CVS commit: pkgsrc/devel/SOPE5

["Robert Bagdan" <kikadf%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   kikadf
Date:           Sat Oct  4 14:07:29 UTC 2025

Modified Files:
        pkgsrc/devel/SOPE5: Makefile distinfo
Added Files:
        pkgsrc/devel/SOPE5/patches: patch-sope-core_NGExtensions_NGHashMap.m

Log Message:
devel/SOPE5: fix CVE-2025-53603


To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 pkgsrc/devel/SOPE5/Makefile
cvs rdiff -u -r1.6 -r1.7 pkgsrc/devel/SOPE5/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/devel/SOPE5/patches/patch-sope-core_NGExtensions_NGHashMap.m

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/SOPE5/Makefile
diff -u pkgsrc/devel/SOPE5/Makefile:1.17 pkgsrc/devel/SOPE5/Makefile:1.18
--- pkgsrc/devel/SOPE5/Makefile:1.17    Thu Apr 17 21:50:15 2025
+++ pkgsrc/devel/SOPE5/Makefile Sat Oct  4 14:07:29 2025
@@ -1,9 +1,8 @@
-#      $NetBSD: Makefile,v 1.17 2025/04/17 21:50:15 wiz Exp $
+#      $NetBSD: Makefile,v 1.18 2025/10/04 14:07:29 kikadf Exp $
 #
 
 DISTNAME=      SOPE-5.11.2
-#PKGREVISION=  1
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=Alinto/}
 GITHUB_PROJECT=        sope

Index: pkgsrc/devel/SOPE5/distinfo
diff -u pkgsrc/devel/SOPE5/distinfo:1.6 pkgsrc/devel/SOPE5/distinfo:1.7
--- pkgsrc/devel/SOPE5/distinfo:1.6     Thu Feb 20 14:38:18 2025
+++ pkgsrc/devel/SOPE5/distinfo Sat Oct  4 14:07:29 2025
@@ -1,9 +1,10 @@
-$NetBSD: distinfo,v 1.6 2025/02/20 14:38:18 manu Exp $
+$NetBSD: distinfo,v 1.7 2025/10/04 14:07:29 kikadf Exp $
 
 BLAKE2s (sope/SOPE-5.11.2.tar.gz) = 6c6a12e823ab7c2358a906885ffb63a9c436aaa2b6aff0be48c2f43271a55231
 SHA512 (sope/SOPE-5.11.2.tar.gz) = 7fe6bd7db01df21c77fc2c0e372beea6e440d301bdb81661a49b0d32aeef97dc7ae245caf7cc0767ab7109e9464feb51d2eac08e5a42d21b0ab126c7ac8caecb
 Size (sope/SOPE-5.11.2.tar.gz) = 2224833 bytes
 SHA1 (patch-general.make) = 080d097aca56c4aae59beadd0c0829c6b1798aa3
+SHA1 (patch-sope-core_NGExtensions_NGHashMap.m) = 2405ae1d45dc2c98b68553930e707a5bf774b809
 SHA1 (patch-sope-core_NGStreams_NGActiveSocket.m) = 96a8452c9fd655c7d56fa2f43cb18a20d51e17bd
 SHA1 (patch-sope-core_NGStreams_NGDescriptorFunctions.m) = 6560f602033ddeba52d96175e244921423bb6671
 SHA1 (patch-sope-core_NGStreams_NGLocalSocketAddress.m) = 26288c147ef39ef3a63bc03cc83be123b364d206

Added files:

Index: pkgsrc/devel/SOPE5/patches/patch-sope-core_NGExtensions_NGHashMap.m
diff -u /dev/null pkgsrc/devel/SOPE5/patches/patch-sope-core_NGExtensions_NGHashMap.m:1.1
--- /dev/null   Sat Oct  4 14:07:29 2025
+++ pkgsrc/devel/SOPE5/patches/patch-sope-core_NGExtensions_NGHashMap.m Sat Oct  4 14:07:29 2025
@@ -0,0 +1,125 @@
+$NetBSD: patch-sope-core_NGExtensions_NGHashMap.m,v 1.1 2025/10/04 14:07:29 kikadf Exp $
+
+* Fix CVE-2025-53603,
+  https://github.com/Alinto/sope/commit/e954ab0cd254dc1837af690329b04504410cbe63
+* note: remove after 5.12.3 release
+
+--- sope-core/NGExtensions/NGHashMap.m.orig    2022-04-05 15:02:10.000000000 +0000
++++ sope-core/NGExtensions/NGHashMap.m
+@@ -216,6 +216,7 @@ static inline unsigned __countObjectsFor
+   NSEnumerator *keys    = nil;
+   id            key     = nil;
+   LList *list    = NULL;
++  LList *root    = NULL;
+   LList *newList = NULL;
+   LList *oldList = NULL;
+ 
+@@ -223,7 +224,7 @@ static inline unsigned __countObjectsFor
+     keys  = [_hashMap keyEnumerator];
+     while ((key = [keys nextObject])) {
+       list           = [_hashMap __structForKey:key];
+-      newList        = initLListElement(list->object,NULL);
++      root = newList = initLListElement(list->object,NULL);
+       newList->count = list->count;
+       NSMapInsert(self->table,key,newList);
+       while (list->next) {
+@@ -232,6 +233,7 @@ static inline unsigned __countObjectsFor
+         newList       = initLListElement(list->object,NULL);
+         oldList->next = newList;
+       }
++      root->last = newList;
+     }
+   }
+   return self;
+@@ -257,6 +259,7 @@ static inline unsigned __countObjectsFor
+       pred       = element;
+     }
+     root->count = i;
++    root->last  = pred;
+     NSMapInsert(self->table,_key, root);
+   }
+   NSAssert(self->table, @"missing table for hashmap ..");
+@@ -712,6 +715,7 @@ static inline unsigned __countObjectsFor
+ {
+   id            object  = nil;
+   LList *root    = NULL;
++  LList *insert  = NULL;
+   LList *element = NULL;
+   unsigned i = 0;
+   
+@@ -728,10 +732,13 @@ static inline unsigned __countObjectsFor
+     }
+ 
+     root        = initLListElement(_objects[0], NULL);
++    insert = root;
+     root->count = _count;
++    // set root->last to last inserted element later
+     NSMapInsert(self->table, _key, root);
+   }
+   else {
++    insert = root;
+     if (!(_index < root->count)) {
+       [NSException raise:NSRangeException
+                   format:@"index %"PRIuPTR" out of range in map 0x%p length %d",
+@@ -741,30 +748,38 @@ static inline unsigned __countObjectsFor
+     
+     root->count += _count;
+     if (_index == 0) {
++      // move current data at pos 0 to new element (prepending
++      // a new element would require replacing entry in NSMapTable)
+       element         = initLListElement(_objects[0],NULL);
+       object          = element->object;
+       element->next   = root->next;
+       element->object = root->object;      
+       root->object    = object;
+       root->next      = element;
++      if (root->last == root)
++        root->last = element; // inserted at pos 0 before the only item
+     }
+     else {
+       while (--_index)
+-        root = root->next;
++        insert = insert->next;
++      if (root->last == insert)
++        root->last = NULL; // set to last inserted element later
+ 
+       element       = initLListElement(_objects[0], NULL);
+-      element->next = root->next;
+-      root->next    = element;
+-      root          = root->next;
++      element->next = insert->next;
++      insert->next    = element;
++      insert          = insert->next;
+     }
+   }
+   for (i = 1; i < _count; i++) {
+     checkForAddErrorMessage(self, _objects[i], _key);
+     element       = initLListElement(_objects[i], NULL);
+-    element->next = root->next;
+-    root->next    = element;
+-    root          = element;
++    element->next = insert->next;
++    insert->next    = element;
++    insert          = element;
+   }
++  if (root->last == NULL)
++    root->last = insert;
+ }
+ 
+ /* adding objects */
+@@ -864,6 +879,7 @@ static inline unsigned __countObjectsFor
+       root->next   = list->next;
+       root->object = list->object;
+       root->count--;
++      // cleanup root->last (could be list!) after loop below
+       if (list) free(list);
+       list = NULL;
+     }
+@@ -880,6 +896,7 @@ static inline unsigned __countObjectsFor
+         list = oldList;
+       }
+     }
++    root->last = list; // list->next is NULL, i.e. it is the last
+     root->count -= cnt;
+   }
+ }