pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: [pkgsrc-2026Q2] pkgsrc/net/libcares
Module Name: pkgsrc
Committed By: maya
Date: Thu Jul 16 14:06:45 UTC 2026
Modified Files:
pkgsrc/net/libcares [pkgsrc-2026Q2]: Makefile PLIST distinfo
Log Message:
Pullup ticket #7173 - requested by taca
net/libcares: Security fix
Revisions pulled up:
- net/libcares/Makefile 1.55
- net/libcares/PLIST 1.36
- net/libcares/distinfo 1.47
---
Module Name: pkgsrc
Committed By: wiz
Date: Mon Jul 6 21:03:09 UTC 2026
Modified Files:
pkgsrc/net/libcares: Makefile PLIST distinfo
Log Message:
libcares: update to 1.34.7.
## c-ares version 1.34.7 - July 6 2026
This is a security release.
Security:
* CVE-2026-33630. Use-after-free / double-free in c-ares' query-completion
handling, remotely triggerable via ares_getaddrinfo() over TCP. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542
* CPU-exhaustion denial of service via unbounded DNS name compression pointer
chains. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76
* Memory-amplification denial of service via unvalidated DNS header record
counts. Please see
https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
Changes:
* `ares_getaddrinfo()`: handle a NULL node per POSIX and implement
`ARES_AI_PASSIVE`. [PR #1186](https://github.com/c-ares/c-ares/pull/1186)
* Mark parameters in callbacks as const.
[PR #1060](https://github.com/c-ares/c-ares/pull/1060)
* Correct `ARES_CLASS_HESOID` misspelling to `ARES_CLASS_HESIOD`.
[PR #1092](https://github.com/c-ares/c-ares/pull/1092)
Bugfixes:
* Fix sticky server recovery when all servers have failures. [PR #1192](https://github.com/c-ares/c-ares/pull/1192)
* Fix UDP socket exhaustion regression: retire connections per-connection, not via server failure count. [PR #1197](https://github.com/c-ares/c-ares/pull/1197)
* Guard DNS record binary length overflow. [PR #1168](https://github.com/c-ares/c-ares/pull/1168)
* Prevent integer overflow in allocation size calculations. [PR #1147](https://github.com/c-ares/c-ares/pull/1147)
* Prevent overflow in ares_array allocation size calculations. [PR #1117](https://github.com/c-ares/c-ares/pull/1117)
* Prevent integer overflow in buffer size calculation. [PR #1116](https://github.com/c-ares/c-ares/pull/1116)
* Add overflow checks to ares_buf_ensure_space(). [PR #1094](https://github.com/c-ares/c-ares/pull/1094)
* Skip name compression offsets beyond the 14-bit pointer limit. [PR #1159](https://github.com/c-ares/c-ares/pull/1159)
* ares_dns_parse: reject name compression in RDATA where not permitted (RFC 3597). [PR #1190](https://github.com/c-ares/c-ares/pull/1190)
* ares_dns_parse: reject responses with more than one OPT record (RFC 6891). [PR #1189](https://github.com/c-ares/c-ares/pull/1189)
* Discard oversized UDP datagrams instead of truncating the length frame. [PR #1161](https://github.com/c-ares/c-ares/pull/1161)
* Route numeric config parsing through range-checked ares_str_parse_uint. [PR #1158](https://github.com/c-ares/c-ares/pull/1158)
* Replace atoi-based port parsing with validated helper. [PR #1097](https://github.com/c-ares/c-ares/pull/1097)
* Defer TCP connection error handling until DNS responses are parsed. [PR #1138](https://github.com/c-ares/c-ares/pull/1138)
* Prevent undefined-behavior left shift in ares_calc_query_timeout(). [PR #1151](https://github.com/c-ares/c-ares/pull/1151)
* Use unsigned type for ares_round_up_pow2_u64 to avoid undefined behavior. [PR #1107](https://github.com/c-ares/c-ares/pull/1107)
* Fix undefined behavior in ares_buf_replace() pointer arithmetic. [PR #1099](https://github.com/c-ares/c-ares/pull/1099)
* ares_array: reset offset when array becomes empty. [PR #1165](https://github.com/c-ares/c-ares/pull/1165)
* ares_iface_ips: add ARES_IFACE_IP_NONE zero enum value. [PR #1187](https://github.com/c-ares/c-ares/pull/1187)
* ares_sysconfig_files: recognize AIX netsvc.conf bind4/local4 tokens. [PR #1188](https://github.com/c-ares/c-ares/pull/1188)
* Use safe string construction in Windows sysconfig join path. [PR #1143](https://github.com/c-ares/c-ares/pull/1143)
* Fix zero-length RAW_RR losing type metadata during parsing. [PR #1129](https://github.com/c-ares/c-ares/pull/1129)
* Fix RAW_RR type tostr/fromstr roundtrip mismatch. [PR #1123](https://github.com/c-ares/c-ares/pull/1123)
* Fix NULL dereference for ifa netmask. [PR #1120](https://github.com/c-ares/c-ares/pull/1120)
* adig: fix negated option prefix parsing. [PR #1135](https://github.com/c-ares/c-ares/pull/1135)
* Use UnregisterWaitEx to prevent use-after-free on Win32. [PR #1111](https://github.com/c-ares/c-ares/pull/1111)
* Add NULL check after ares_malloc_zero in Windows UTF8 conversion. [PR #1121](https://github.com/c-ares/c-ares/pull/1121)
* Fix NULL dereference after ares_malloc_zero in Win32 IOCP event add. [PR #1132](https://github.com/c-ares/c-ares/pull/1132)
* Fix microsecond overflow in ares_queue_wait_empty timeout. [PR #1122](https://github.com/c-ares/c-ares/pull/1122)
* Fix NULL dereference in ares_buf_replace() on NULL buf. [PR #1124](https://github.com/c-ares/c-ares/pull/1124)
* Initialize *read_bytes in ares_socket_recvfrom(). [PR #1125](https://github.com/c-ares/c-ares/pull/1125)
* Fix memory leak of binbuf in ares_buf_parse_dns_binstr_int. [PR #1126](https://github.com/c-ares/c-ares/pull/1126)
* Fix memory leak of qcache entry on key allocation failure. [PR #1127](https://github.com/c-ares/c-ares/pull/1127)
* Fix memory leak of buf in ares_dns_multistring_combined() on OOM. [PR #1110](https://github.com/c-ares/c-ares/pull/1110)
* Fix memory leaks on error paths in two functions. [PR #1109](https://github.com/c-ares/c-ares/pull/1109)
* Fix memory leak of buckets in ares_htable_dict_keys() error path. [PR #1108](https://github.com/c-ares/c-ares/pull/1108)
* Fix memory leak of bucket->key in ares_htable_dict_insert error path. [PR #1105](https://github.com/c-ares/c-ares/pull/1105)
* Fix additional memory leaks. [PR #1091](https://github.com/c-ares/c-ares/pull/1091) [PR #1078](https://github.com/c-ares/c-ares/pull/1078)
* Prevent corrupt addrinfo nodes on sockaddr allocation failure. [PR #1112](https://github.com/c-ares/c-ares/pull/1112)
* Fix two logic bugs in DNS cookie handling. [PR #1103](https://github.com/c-ares/c-ares/pull/1103)
* Fix linked list INSERT_BEFORE corruption and array insertdata_first ordering. [PR #1101](https://github.com/c-ares/c-ares/pull/1101)
* Fix HASH_IDX macro missing parentheses. [PR #1128](https://github.com/c-ares/c-ares/pull/1128)
* Fix malloc(0) in ares_htable_all_buckets on empty table. [PR #1131](https://github.com/c-ares/c-ares/pull/1131)
* Fix wrong sizeof in QNX confstr() call truncating domain names. [PR #1130](https://github.com/c-ares/c-ares/pull/1130)
* Clear probe pending flag after timeout. [PR #1059](https://github.com/c-ares/c-ares/pull/1059)
* Fix incorrect check for empty wide string. [PR #1064](https://github.com/c-ares/c-ares/pull/1064)
* Handle strdup failure. [PR #1077](https://github.com/c-ares/c-ares/pull/1077)
* doc: reference ares_free_string(), not ares_free(). [PR #1084](https://github.com/c-ares/c-ares/pull/1084)
To generate a diff of this commit:
cvs rdiff -u -r1.54 -r1.54.6.1 pkgsrc/net/libcares/Makefile
cvs rdiff -u -r1.35 -r1.35.6.1 pkgsrc/net/libcares/PLIST
cvs rdiff -u -r1.46 -r1.46.6.1 pkgsrc/net/libcares/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/net/libcares/Makefile
diff -u pkgsrc/net/libcares/Makefile:1.54 pkgsrc/net/libcares/Makefile:1.54.6.1
--- pkgsrc/net/libcares/Makefile:1.54 Mon Dec 8 23:37:49 2025
+++ pkgsrc/net/libcares/Makefile Thu Jul 16 14:06:45 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.54 2025/12/08 23:37:49 wiz Exp $
+# $NetBSD: Makefile,v 1.54.6.1 2026/07/16 14:06:45 maya Exp $
-DISTNAME= c-ares-1.34.6
+DISTNAME= c-ares-1.34.7
PKGNAME= ${DISTNAME:S/c-/libc/1}
CATEGORIES= net
MASTER_SITES= ${MASTER_SITE_GITHUB:=c-ares/}
Index: pkgsrc/net/libcares/PLIST
diff -u pkgsrc/net/libcares/PLIST:1.35 pkgsrc/net/libcares/PLIST:1.35.6.1
--- pkgsrc/net/libcares/PLIST:1.35 Mon Dec 8 23:37:49 2025
+++ pkgsrc/net/libcares/PLIST Thu Jul 16 14:06:45 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.35 2025/12/08 23:37:49 wiz Exp $
+@comment $NetBSD: PLIST,v 1.35.6.1 2026/07/16 14:06:45 maya Exp $
bin/adig
bin/ahost
include/ares.h
@@ -14,7 +14,7 @@ lib/cmake/c-ares/c-ares-targets.cmake
lib/libcares.a
lib/libcares.so
lib/libcares.so.2
-lib/libcares.so.2.19.5
+lib/libcares.so.2.19.6
lib/pkgconfig/libcares.pc
man/man1/adig.1
man/man1/ahost.1
Index: pkgsrc/net/libcares/distinfo
diff -u pkgsrc/net/libcares/distinfo:1.46 pkgsrc/net/libcares/distinfo:1.46.6.1
--- pkgsrc/net/libcares/distinfo:1.46 Mon Dec 8 23:37:49 2025
+++ pkgsrc/net/libcares/distinfo Thu Jul 16 14:06:45 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.46 2025/12/08 23:37:49 wiz Exp $
+$NetBSD: distinfo,v 1.46.6.1 2026/07/16 14:06:45 maya Exp $
-BLAKE2s (c-ares-1.34.6.tar.gz) = 27e42cfd5e67d7f319f8dad5bea087ffe52f5efa7e24306ce1a5690ec52518dc
-SHA512 (c-ares-1.34.6.tar.gz) = 826eecdb40942caf75da982b9ca57fbe7c3e7c23af43a908683c7c1523c46b06ebac68405c26db8bf4c8b0774ca415666866249a3bde663a71c278f4ec7b1827
-Size (c-ares-1.34.6.tar.gz) = 1017864 bytes
+BLAKE2s (c-ares-1.34.7.tar.gz) = 7ae401c366ffa215727e1590277cf92f8895fdb712ebc439172ed3adf56da344
+SHA512 (c-ares-1.34.7.tar.gz) = af0924f46790ff26cd60872870421c29fb4479f6260151f8ee91e96788ac269443dccc236bc4ff96012a9e4c03c57732ab1c17c4b4f106c4b24bf497abe0b16c
+Size (c-ares-1.34.7.tar.gz) = 1034872 bytes
Home |
Main Index |
Thread Index |
Old Index