Folks, I had discovered that libslirp had a secirity related release which was issues a few day ago. Related changelog entries: - Fix bounds-check in processing OEM commands (CVE-2026-95507) - Fix bounds-check in dhcpv6 against MTU (CVE-2026-95508) it was tested with qemu, no regression discovered. Ok for 8.0? Index: Makefile =================================================================== RCS file: /home/cvs/ports/net/libslirp/Makefile,v diff -u -p -r1.4 Makefile --- Makefile 15 Jun 2026 08:19:59 -0000 1.4 +++ Makefile 28 Sep 2026 20:55:22 -0000 @@ -1,6 +1,6 @@ COMMENT= general purpose TCP-IP emulator library -VER= 4.9.3 +VER= 4.9.5 DISTNAME= libslirp-v${VER} PKGNAME= libslirp-${VER} CATEGORIES= net Index: distinfo =================================================================== RCS file: /home/cvs/ports/net/libslirp/distinfo,v diff -u -p -r1.3 distinfo --- distinfo 15 Jun 2026 08:19:59 -0000 1.3 +++ distinfo 28 Sep 2026 20:55:35 -0000 @@ -1,2 +1,2 @@ -SHA256 (libslirp-v4.9.3.tar.bz2) = yC4ixzvcPywDjlONTwycIWbe+yQCIS1hu3yxtTC6lS8= -SIZE (libslirp-v4.9.3.tar.bz2) = 133720 +SHA256 (libslirp-v4.9.5.tar.bz2) = T1nfiWyzRep21/aLHoIIcv6qnYJVpnYfa/ig8tUUS80= +SIZE (libslirp-v4.9.5.tar.bz2) = 134635 Index: patches/patch-meson_build =================================================================== RCS file: patches/patch-meson_build diff -N patches/patch-meson_build --- patches/patch-meson_build 15 Jun 2026 08:19:59 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,22 +0,0 @@ -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a - -Index: meson.build ---- meson.build.orig -+++ meson.build -@@ -238,6 +238,16 @@ ncsitest = executable('ncsitest', 'test/ncsitest.c', - - test('ncsi', ncsitest) - -+guestfwdtest = executable('guestfwdtest', 'test/guestfwdtest.c', -+ link_with: [lib], -+ c_args : cargs, -+ link_args : vflag, -+ include_directories: ['src'], -+ dependencies: libslirp_deps -+) -+ -+test('guestfwd', guestfwdtest) -+ - if install_devel - install_headers(['src/libslirp.h'], subdir : 'slirp') - Index: patches/patch-src_slirp_c =================================================================== RCS file: patches/patch-src_slirp_c diff -N patches/patch-src_slirp_c --- patches/patch-src_slirp_c 15 Jun 2026 08:19:59 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,21 +0,0 @@ -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a - -Index: src/slirp.c ---- src/slirp.c.orig -+++ src/slirp.c -@@ -1581,9 +1581,12 @@ static bool check_guestfwd(Slirp *slirp, struct in_add - (htonl(0x0204) & ~slirp->vnetwork_mask.s_addr); - } - if ((guest_addr->s_addr & slirp->vnetwork_mask.s_addr) != -- slirp->vnetwork_addr.s_addr || -- guest_addr->s_addr == slirp->vhost_addr.s_addr || -- guest_addr->s_addr == slirp->vnameserver_addr.s_addr) { -+ slirp->vnetwork_addr.s_addr) { -+ return false; -+ } -+ if (!slirp->disable_dns && -+ guest_addr->s_addr == slirp->vnameserver_addr.s_addr && -+ guest_port == 53) { - return false; - } - Index: patches/patch-src_tcp_input_c =================================================================== RCS file: patches/patch-src_tcp_input_c diff -N patches/patch-src_tcp_input_c --- patches/patch-src_tcp_input_c 15 Jun 2026 08:19:59 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,36 +0,0 @@ -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a - -Index: src/tcp_input.c ---- src/tcp_input.c.orig -+++ src/tcp_input.c -@@ -600,20 +600,17 @@ findso: - if (af == AF_INET && - (so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) == - slirp->vnetwork_addr.s_addr) { -- if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr && -- so->so_faddr.s_addr != slirp->vnameserver_addr.s_addr) { -- /* May be an add exec */ -- for (ex_ptr = slirp->guestfwd_list; ex_ptr; -- ex_ptr = ex_ptr->ex_next) { -- if (ex_ptr->ex_fport == so->so_fport && -- so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { -- so->so_state |= SS_CTL; -- break; -- } -+ /* May be an add exec */ -+ for (ex_ptr = slirp->guestfwd_list; ex_ptr; -+ ex_ptr = ex_ptr->ex_next) { -+ if (ex_ptr->ex_fport == so->so_fport && -+ so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { -+ so->so_state |= SS_CTL; -+ break; - } -- if (so->so_state & SS_CTL) { -- goto cont_input; -- } -+ } -+ if (so->so_state & SS_CTL) { -+ goto cont_input; - } - /* CTL_ALIAS: Do nothing, tcp_fconnect will be called on it */ - } Index: patches/patch-src_tcp_subr_c =================================================================== RCS file: patches/patch-src_tcp_subr_c diff -N patches/patch-src_tcp_subr_c --- patches/patch-src_tcp_subr_c 15 Jun 2026 08:19:59 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,41 +0,0 @@ -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a - -Index: src/tcp_subr.c ---- src/tcp_subr.c.orig -+++ src/tcp_subr.c -@@ -992,22 +992,20 @@ int tcp_ctl(struct socket *so) - DEBUG_ARG("so = %p", so); - - /* TODO: IPv6 */ -- if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr) { -- /* Check if it's pty_exec */ -- for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { -- if (ex_ptr->ex_fport == so->so_fport && -- so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { -- if (ex_ptr->write_cb) { -- so->s = SLIRP_INVALID_SOCKET; -- so->guestfwd = ex_ptr; -- return 1; -- } -- DEBUG_MISC(" executing %s", ex_ptr->ex_exec); -- if (ex_ptr->ex_unix) -- return open_unix(so, ex_ptr->ex_unix); -- else -- return fork_exec(so, ex_ptr->ex_exec); -+ /* Check if it's pty_exec */ -+ for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { -+ if (ex_ptr->ex_fport == so->so_fport && -+ so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { -+ if (ex_ptr->write_cb) { -+ so->s = SLIRP_INVALID_SOCKET; -+ so->guestfwd = ex_ptr; -+ return 1; - } -+ DEBUG_MISC(" executing %s", ex_ptr->ex_exec); -+ if (ex_ptr->ex_unix) -+ return open_unix(so, ex_ptr->ex_unix); -+ else -+ return fork_exec(so, ex_ptr->ex_exec); - } - } - sb->sb_cc = slirp_fmt(sb->sb_wptr, sb->sb_datalen - (sb->sb_wptr - sb->sb_data), Index: patches/patch-test_guestfwdtest_c =================================================================== RCS file: patches/patch-test_guestfwdtest_c diff -N patches/patch-test_guestfwdtest_c --- patches/patch-test_guestfwdtest_c 15 Jun 2026 08:19:59 -0000 1.1 +++ /dev/null 1 Jan 1970 00:00:00 -0000 @@ -1,79 +0,0 @@ -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a - -Index: test/guestfwdtest.c ---- test/guestfwdtest.c.orig -+++ test/guestfwdtest.c -@@ -0,0 +1,73 @@ -+/* SPDX-License-Identifier: BSD-3-Clause */ -+ -+#include <assert.h> -+#include <stddef.h> -+ -+#include "libslirp.h" -+ -+static slirp_ssize_t guestfwd_write(const void *buf, size_t len, void *opaque) -+{ -+ return len; -+} -+ -+static SlirpCb callbacks; -+ -+static struct in_addr in_addr4(uint32_t addr) -+{ -+ struct in_addr ret = { .s_addr = htonl(addr) }; -+ -+ return ret; -+} -+ -+static Slirp *guestfwd_slirp(bool disable_dns) -+{ -+ SlirpConfig config = { -+ .version = SLIRP_CONFIG_VERSION_MAX, -+ .in_enabled = true, -+ .vnetwork = in_addr4(0x0a000200), -+ .vnetmask = in_addr4(0xffffff00), -+ .vhost = in_addr4(0x0a000202), -+ .vdhcp_start = in_addr4(0x0a00020f), -+ .vnameserver = in_addr4(0x0a000203), -+ .disable_dns = disable_dns, -+ }; -+ -+ return slirp_new(&config, &callbacks, NULL); -+} -+ -+static void assert_guestfwd(Slirp *slirp, struct in_addr addr, int port, -+ bool expect_ok) -+{ -+ int ret; -+ -+ ret = slirp_add_guestfwd(slirp, guestfwd_write, NULL, &addr, port); -+ assert((ret == 0) == expect_ok); -+ -+ if (ret == 0) { -+ assert(slirp_remove_guestfwd(slirp, addr, port) == 0); -+ } -+} -+ -+static void test_guestfwd_validation(void) -+{ -+ struct in_addr vhost = in_addr4(0x0a000202); -+ struct in_addr vnameserver = in_addr4(0x0a000203); -+ Slirp *slirp; -+ -+ slirp = guestfwd_slirp(false); -+ assert_guestfwd(slirp, vhost, 8080, true); -+ assert_guestfwd(slirp, vnameserver, 8080, true); -+ assert_guestfwd(slirp, vhost, 67, true); -+ assert_guestfwd(slirp, vhost, 69, true); -+ assert_guestfwd(slirp, vnameserver, 53, false); -+ slirp_cleanup(slirp); -+ -+ slirp = guestfwd_slirp(true); -+ assert_guestfwd(slirp, vnameserver, 53, true); -+ slirp_cleanup(slirp); -+} -+ -+int main(int argc, char *argv[]) -+{ -+ test_guestfwd_validation(); -+} -- wbr, Kirill
Monday, September 28, 2026
Re: NEW: java/openjfx
On Thu, Sep 24, 2026 at 05:06:54PM +0200, Sebastian Reitenbach wrote: > attached updated version using FULLDISTDIR in the patch and SUBST_CMD it > before building works for me. > Does it work for you as well? This works and build for me. ok kmos --Kurt
Subscribe to:
Posts (Atom)