pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/lang
Module Name: pkgsrc
Committed By: taca
Date: Wed Sep 16 15:00:10 UTC 2026
Modified Files:
pkgsrc/lang/ruby: rubyversion.mk
pkgsrc/lang/ruby34: Makefile distinfo
Added Files:
pkgsrc/lang/ruby34/patches: patch-lib_resolv.rb
Log Message:
lang/ruby34: update resolv gem
Update resolv gem to 0.7.2 to fix CVE-2026-80212 and CVE-2026-80213.
Bump PKGREVISION.
To generate a diff of this commit:
cvs rdiff -u -r1.330 -r1.331 pkgsrc/lang/ruby/rubyversion.mk
cvs rdiff -u -r1.11 -r1.12 pkgsrc/lang/ruby34/Makefile
cvs rdiff -u -r1.17 -r1.18 pkgsrc/lang/ruby34/distinfo
cvs rdiff -u -r0 -r1.3 pkgsrc/lang/ruby34/patches/patch-lib_resolv.rb
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/lang/ruby/rubyversion.mk
diff -u pkgsrc/lang/ruby/rubyversion.mk:1.330 pkgsrc/lang/ruby/rubyversion.mk:1.331
--- pkgsrc/lang/ruby/rubyversion.mk:1.330 Wed Sep 16 14:50:17 2026
+++ pkgsrc/lang/ruby/rubyversion.mk Wed Sep 16 15:00:09 2026
@@ -1,4 +1,4 @@
-# $NetBSD: rubyversion.mk,v 1.330 2026/09/16 14:50:17 taca Exp $
+# $NetBSD: rubyversion.mk,v 1.331 2026/09/16 15:00:09 taca Exp $
#
# This file determines which Ruby version is used as a dependency for
@@ -397,7 +397,7 @@ RUBY_PSTORE_VER= 0.2.1
RUBY_RDOC_VER= 6.14.0
RUBY_READLINE_VER= 0.0.4
RUBY_RELINE_VER= 0.6.0
-RUBY_RESOLV_VER= 0.7.1
+RUBY_RESOLV_VER= 0.7.2
RUBY_RUBY2_KEYWORDS_VER= 0.0.5
RUBY_SECURERANDOM_VER= 0.4.1
RUBY_SET_VER= 1.1.1
Index: pkgsrc/lang/ruby34/Makefile
diff -u pkgsrc/lang/ruby34/Makefile:1.11 pkgsrc/lang/ruby34/Makefile:1.12
--- pkgsrc/lang/ruby34/Makefile:1.11 Sun Sep 6 15:12:19 2026
+++ pkgsrc/lang/ruby34/Makefile Wed Sep 16 15:00:10 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.11 2026/09/06 15:12:19 kikadf Exp $
+# $NetBSD: Makefile,v 1.12 2026/09/16 15:00:10 taca Exp $
DISTNAME= ${RUBY_DISTNAME}
PKGNAME= ${RUBY_PKGPREFIX}-${RUBY_VERSION}
-PKGREVISION= 1
+PKGREVISION= 2
CATEGORIES= lang ruby
MASTER_SITES= ${MASTER_SITE_RUBY}
Index: pkgsrc/lang/ruby34/distinfo
diff -u pkgsrc/lang/ruby34/distinfo:1.17 pkgsrc/lang/ruby34/distinfo:1.18
--- pkgsrc/lang/ruby34/distinfo:1.17 Sun Sep 6 15:12:19 2026
+++ pkgsrc/lang/ruby34/distinfo Wed Sep 16 15:00:10 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.17 2026/09/06 15:12:19 kikadf Exp $
+$NetBSD: distinfo,v 1.18 2026/09/16 15:00:10 taca Exp $
BLAKE2s (ruby-3.4.10.tar.xz) = f572159895927752a9dc04403c0ba186008aa8e3cf3c340eddb441444c48ac71
SHA512 (ruby-3.4.10.tar.xz) = c28d59946c0a1b8e4385a772e0651c6f4154c18ab8a2a62289c3213eb4fe937cec0942e0076cda429576e58ad277b18f4b5611e644d15b122c1cd96baf10f284
@@ -10,6 +10,7 @@ SHA1 (patch-include_ruby_internal_static
SHA1 (patch-lib_mkmf.rb) = ea66bc4e42d2b15edfcd8ceefa9b94d07a3cdd0f
SHA1 (patch-lib_rdoc_encoding.rb) = aea07b878cbf46ddfdc0364ca5adf3fda9311735
SHA1 (patch-lib_rdoc_parser_c.rb) = 5d97f938379b05443438e8ae841d56c321a22c1a
+SHA1 (patch-lib_resolv.rb) = 2cc29bff6154d09b20f453b386e495d07f1b2add
SHA1 (patch-lib_rubygems.rb) = 81af71ae9b0c3fef2ad1de88a542b3ece14b4519
SHA1 (patch-lib_rubygems_commands_setup__command.rb) = 66c475a5308deb2ed5096b88cf65549732f87421
SHA1 (patch-lib_rubygems_config__file.rb) = 584f8cd9ef1d1b9bf25efc7e85c2219166db7ac9
Added files:
Index: pkgsrc/lang/ruby34/patches/patch-lib_resolv.rb
diff -u /dev/null pkgsrc/lang/ruby34/patches/patch-lib_resolv.rb:1.3
--- /dev/null Wed Sep 16 15:00:10 2026
+++ pkgsrc/lang/ruby34/patches/patch-lib_resolv.rb Wed Sep 16 15:00:10 2026
@@ -0,0 +1,186 @@
+$NetBSD: patch-lib_resolv.rb,v 1.3 2026/09/16 15:00:10 taca Exp $
+
+Update resolv gem to 0.7.2.
+
+--- lib/resolv.rb.orig 2026-06-30 10:54:35.000000000 +0000
++++ lib/resolv.rb
+@@ -35,7 +35,7 @@ require 'rbconfig'
+ class Resolv
+
+ # The version string
+- VERSION = "0.7.1"
++ VERSION = "0.7.2"
+
+ ##
+ # Looks up the first IP address for +name+.
+@@ -1253,6 +1253,13 @@ class Resolv
+
+ class Str # :nodoc:
+ def initialize(string)
++ # A label is limited to 63 octets. [RFC 1035 2.3.4] Checking it here
++ # makes it an invariant of the object: every label, however it was
++ # built, fits in its length octet and cannot wrap it. Callers turn
++ # this into the error their own contract promises.
++ if string.bytesize > 63
++ raise ArgumentError, "DNS label is too long (#{string.bytesize} bytes, max 63): #{string.inspect}"
++ end
+ @string = string
+ # case insensivity of DNS labels doesn't apply non-ASCII characters. [RFC 4343]
+ # This assumes @string is given in ASCII compatible encoding.
+@@ -1298,7 +1305,26 @@ class Resolv
+ when Name
+ return arg
+ when String
+- return Name.new(Label.split(arg), /\.\z/ =~ arg ? true : false)
++ # A hostname is runtime data rather than a programming mistake, so
++ # both size limits surface as ResolvError to stay rescuable alongside
++ # the rest of name resolution. The type check below is a caller
++ # mistake and keeps raising ArgumentError.
++ begin
++ labels = Label.split(arg)
++ rescue ArgumentError => e
++ raise ResolvError.new(e.message)
++ end
++ # Label::Str enforces the per-label limit. Only the total is knowable
++ # here, and it counts the encoded form, so size starts at 1 for the
++ # root label's terminating zero octet. [RFC 1035 2.3.4, 3.1]
++ size = 1
++ labels.each do |label|
++ size += 1 + label.string.bytesize
++ if size > 255
++ raise ResolvError.new("DNS name is too long (#{size} octets, max 255): #{arg.inspect}")
++ end
++ end
++ return Name.new(labels, /\.\z/ =~ arg ? true : false)
+ else
+ raise ArgumentError.new("cannot interpret as DNS name: #{arg.inspect}")
+ end
+@@ -1420,12 +1446,24 @@ class Resolv
+ @rd == other.rd &&
+ @ra == other.ra &&
+ @rcode == other.rcode &&
+- @question == other.question &&
++ question_equal?(other.question) &&
+ @answer == other.answer &&
+ @authority == other.authority &&
+ @additional == other.additional
+ end
+
++ # A question holds the resource class itself, and decoding creates a fresh
++ # class for each unknown type, so the classes cannot be compared by
++ # identity alone.
++ private def question_equal?(other_question) # :nodoc:
++ return false unless @question.length == other_question.length
++ @question.zip(other_question) {|(name, typeclass), (o_name, o_typeclass)|
++ return false unless name == o_name &&
++ Resource::Generic.type_class_equal?(typeclass, o_typeclass)
++ }
++ return true
++ end
++
+ def add_question(name, typeclass)
+ @question << [Name.create(name), typeclass]
+ end
+@@ -1532,8 +1570,15 @@ class Resolv
+ end
+
+ def put_string(d)
+- self.put_pack("C", d.length)
+- @data << d
++ s = d.to_s
++ # A character-string is prefixed by a single length octet, so it can
++ # hold at most 255 octets. [RFC 1035 3.3] Reject anything longer to
++ # avoid silently truncating the length to its low 8 bits (mod 256).
++ if s.bytesize > 255
++ raise ArgumentError, "character-string is too long (#{s.bytesize} bytes, max 255): #{s.inspect}"
++ end
++ self.put_pack("C", s.bytesize)
++ @data << s
+ end
+
+ def put_string_list(ds)
+@@ -1563,7 +1608,17 @@ class Resolv
+ end
+
+ def put_label(d)
+- self.put_string(d.to_s)
++ s = d.to_s
++ # Label::Str applies this limit when a label is built, so what is left
++ # for here is a raw string handed straight to put_labels. The two ways
++ # an over-long label goes wrong differ: 64 to 255 octets write a length
++ # octet in the reserved or compression pointer range, and 256 or more
++ # wrap it mod 256. Either way the encoded name stops being the name the
++ # caller asked for. [RFC 1035 2.3.4, 4.1.4]
++ if s.bytesize > 63
++ raise ArgumentError, "DNS label is too long (#{s.bytesize} bytes, max 63): #{s.inspect}"
++ end
++ self.put_string(s)
+ end
+ end
+
+@@ -1689,7 +1744,9 @@ class Resolv
+ prev_index = @index
+ save_index = nil
+ d = []
+- size = -1
++ # size counts the encoded form, so it starts at 1 for the root
++ # label's terminating zero octet. [RFC 1035 3.1]
++ size = 1
+ while true
+ raise DecodeError.new("limit exceeded") if @limit <= @index
+ case @data.getbyte(@index)
+@@ -1720,6 +1777,11 @@ class Resolv
+
+ def get_label
+ return Label::Str.new(self.get_string)
++ rescue ArgumentError => e
++ # A length octet of 64..191 is reserved rather than a label length,
++ # but this decoder used to read it as one. [RFC 1035 4.1.4] Report it
++ # the way the rest of a malformed message is reported.
++ raise DecodeError.new(e.message)
+ end
+
+ def get_question
+@@ -1907,8 +1969,9 @@ class Resolv
+ key_name = :"key#{key_number}"
+ c.const_set(:KeyName, key_name)
+ c.const_set(:KeyNumber, key_number)
+- self.const_set(:"Key#{key_number}", c)
+- ClassHash[key_name] = ClassHash[key_number] = c
++ # Not registered in a constant or in ClassHash. ClassHash creates a
++ # class for every unknown SvcParamKey, so registering them
++ # permanently would let a malicious response exhaust memory.
+ return c
+ end
+ end
+@@ -2215,12 +2278,28 @@ class Resolv
+ return self.new(msg.get_bytes)
+ end
+
++ # create makes a fresh class for each decoded resource, so the type and
++ # class values have to be compared instead of the class itself.
++ def self.type_class_equal?(klass, other) # :nodoc:
++ return true if klass.equal?(other)
++ Generic > klass && Generic > other &&
++ klass::TypeValue == other::TypeValue &&
++ klass::ClassValue == other::ClassValue
++ end
++
++ def ==(other) # :nodoc:
++ return other.is_a?(Generic) &&
++ Generic.type_class_equal?(self.class, other.class) &&
++ @data == other.data
++ end
++
+ def self.create(type_value, class_value) # :nodoc:
+ c = Class.new(Generic)
+ c.const_set(:TypeValue, type_value)
+ c.const_set(:ClassValue, class_value)
+- Generic.const_set("Type#{type_value}_Class#{class_value}", c)
+- ClassHash[[type_value, class_value]] = c
++ # Not registered in a constant or in ClassHash. get_class creates a
++ # class for every unknown (type, class) pair, so registering them
++ # permanently would let a malicious response exhaust memory.
+ return c
+ end
+ end
Home |
Main Index |
Thread Index |
Old Index