CVS commit: pkgsrc/net/inetutils

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sat Sep 26 07:03:00 UTC 2026

Modified Files:
        pkgsrc/net/inetutils: Makefile distinfo
Added Files:
        pkgsrc/net/inetutils/patches: patch-libinetutils_setsig.c

Log Message:
inetutils: fix CVE-2026-95510

Bump PKGREVISION.


To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 pkgsrc/net/inetutils/Makefile
cvs rdiff -u -r1.10 -r1.11 pkgsrc/net/inetutils/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/net/inetutils/patches/patch-libinetutils_setsig.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/inetutils/Makefile
diff -u pkgsrc/net/inetutils/Makefile:1.14 pkgsrc/net/inetutils/Makefile:1.15
--- pkgsrc/net/inetutils/Makefile:1.14  Sat Aug 15 06:46:44 2026
+++ pkgsrc/net/inetutils/Makefile       Sat Sep 26 07:02:59 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.14 2026/08/15 06:46:44 wiz Exp $
+# $NetBSD: Makefile,v 1.15 2026/09/26 07:02:59 wiz Exp $
 
 DISTNAME=      inetutils-2.8
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    net
 MASTER_SITES=  ${MASTER_SITE_GNU:=inetutils/}
 

Index: pkgsrc/net/inetutils/distinfo
diff -u pkgsrc/net/inetutils/distinfo:1.10 pkgsrc/net/inetutils/distinfo:1.11
--- pkgsrc/net/inetutils/distinfo:1.10  Sat Aug 15 06:46:44 2026
+++ pkgsrc/net/inetutils/distinfo       Sat Sep 26 07:02:59 2026
@@ -1,9 +1,10 @@
-$NetBSD: distinfo,v 1.10 2026/08/15 06:46:44 wiz Exp $
+$NetBSD: distinfo,v 1.11 2026/09/26 07:02:59 wiz Exp $
 
 BLAKE2s (inetutils-2.8.tar.gz) = 4c862ef324da6b9b1ad62d24e56de4918425776fd7d204efaaecd7cdf595e80c
 SHA512 (inetutils-2.8.tar.gz) = 00b33c9d712cf670f16dbefc963fed880088ff67f506df54fd02fdfc0f8c05d379faba5d602c8772c4dc4fd72e1fa8733777d5840784aa86e092eeb5d0f905f7
 Size (inetutils-2.8.tar.gz) = 2985957 bytes
 SHA1 (patch-libinetutils_libinetutils.h) = 4fd40c71340a90cbe606b71655555d98dfc7e2c6
+SHA1 (patch-libinetutils_setsig.c) = 15b35eaaaa714dc14fbfce958696428f15a8ec0f
 SHA1 (patch-ping_Makefile.in) = bfc193800d353496ce2dc639803c356eef7a655a
 SHA1 (patch-src_Makefile.in) = a8321822fdd68db4ec86ad232b59aaad92583297
 SHA1 (patch-src_syslogd.c) = 608579f47456d85b29520e7021c86cf80f6faa1c

Added files:

Index: pkgsrc/net/inetutils/patches/patch-libinetutils_setsig.c
diff -u /dev/null pkgsrc/net/inetutils/patches/patch-libinetutils_setsig.c:1.1
--- /dev/null   Sat Sep 26 07:03:00 2026
+++ pkgsrc/net/inetutils/patches/patch-libinetutils_setsig.c    Sat Sep 26 07:02:59 2026
@@ -0,0 +1,36 @@
+$NetBSD: patch-libinetutils_setsig.c,v 1.1 2026/09/26 07:02:59 wiz Exp $
+
+From f756321da9b964fc27fc43652b73913117883047 Mon Sep 17 00:00:00 2001
+From: Brian Mak <brian.mak%hpe.com@localhost>
+Date: Mon, 14 Sep 2026 15:44:23 -0700
+Subject: [PATCH] libinetutils: zero-initialize sigactions and sigvecs
+
+This commit fixes CVE-2026-95510.
+
+* libinetutils/setsig.c (setsig): Initialize the siactions and sigvecs
+to zero.
+Copyright-paperwork-exempt: Yes
+---
+ libinetutils/setsig.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- libinetutils/setsig.c.orig 2026-04-29 07:53:25.000000000 +0000
++++ libinetutils/setsig.c
+@@ -30,7 +30,7 @@ setsig (int sig, sighandler_t handler)
+ setsig (int sig, sighandler_t handler)
+ {
+ #ifdef HAVE_SIGACTION
+-  struct sigaction sa, osa;
++  struct sigaction sa = { 0 }, osa = { 0 };
+   sigemptyset (&sa.sa_mask);
+   sigemptyset (&osa.sa_mask);
+ # ifdef SA_RESTART
+@@ -42,7 +42,7 @@ setsig (int sig, sighandler_t handler)
+   return osa.sa_handler;
+ #else /* !HAVE_SIGACTION */
+ # ifdef HAVE_SIGVEC
+-  struct sigvec sv, osv;
++  struct sigvec sv = { 0 }, osv = { 0 };
+   sigemptyset (&sv.sv_mask);
+   sigemptyset (&osv.sv_mask);
+   sv.sv_handler = handler;