A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-…
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response).
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (2)
VuXML entries whose affected range this version has left.
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
devel/libsoup: add a DOCS option
Add DOCS, which just uses gtk_doc to do the work. The change
was suggested by Sean Champ in the linked PR, but I reworked
it substantially to be explicit about the files, and to use
the simplest tooling. Other changes suggested by the way
devel/libical and devel/json/glib do DOCS with gtk_doc.
PR: 265568
Reported by: Sean Champ
net/glib-networking: update to 2.70.1 to match glib
glib-networking and glib (glib20) should be kept in sync
with major.minor versions. Update to catch up with glib.
Bump PORTREVISION on direct consumers, but not transitively.
Note that the PR has a newer patch, but that bumps glib
by a minor revision as well, to 2.72, which is tricky in itself.
Transitive consumers of libsoup and libsoup3 all build,
except for net-im/libnice, but that fails locally without this
change as well, so I'm going to choose to ignore that.
PR: 262389
Obtained from: yzrh@noema.org
textproc/libxml2: bump all LIB_DEPENDS consumers
This is a separate commit to facilitate easier cherry-picking for
quarterly.
PR: 262853, 262940, 262877, 263126
Approved by: fluffy (mentor)
textproc/libxml2: bump all dependencies
This should make sure that all dependent ports will pick
up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246
devel/libsoup: make samba a (not registered) runtime dep
This picks up an idea from PR 235207 again, where NTLM authentication
is optional. Previous commits made samba a build-dependency so
that the --enable-ntlm option would work. The meson build -- even
though the dep is entirely runtime -- would check for the presence
of ntlm_auth at build-time, to be able to pass in the path to
ntlm_auth to the build.
Re-jig this to not do the check, accept the option as-is, and
use a likely path to ntlm_auth instead (which is what the original
patch in 235207 did).
A circular dependency from samba41[23] -> libsoup and back
can be triggered by setting option SMB in libsoup and
option SPOTLIGHT in samba. Originally the runtime dependency
was registered as
USES= samba:run
A _RUN dependency still wants to build, though, and package and
index builds failed. Cut the circular dependency by **not**
registering samba as a runtime dependency and using a pkg-message
to tell users to possibly install samba.
Anyone who now has "but my samba is installed in a different prefix"
can file a PR with a patch fixing meson better.
PR: 256076
Reported by: Dimitry Andric
devel/libsoup: make NTLM (Samba) an option
Having Samba as a build-dep can still be heavy, so add
an OPTION to turn it off again; this just means that
the runtime check for ntlm will be skipped.
Thanks Barbara for insisting on a more configurable approach.
devel/libsoup: fix options USES
Too much copy-and-paste in the options helpers; build tests
didn't show anything because it tries to grab **some** GSSAPI
and that works out ok because GSSAPI detection is normally automatic.
Reported by: tobik
devel/libsoup: Massage features and options
- From PR 235207 comes a patch from mi@ to use NTLM if it's there.
Unfortunately, the switch to Meson has made this run-time-option
a build-time-check, so the original patch isn't directly useful.
Make samba a build-time dep, so that the code is enabled; there
is a run-time check if the NTLM executable is available.
- From PR 231160 comes a patch to configure different kinds of
GSSAPI. That too doesn't apply with the current Meson build,
but the general idea does.
Build-tested in 8 configurations (but libsoup is nice that everything
is #ifdeffed internally, so there's no plist or other visible changes)
While here, add WWW line.
PR: 235207 231160
Reported by: mi
Reported by: Sergey Akhmatov
Update libsoup to 2.72.0
Merge back libsoup and libsoup-gnome, they both have the same dependencies
now, and they are more complicated to split now that they switched to meson
Bump portrevision of dependant ports
Move some gnome@ ports to desktop@
As gnome@ is lacking active committers at the moment, transfer some of its
ports [1] up the stack to the desktop@ group, in hope that this way we get some
updates in as the set of people that "should feel responsible" grows.
As soon as gnome@ grows some committers again, this can (and should) of course
be reverted again.
[1] The list of ports chosen in this move consits of all the ports that are
required to build x11/kde5.
Approved by: portmgr (bapt)
Differential Revision: https://reviews.freebsd.org/D26362
The FreeBSD GNOME team proudly presents GNOME 3.28 for FreeBSD.
The offical GNOME 3.28 release notes can be found at
https://help.gnome.org/misc/release-notes/3.28/
Thanks to Antoine Brodin for running the exp-runs.
PR: 229761
Remove USE_SQLITE from bsd.databases.mk, replaced by USES=sqlite.
While there replace USE_SQLITE=x by USES=sqlite:x.
PR: 208971
Submitted by: mat
Exp-run by: antoine
With hat: portmgr
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D5951
The FreeBSD GNOME team proudly presents GNOME 3.18 for FreeBSD.
The offical GNOME 3.18 release notes can be found at
https://help.gnome.org/misc/release-notes/3.18/
This update doesn't contain the glib/gtk c++ bindings which will
be done in a another update due to the requirement on c++11 and the
amount of fallout this probably will give.
GDM is still at version 3.16 due to some issues.
Bump mate-themes to use the gtk 3.18 version of the themes.
Thanks to Antoine Brodin for running the exp-runs.
This release was made possible by the following people:
Gustau Perez
Ting-Wei_Lan
PR: 207006
The FreeBSD GNOME team proudly presents GNOME 3.16 for FreeBSD.
The offical GNOME 3.16 release notes can be found at https://help.gnome.org/misc/release-notes/3.16/
Upgrade instructions for port users:
Delete the old tracker package with:
# pkg delete -f tracker
And user port upgrade tool of choice to upgrade.
Thanks to Antoine Brodin for running the exp-runs.
This release was made possible by the following people:
Gustau Perez
Ting-Wei_Lan
PR: 201980
security/libgcrypt: 1.6.1 -> 1.6.2, bump depends
Changes:
- src/sexp.c (do_vsexp_sscan): Return error for invalid args.
- cipher/md.c (_gcry_md_info): Fix a segv in case of calling
with wrong parameters.
- cipher/primegen.c (_gcry_generate_elg_prime): Change to return an
error code, possible NULL deref in call to prime generator.
- cipher/dsa.c (generate): Take care of new return code.
- cipher/elgamal.c (generate): Change to return an error code. Take
care of _gcry_generate_elg_prime return code.
- ecc: Support the non-standard 0x40 compression flag for EdDSA.
- mpi: Extend the internal mpi_get_buffer.
- mpi: Fix regression for powerpc-apple-darwin detection.
- Fix bug inhibiting the use of the sentinel attribute in src/gcrypt.h.in
- Fix building for the x32 target without asm modules in
mpi/generic/mpi-asm-defs.h: Use a fixed value for the x32 ABI.
- Fix ARM assembly when building __PIC__
- mpi: Fix a subtle bug setting spurious bits with in mpi_set_bit.
* mpi/mpi-bit.c (_gcry_mpi_set_bit, _gcry_mpi_set_highbit): Clear
allocated but not used bits before resizing.
* tests/t-mpi-bits.c (set_bit_with_resize): New.
- Use internal malloc function in fips.c.
* src/fips.c (check_binary_integrity): s/gcry_malloc/xtrymalloc/.
- pubkey: Re-map all deprecated RSA algo numbers.
- cipher: Fix possible NULL dereference in cipher/md.c for being NULL.
- Fix ARMv6 detection when CFLAGS modify target CPU architecture.
PR: 193264
Approved by: cpm@fbsd.es (maintainer)
Update cinnamon to 2.4, this should fix [1] and [2]. Update totem to 3.14 now that we have gstreamer 1.4 and minor gnome updates. Update evolution suite to 3.12.9. Make sure gtk30 pulls in adwait-icon-theme, since it now the default theme [3].
PR: 195290 [1], 195289 [2], 195455 [3]
Obtained from: gnome devel repo
The FreeBSD GNOME team proudly presents GNOME 3.14 and Cinnamon 2.2. Gnome 3.14.1 and Cinnamon 2.2.16 are supported on FreeBSD 9.3-RELEASE and up.
This commit removes the old GNOME 2 desktop, bindings and some ports that
can't be compiled. A few ports where updated to more recent versions to
allow them to compile with this update.
Apart from updating ports to newer versions
GDM is more integrated with gnome-shell now, and handles several things for
the GNOME desktop such as screen locking. If you want to use GNOME 3 via
startx, you will have to add your own lock screen/screensaver. For example xscreensaver
can be used for sessions started without GDM.
Shell Extensions can be installed via https://extensions.gnome.org/ , we have
ported a few that can't be installed via this way.
The old gnome-utils and gnome-games ports where split up into single ports
and where converted to meta-ports.
gnome-terminal requires a UTF-8 locale to run, gdm handles this already, but
if you use startx you need to do this yourself.
Upgrade instructions:
Delete the old and conflicting packages:
# pkg delete clutter gnome-utils gnome-panel gnome-keyring vala-vapigen \
guile gcalctool gnome-media libgnomekbd
# pkg delete gnome-screensaver gnome-applets bug-buddy evolution-exchange \
evolution-webcal gnome-system-tools seahorse-plugins gnome-control-center
For package users the following lines will be enough:
# pkg upgrade
# pkg install gnome3
For ports users should do the following:
# portmaster -a
# portmaster x11/gnome3
We are currently aware of two issues. The first issue is a bug in the
file monitoring code in the glib20 port. This bug causes glib programs
to crash when files in a monitored directory are added or removed.
Upstream is aware of the problem, but since the problem is quite complex
there is no solution yet. This problem isn't restricted to BSD.
The second issue is that on certain video cards totem will display a
purple/pink overlay on the video. It not clear yet where the issues
comes from.
Major thanks goes to Gustau Perez for being a driving force behind getting
GNOME 3 up to speed again. Also thanks to Antoine Brodin for running the exp-runs.
This update was also made possible by:
Joe Maloney
Kris Moore
Beeblebrox
Ryan Lortie
Antoine Jacoutot
and everyone I missed
Bump PORTREVISION on all ports with USE_SQLITE=yes or USE_SQLITE=3 that have not been bumped yet after the latest libsqlite3.so library version change.
Approved by: portmgr (implicit)
Convert GMAKE to MAKE_CMD Please note that lots of invocation of MAKE_CMD here are wrong as they do not properly respect MAKE_ENV and friends
With hat: portmgr
When linking a library libA with a library libB using libtool, if libB.la exists, libtool will add all libraries libB.la refers to (dependency_libs field) to the linker command line and store them in the dependency_libs field of libA.la. So everything that subsequently links with libA will also link to these extra libraries. This causes too much overlinking.
This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs
field in .la libraries during staging. However, because .la libraries have
very limited use when dependency_libs is empty it makes sense to completely
remove them during staging.
So with this commit USES=libtool is modified to remove .la libraries and a
new form (USES=libtool:keepla) is introduced in case they need to be kept
(dependency_libs is still emptied).
PORTREVISION is bumped on all ports with USES=libtool that install .la
libraries. Most ports are also changed to add :keepla because .la
libraries have to be kept around as long as there are dependent ports with
.la libraries that refer to them in their dependency_libs field. In most
cases :keepla can be removed again as soon as all dependent ports that
install .la libraries have some form of USES=libtool added to their
Makefile.
PR: ports/188759
Exp-run: bdrewery
Approved by: portmgr (bdrewery)
The FreeBSD x11@ and graphics team proudly presents a zeising, kwm production, with help from dumbbell, bdrewery:
NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE
This update switches over to use the new xorg stack by default on FreeBSD 9
and 10 stable, on osversions where vt(9) is available.
It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in
/etc/make.conf .
FreeBSD 8-STABLE and released versions of FreeBSD still use
the old version.
A package repository with binary packages for new xorg will
be available soon.
This patch also contains updates of libxcb and related ports, pixman, as well
as some drivers and utilities.
Bump portrevisions for xf86-* ports, as well as virtualbox-ose-additions due
to xserver version change.
Apart from these updates, the way shared libraries are handled has been
changed for all xorg ports, as well as libxml2 and freetype, which means
ltverhack is gone and as a consequence shared libraries have been bumped.
The plan is that this change will make library bumps less likely in the
future.
All affected ports have had their portrevisions bumped as a consequence of
this.
Fix some issues where WITH_NEW_XORG weren't detected properly on CURRENT.
Update instructions, hardware support, and more notes can be found on
https://wiki.freebsd.org/Graphics
Thanks to: all testers, bdrewery and the FreeBSD x11@ team
exp-run by: bdrewery [1]
PR: ports/187602 [1]
Approved by: portmgr (bdrewery), core (jhb)