Re: update wget 1.20.2 (security fix and new release)

On 2019/04/03 20:45, Nam Nguyen wrote:
>
> This is a new release of wget 1.20.2 (April 1, 2019). I successfully
> downloaded install64.iso as a test. Of note: "Fixed a buffer overflow
> vulnerability." I just wanted to get this new version out first. I will
> look into how to download the corpus of tests to reactivate fuzz tests
> in a future diff.

Thanks, committed. I don't really see much value in adding fuzz tests
to ports if upstream doesn't see a need to include them in the main
distfile - that is more something that upstream developers would use
rather than part of the usual regression test framework.

> Release notes:
> https://lists.gnu.org/archive/html/bug-wget/2019-04/msg00001.html
>
> Details on vulnerability:
> https://lists.gnu.org/archive/html/bug-wget/2019-02/msg00004.html
> https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=72e936e89c09bcf1a76479258881d91b0a27003f

Those posts relate to the gnulib change which in practice isn't likely
to affect much other than cygwin crosscompiles (and is infinite recursion
not a buffer overflow).

I *think* the buffer overflow refers to this corner-case.

+ * src/http.c (response_head_terminator): Don't access uninitialized data

->

/* p==end-2: check for \n\n directly preceding END. */
- if (p[0] == '\n' && p[1] == '\n')
+ if (peeklen >= 2 && p[0] == '\n' && p[1] == '\n')
return p + 2;