libc: Fix stack buffer overflow in cgetnext()
`cgetnext()` copies a capability record's name field into a fixed
1024 byte on-stack buffer (`nbuf[BSIZE]`) one character at a time,
but never checks that the write pointer stays within the buffer.
Therefore, a record name that is longer than `BSIZE` (either on a
single line, or accumulated across several `\`-continued lines as
the pointer is not reset amidst continuation) writes past the end
of `nbuf` and smashes the stack.
The name field is read directly from the capability file, so any
consumer of `cgetnext()`/`cgetfirst()` that processes an untrusted
`termcap(5)`- or `printcap(5)`-style database (e.g. `cap_mkdb(1)`,
`lpr(1)`, or any third-party caller) can be exposed and hence made
to corrupt the stack.
Reviewed by: fuz, dteske
Approved by: fuz (mentor), dteske (mentor)
MFC after: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/2309
mail/mlmmj-archiver: fix package being empty
Since 0.6.0 we move from PLIST_FILES to pkg-plist but the pkg-plist was
never git added.
While here strip the binaries.
Reported by: R. Matthew Emerson" <rme at acm.org>
devel/wasi-*: deprecate LLVM 17 and 18 based ports
Deprecate the individual devel/wasi-compiler-rt1[78] and
devel/wasi-libcxx1[78] ports and the 17 and 18 flavors of
devel/wasi-libc.
Approved by: vishwin (maintainer, in concept)
Fix broken doc package, offline local and online local browsing
Fix a bug that prevents the packaged FreeBSD documentation from being
browsed correctly when built using the offline Hugo configuration.
The offline configuration leaves baseURL empty, causing Hugo to fall
back to https://example.org/. As a result, the generated documentation
contains incorrect links, breaking offline browsing and online browsing
by directing users to example.org. This affects the built package as
well (tested with pkg version: en-freebsd-doc-20260814,1; tested on a
fresh VM with documentation installed using bsdinstall(8)). According to
the Hugo documentation, this is the default behavior when baseurl is not
set.
The fix is to set baseURL = "/" ensuring the generated documentation can
be browsed directly from the file system without requiring the web
server. This also preserves the ability to browse the documentation
through the local server started by 'make run'.
Event: Oslo Hackathon 2026
Pull Request: https://github.com/freebsd/freebsd-doc/pull/731
