CVS commit: pkgsrc/geography/libmaxminddb

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Sep 13 10:45:12 UTC 2026

Modified Files:
        pkgsrc/geography/libmaxminddb: Makefile distinfo

Log Message:
libmaxminddb: update to 1.14.0.

## 1.14.0 - 2026-09-08

- Bounded the resources that `MMDB_get_entry_data_list()` spends decoding a
  single entry. A crafted database could nest data-section pointers to shared
  targets so that decoding one entry cost exponential time and memory, or point
  many times at one large value so that a caller copying the result materialized
  far more data than the file holds. The decoder now follows the Reader Resource
  Limits section of the MaxMind DB specification. Each call is limited to 65,536
  values and 2 MiB of string and bytes payload, in addition to the existing
  recursive-decoder depth limit of 512. See the `MMDB_get_entry_data_list()`
  documentation for details.
  - Exceeding a limit returns the new `MMDB_DECODER_LIMIT_ERROR` status. A
    full-list failure leaves the output set to `NULL`.
  - `MMDB_get_value()`, `MMDB_vget_value()`, and `MMDB_aget_value()` now return
    `MMDB_DECODER_LIMIT_ERROR` instead of `MMDB_INVALID_DATA_ERROR` when they
    skip a subtree past the depth limit.
  - `MMDB_open()` returns `MMDB_INVALID_METADATA_ERROR` when metadata processing
    exceeds a decoder limit.
  - The limits can be raised when building the library with
    `-DMAXIMUM_DATA_STRUCTURE_DEPTH`, `-DMAXIMUM_DATA_STRUCTURE_VALUES`, and
    `-DMAXIMUM_DATA_STRUCTURE_BYTES`.
- Fixed an out-of-bounds read in `MMDB_lookup_sockaddr()` when callers passed a
  `sockaddr` with an unsupported address family. The function now rejects any
  family other than `AF_INET` and `AF_INET6` with
  `MMDB_INVALID_NETWORK_ADDRESS_ERROR`.
- Fixed metadata parsing for files that end immediately after the
  `\xAB\xCD\xEFMaxMind.com` marker. Such files are now rejected as invalid
  metadata instead of allowing a zero-length metadata section to reach the
  decoder.
- Fixed search-tree validation for records that point into the 16-byte separator
  before the data section. These records are now rejected as corrupt instead of
  being exposed as apparent data entries with underflowed offsets.
- `MMDB_read_node()` now returns `MMDB_CORRUPT_SEARCH_TREE_ERROR` instead of
  `MMDB_SUCCESS` with `MMDB_RECORD_TYPE_INVALID` record types when a node's
  child record is invalid.


To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 pkgsrc/geography/libmaxminddb/Makefile
cvs rdiff -u -r1.17 -r1.18 pkgsrc/geography/libmaxminddb/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/geography/libmaxminddb/Makefile
diff -u pkgsrc/geography/libmaxminddb/Makefile:1.18 pkgsrc/geography/libmaxminddb/Makefile:1.19
--- pkgsrc/geography/libmaxminddb/Makefile:1.18 Fri Mar  6 06:21:35 2026
+++ pkgsrc/geography/libmaxminddb/Makefile      Sun Sep 13 10:45:12 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.18 2026/03/06 06:21:35 adam Exp $
+# $NetBSD: Makefile,v 1.19 2026/09/13 10:45:12 wiz Exp $
 
-DISTNAME=      libmaxminddb-1.13.3
+DISTNAME=      libmaxminddb-1.14.0
 CATEGORIES=    geography
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=maxmind/}
 GITHUB_RELEASE=        ${PKGVERSION_NOREV}
@@ -13,7 +13,7 @@ LICENSE=      apache-2.0
 USE_CC_FEATURES=       c99
 USE_LANGUAGES=         c
 USE_LIBTOOL=           yes
-USE_TOOLS+=            gmake
+USE_TOOLS+=            gmake pkg-config perl:test
 GNU_CONFIGURE=         yes
 PKGCONFIG_OVERRIDE+=   src/libmaxminddb.pc.in
 TEST_TARGET=           check

Index: pkgsrc/geography/libmaxminddb/distinfo
diff -u pkgsrc/geography/libmaxminddb/distinfo:1.17 pkgsrc/geography/libmaxminddb/distinfo:1.18
--- pkgsrc/geography/libmaxminddb/distinfo:1.17 Fri Mar  6 06:21:35 2026
+++ pkgsrc/geography/libmaxminddb/distinfo      Sun Sep 13 10:45:12 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.17 2026/03/06 06:21:35 adam Exp $
+$NetBSD: distinfo,v 1.18 2026/09/13 10:45:12 wiz Exp $
 
-BLAKE2s (libmaxminddb-1.13.3.tar.gz) = ec87037cd678c2812c1c4ca8a239060e2ff0a0d0a4c74e2919c23d245dea124a
-SHA512 (libmaxminddb-1.13.3.tar.gz) = 62098af00e7a827c079f169a73f2b259bb3a20144a8d6a17e10f531a77fc836ddd7c93d73c10d775ea50aad134b2461aa2c81b6f7cd208cca7ef2956e4de0f31
-Size (libmaxminddb-1.13.3.tar.gz) = 795830 bytes
+BLAKE2s (libmaxminddb-1.14.0.tar.gz) = 7a3cc1d73818d999f81d88df60fa1aedb9a894e32fa61b28efdb86224feee7bc
+SHA512 (libmaxminddb-1.14.0.tar.gz) = 91a880d7c66c7b022915ceb6cf467515505666381178ac7713e52ac99d0c02fc57e43bf581b3fcb9fa5673c2fdb489b1d7964dbb3ea2f36a15961783490852d1
+Size (libmaxminddb-1.14.0.tar.gz) = 846559 bytes