gzip queue read.

   from Andrew Griffiths, ok op@

   stop parsing DNS answers once unpack_rr() reports failure

   the MX, MX-preference and spf walkers looped on the attacker-controlled
   ancount calling unpack_rr() without checking its return, processing stale
   or uninitialized rr contents on malformed or truncated replies.  break out
   of the loop as soon as unpack_rr() fails.

   from Andrew Griffiths, ok op@

   Enable X11 flavour for nethack/5.0.
   From espie

   sysv: Recheck message queue limit after malloc

   que_create() allocates with M_WAIT and may sleep after sys_msgget()
   checks num_ques against msgmni. The kernel lock is released while the
   thread sleeps, allowing concurrent creators to pass the same check and
   exceed the queue limit.

   OK: mvs@

   sysv: Use zero-based message queue indices

   que_ix starts at one, while KERN_SYSVIPC_MSG_INFO allocates msgmni
   entries and uses que_ix directly as an array index. The last permitted
   queue therefore makes sysctl_sysvmsg() copy one struct msqid_ds past the
   allocation, which KASAN detects.

   OK: mvs@

   IPComp decompression must not overflow mbuf cluster.

   Check after decompressing an IPComp packet, that the content fits
   into a mbuf cluster.  m_copyback() assumes that it can allocate a
   single mbuf cluster to enlarge the mbuf chain.  That means the
   decompressed data must not exceed MAXMCLBYTES.  Prevent panic:
   m_clget: request for 67948 byte cluster.

   reported by Homura Akemi, SecBuddyF, Tencent KeenLab; OK mvs@

   IPsec AH must contain replay counter.

   Before reading the replay counter from packet header in ah_input(),
   make sure that the mbuf is long enough.  Prevents panic: m_copydata:
   null mbuf.

   reported by Homura Akemi, SecBuddyF, Tencent KeenLab; OK mvs@

   Update yyjson to 0.12.0.

   Use _exit in child after fork, from Yayo Razo in GitHub issue 5376.

   Add missing calloc check and use fatal. Prompted by a similar change
   from Yayo Razo.

   wayland/mango: Update to 0.15.2

   wayland/scenefx: Update to 0.5

   feedback and tests from yaydn (at) protonmail, hints from tb@ and naddy@
   Thanks!

   update to lzdoom 4.14.4, a bugfix release. Release notes: https://github.com/drfrag666/lzdoom/releases/tag/l4.14.4

   update

   Update to gccmakedep 1.0.5

   Update xwud to 1.0.8

   Update to xwd 1.0.10

   Update to xvinfo 1.1.6

   Update to xsetroot 1.1.4

   Update to xset 1.2.6

   missed cvs add

   Update to xrefresh 1.1.1

   Update to xrdb 1.2.3

   Update to xlsfonts 1.0.9

   Update to xlsatoms 1.1.5

   Update to xkbutils 1.0.7

   Move SysV sysctl(2) handlers out of sysctl_vslock(). They don't need to
   wire userland pages, but have sleeping malloc() calls which could block
   the locked sysctl(2) paths. Introduce rwlocks to serialize access to
   `seminfo' and `shminfo' respectively. The whole SysV IPC layer relies on
   kernel lock, but sysctl_sysvsem() and sysctl_sysvshm() paths have
   context switch requires the extra serialization.

   Joint work with and OK from kirill.