pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/net/inetutils
Module Name: pkgsrc
Committed By: wiz
Date: Sat Aug 15 06:46:45 UTC 2026
Modified Files:
pkgsrc/net/inetutils: Makefile distinfo
Added Files:
pkgsrc/net/inetutils/patches: patch-talkd_announce.c
patch-talkd_intalkd.h patch-talkd_talkd.c
Log Message:
inetutils: fix CVE-2026-19720 using upstream patch.
Bump PKGREVISION.
To generate a diff of this commit:
cvs rdiff -u -r1.13 -r1.14 pkgsrc/net/inetutils/Makefile
cvs rdiff -u -r1.9 -r1.10 pkgsrc/net/inetutils/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/net/inetutils/patches/patch-talkd_announce.c \
pkgsrc/net/inetutils/patches/patch-talkd_intalkd.h \
pkgsrc/net/inetutils/patches/patch-talkd_talkd.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/net/inetutils/Makefile
diff -u pkgsrc/net/inetutils/Makefile:1.13 pkgsrc/net/inetutils/Makefile:1.14
--- pkgsrc/net/inetutils/Makefile:1.13 Thu Apr 30 05:44:15 2026
+++ pkgsrc/net/inetutils/Makefile Sat Aug 15 06:46:44 2026
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.13 2026/04/30 05:44:15 wiz Exp $
+# $NetBSD: Makefile,v 1.14 2026/08/15 06:46:44 wiz Exp $
DISTNAME= inetutils-2.8
+PKGREVISION= 1
CATEGORIES= net
MASTER_SITES= ${MASTER_SITE_GNU:=inetutils/}
Index: pkgsrc/net/inetutils/distinfo
diff -u pkgsrc/net/inetutils/distinfo:1.9 pkgsrc/net/inetutils/distinfo:1.10
--- pkgsrc/net/inetutils/distinfo:1.9 Thu Apr 30 05:44:15 2026
+++ pkgsrc/net/inetutils/distinfo Sat Aug 15 06:46:44 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.9 2026/04/30 05:44:15 wiz Exp $
+$NetBSD: distinfo,v 1.10 2026/08/15 06:46:44 wiz Exp $
BLAKE2s (inetutils-2.8.tar.gz) = 4c862ef324da6b9b1ad62d24e56de4918425776fd7d204efaaecd7cdf595e80c
SHA512 (inetutils-2.8.tar.gz) = 00b33c9d712cf670f16dbefc963fed880088ff67f506df54fd02fdfc0f8c05d379faba5d602c8772c4dc4fd72e1fa8733777d5840784aa86e092eeb5d0f905f7
@@ -7,3 +7,6 @@ SHA1 (patch-libinetutils_libinetutils.h)
SHA1 (patch-ping_Makefile.in) = bfc193800d353496ce2dc639803c356eef7a655a
SHA1 (patch-src_Makefile.in) = a8321822fdd68db4ec86ad232b59aaad92583297
SHA1 (patch-src_syslogd.c) = 608579f47456d85b29520e7021c86cf80f6faa1c
+SHA1 (patch-talkd_announce.c) = 2fdb64c69c97b230a5ffe4be7fb3716d3d261f40
+SHA1 (patch-talkd_intalkd.h) = 6c0f7169bbbea1013cf8553fe7103cc88b44b672
+SHA1 (patch-talkd_talkd.c) = 8dd3979e9cfca8e1d13f7e6800325f931bc78ca4
Added files:
Index: pkgsrc/net/inetutils/patches/patch-talkd_announce.c
diff -u /dev/null pkgsrc/net/inetutils/patches/patch-talkd_announce.c:1.1
--- /dev/null Sat Aug 15 06:46:45 2026
+++ pkgsrc/net/inetutils/patches/patch-talkd_announce.c Sat Aug 15 06:46:44 2026
@@ -0,0 +1,223 @@
+$NetBSD: patch-talkd_announce.c,v 1.1 2026/08/15 06:46:44 wiz Exp $
+
+Fix CVE-2026-19720.
+https://codeberg.org/inetutils/inetutils/commit/81987d968ab831c08bd7e42a46f4a4823729cf1e
+
+--- talkd/announce.c.orig 2026-04-29 07:53:25.000000000 +0000
++++ talkd/announce.c
+@@ -24,99 +24,144 @@
+
+ #undef MAX
+ #define MAX(a,b) ( (a) > (b) ? (a) : (b) )
+-#define N_LINES 5
+-#define N_CHARS 256
+
+ #include <libinetutils.h>
+
+-typedef struct
+-{
+- int ind;
+- int max_size;
+- char line[N_LINES][N_CHARS];
+- int size[N_LINES];
+- char buf[N_LINES * N_CHARS + 3];
+-} LINE;
++#include "intprops.h"
++#include "inttostr.h"
+
+-static void
+-init_line (LINE *lp)
++static int
++print_mesg (char *tty, CTL_MSG *request, char *remote_machine)
+ {
+- memset (lp, 0, sizeof *lp);
+-}
++ time_t t;
++ time (&t);
++ struct tm *tm = localtime (&t);
+
+-static void
+-format_line (LINE *lp, const char *fmt, ...)
+-{
+- va_list ap;
+- int i = lp->ind;
++ char tm_hour_buf[INT_BUFSIZE_BOUND (int)];
++ char const *tm_hour_str = inttostr (tm->tm_hour, tm_hour_buf);
++ idx_t tm_hour_len = strlen (tm_hour_str);
+
+- if (lp->ind >= N_LINES)
+- return;
+- lp->ind++;
+- va_start (ap, fmt);
+- lp->size[i] = vsnprintf (lp->line[i], sizeof lp->line[i], fmt, ap);
+- lp->max_size = MAX (lp->max_size, lp->size[i]);
+- va_end (ap);
+-}
++ char tm_min_buf[INT_BUFSIZE_BOUND (int)];
++ char *tm_min_str = inttostr (tm->tm_min, tm_min_buf);
++ if (0 <= tm->tm_min && tm->tm_min < 10)
++ *--tm_min_str = '0';
++ idx_t tm_min_len = strlen (tm_min_str);
+
+-static char *
+-finish_line (LINE *lp)
+-{
+- int i;
+- char *p;
++ /* "Message from Talk_Daemon@%s at %d:%02d ..." */
++ static const char line1_prefix[] = "Message from Talk_Daemon@";
++ static const char line1_part2[] = " at ";
++ static const char line1_part3[] = " ...";
+
+- p = lp->buf;
++ /* Don't subtract the NUL byte from LINE1_PART to make up for the
++ ':' character. */
++ idx_t line1_len = ((sizeof line1_prefix - 1) + hostname_len
++ + sizeof line1_part2 + tm_hour_len + tm_min_len
++ + (sizeof line1_part3 - 1));
++
++ idx_t l_name_len = strlen (request->l_name);
++ idx_t remote_machine_len = strlen (remote_machine);
++
++ /* "talk: connection requested by %s@%s" */
++ static const char line2_prefix[] = "talk: connection requested by ";
++
++ /* Don't subtract the NUL byte to make up for the '@' character. */
++ idx_t line2_len = sizeof line2_prefix + l_name_len + remote_machine_len;
++
++ /* "talk: respond with: talk %s@%s" */
++ static const char line3_prefix[] = "talk: respond with: talk ";
++
++ /* Don't subtract the NUL byte to make up for the '@' character. */
++ idx_t line3_len = sizeof line3_prefix + l_name_len + remote_machine_len;
++
++ /* Get the maximum line length. */
++ idx_t max_line_len = MAX (line1_len, MAX (line2_len, line3_len));
++
++ /* Begin with an alarm followed by CRLF. Each of the 5 lines is filled
++ to MAX_LINE_LEN + 2 with spaces followed by a CRLF. */
++ idx_t size = ((max_line_len + 2 + 2) * 5) + 3;
++ char *buf = malloc (size);
++ if (!buf)
++ {
++ syslog (LOG_ERR, "Out of memory");
++ exit (EXIT_FAILURE);
++ }
++
++ char *p = buf;
++
+ *p++ = '\a';
+ *p++ = '\r';
+ *p++ = '\n';
+- for (i = 0; i < lp->ind; i++)
+- {
+- char *q;
+- int j;
+
+- for (q = lp->line[i]; *q; q++)
+- *p++ = *q;
+- for (j = lp->size[i]; j < lp->max_size + 2; j++)
+- *p++ = ' ';
+- *p++ = '\r';
+- *p++ = '\n';
+- }
+- *p = 0;
+- return lp->buf;
+-}
++ /* Line 0. */
++ memset (p, ' ', max_line_len + 2);
++ p += max_line_len + 2;
++ *p++ = '\r';
++ *p++ = '\n';
+
+-static int
+-print_mesg (char *tty, CTL_MSG *request, char *remote_machine)
+-{
+- time_t t;
+- LINE ln;
+- char *buf;
+- struct tm *tm;
+- struct iovec iovec;
+- char *cp;
++ /* Line 1. */
++ memcpy (p, line1_prefix, sizeof line1_prefix - 1);
++ p += sizeof line1_prefix - 1;
++ memcpy (p, hostname, hostname_len);
++ p += hostname_len;
++ memcpy (p, line1_part2, sizeof line1_part2 - 1);
++ p += sizeof line1_part2 - 1;
++ memcpy (p, tm_hour_str, tm_hour_len);
++ p += tm_hour_len;
++ *p++ = ':';
++ memcpy (p, tm_min_str, tm_min_len);
++ p += tm_min_len;
++ memcpy (p, line1_part3, sizeof line1_part3 - 1);
++ p += sizeof line1_part3 - 1;
++ idx_t line1_spaces = (max_line_len + 2) - line1_len;
++ memset (p, ' ', line1_spaces);
++ p += line1_spaces;
++ *p++ = '\r';
++ *p++ = '\n';
+
+- time (&t);
+- tm = localtime (&t);
+- init_line (&ln);
+- format_line (&ln, "");
+- format_line (&ln, "Message from Talk_Daemon@%s at %d:%02d ...",
+- hostname, tm->tm_hour, tm->tm_min);
+- format_line (&ln, "talk: connection requested by %s@%s",
+- request->l_name, remote_machine);
+- format_line (&ln, "talk: respond with: talk %s@%s",
+- request->l_name, remote_machine);
+- format_line (&ln, "");
+- format_line (&ln, "");
+- buf = finish_line (&ln);
++ /* Line 2. */
++ memcpy (p, line2_prefix, sizeof line2_prefix - 1);
++ p += sizeof line2_prefix - 1;
++ memcpy (p, request->l_name, l_name_len);
++ p += l_name_len;
++ *p++ = '@';
++ memcpy (p, remote_machine, remote_machine_len);
++ p += remote_machine_len;
++ idx_t line2_spaces = (max_line_len + 2) - line2_len;
++ memset (p, ' ', line2_spaces);
++ p += line2_spaces;
++ *p++ = '\r';
++ *p++ = '\n';
++ memcpy (p, line3_prefix, sizeof line3_prefix - 1);
++ p += sizeof line3_prefix - 1;
++ memcpy (p, request->l_name, l_name_len);
++ p += l_name_len;
++ *p++ = '@';
++ memcpy (p, remote_machine, remote_machine_len);
++ p += remote_machine_len;
+
+- iovec.iov_base = buf;
+- iovec.iov_len = strlen (buf);
++ /* Line 3. */
++ idx_t line3_spaces = (max_line_len + 2) - line3_len;
++ memset (p, ' ', line3_spaces);
++ p += line3_spaces;
++ *p++ = '\r';
++ *p++ = '\n';
+
++ /* Line 4. */
++ memset (p, ' ', max_line_len + 2);
++ p += max_line_len + 2;
++ *p++ = '\r';
++ *p++ = '\n';
++
++ struct iovec iovec = {.iov_base = buf,.iov_len = size };
++
++ char *cp;
+ if ((cp = inetutils_ttymsg (&iovec, 1, tty, RING_WAIT - 5)) != NULL)
+ {
+ syslog (LOG_ERR, "%s", cp);
++ free (buf);
+ return FAILED;
+ }
++ free (buf);
+ return SUCCESS;
+ }
+
Index: pkgsrc/net/inetutils/patches/patch-talkd_intalkd.h
diff -u /dev/null pkgsrc/net/inetutils/patches/patch-talkd_intalkd.h:1.1
--- /dev/null Sat Aug 15 06:46:45 2026
+++ pkgsrc/net/inetutils/patches/patch-talkd_intalkd.h Sat Aug 15 06:46:44 2026
@@ -0,0 +1,24 @@
+$NetBSD: patch-talkd_intalkd.h,v 1.1 2026/08/15 06:46:44 wiz Exp $
+
+Fix CVE-2026-19720.
+https://codeberg.org/inetutils/inetutils/commit/81987d968ab831c08bd7e42a46f4a4823729cf1e
+
+--- talkd/intalkd.h.orig 2026-04-29 07:53:25.000000000 +0000
++++ talkd/intalkd.h
+@@ -32,6 +32,8 @@
+ #include <unistd.h>
+ #include <errno.h>
+
++#include "idx.h"
++
+ #ifndef INADDR_NONE
+ # define INADDR_NONE -1
+ #endif
+@@ -48,6 +50,7 @@ extern char *hostname;
+ extern time_t max_idle_time;
+ extern time_t max_request_ttl;
+ extern char *hostname;
++extern idx_t hostname_len;
+
+ #define os2sin_addr(cp) (((struct sockaddr_in *)&(cp))->sin_addr)
+
Index: pkgsrc/net/inetutils/patches/patch-talkd_talkd.c
diff -u /dev/null pkgsrc/net/inetutils/patches/patch-talkd_talkd.c:1.1
--- /dev/null Sat Aug 15 06:46:45 2026
+++ pkgsrc/net/inetutils/patches/patch-talkd_talkd.c Sat Aug 15 06:46:44 2026
@@ -0,0 +1,23 @@
+$NetBSD: patch-talkd_talkd.c,v 1.1 2026/08/15 06:46:44 wiz Exp $
+
+Fix CVE-2026-19720.
+https://codeberg.org/inetutils/inetutils/commit/81987d968ab831c08bd7e42a46f4a4823729cf1e
+
+--- talkd/talkd.c.orig 2026-04-29 07:53:25.000000000 +0000
++++ talkd/talkd.c
+@@ -41,6 +41,7 @@ char *hostname;
+
+ char *acl_file;
+ char *hostname;
++idx_t hostname_len;
+
+ const char args_doc[] = "";
+ const char doc[] = "Talk daemon, using service `ntalk'.";
+@@ -131,6 +132,7 @@ talkd_init (void)
+ syslog (LOG_ERR, "Cannot determine my hostname: %m");
+ exit (EXIT_FAILURE);
+ }
++ hostname_len = strlen (hostname);
+ }
+
+ time_t last_msg_time;
Home |
Main Index |
Thread Index |
Old Index