From nobody Tue Dec 23 10:55:22 2025 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dbBk24P2wz6L9pV for ; Tue, 23 Dec 2025 10:55:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dbBk215RXz3r4m for ; Tue, 23 Dec 2025 10:55:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1766487322; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FclKu4k65SeHbuCW7Tghm4X6KVKbk/fhvO9nCAfJX1A=; b=PqlEi8khWaTgi/tMtGO2A/+Gj2HzBiwyexpQAuGSLhMP/7JMU+gLIGTVZVGTcCKloXtsgd HkPo88BJF6/oIcGu0RHozwE7tAxoHtVYORWs73z8K3TJc7W1+LtbbAF2Enb2zHkW+aiJl7 O53ayocerheTx4Y9iBUxGnys2ddAdSmbMzgP01V/sk4+BHifA7qbOtgMv9NcGcmzzWcWrE j/QQBrjxu0TE+imphOh728/q9aXNLGwth71GEAyJPw9EPCaV3RwfAJmMyMe4yKz1vSHHxL cUR30+OxnsB5TloiTFdDqEWAnMzlk7dhTnDqfhV7mm1as6B7QwBDXl9l0ERqRg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1766487322; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FclKu4k65SeHbuCW7Tghm4X6KVKbk/fhvO9nCAfJX1A=; b=sxG9r9jh2RJHECdHcEPJKt6dC28aG+BAY1CVEnEsGDnPDDwxXvrV2HhEhgFEGMDn19D6ZU 4ONk5vukR763XukiJ3lPNWm21xgGyuhwlJPXf41C6pb/EuaG+jOviMZJ4kDxuk2L6HsWNU 8vTXy1hfLauG80IHW/CiG8HTvc5p/ck9eWl04k1zWfdN21tVuEpM2A6xhgbfEDZGjZKCF8 G9Y5RZZuVbN0hxodaj3mgTluEWrsah3URIOD8fq2Ibz3Tr4OYY3o4if7MRwbjTAw5yhPlc MMGTr8cdMUORCJtIUvEJBXFm/c/cfuYa9+EvaM/tvQpFY58641TpSzkmumtUcg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1766487322; a=rsa-sha256; cv=none; b=leg6hdIQgZc/UKOBoa7RNAkSdPzk7H3q0QbKzw/Pt888ZqcZhqa4g+zcnNwt8UcqVXxFiJ y2GVY4uEYfPmn8TIq1oIZipMaErUNZeXhFoOdM7zX99cy15BOx17fY4LpsHG8d0Bx0KDbx AEWhcqjz/FajizujdP8ndSLnVTlT88AgFLi3AkVatX71fmhN48y3natY+KdgQ6xRCyDR75 kXPJogIdgUSZ+366fB4Y1cXQB/T8LSgsHubgh7yW3QZzHKnby85JyqX5yzvKNBYRkLy/q/ DDviyRoFg/mvzbMSdzaOQvvvTykwWFPNNAvUuGPeDrQmNmibfdRIOehjzwZ+CA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dbBk208h6z187t for ; Tue, 23 Dec 2025 10:55:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id f41d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 23 Dec 2025 10:55:22 +0000 To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Cc: leper From: Renato Botelho Subject: git: a0bac3ef72b2 - main - net/igmpproxy: Fix buffer overflow and use after free List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: garga X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: a0bac3ef72b259e93cafefe1c39e146bbe23fce2 Auto-Submitted: auto-generated Date: Tue, 23 Dec 2025 10:55:22 +0000 Message-Id: <694a751a.f41d.6ee346e4@gitrepo.freebsd.org> The branch main has been updated by garga: URL: https://cgit.FreeBSD.org/ports/commit/?id=a0bac3ef72b259e93cafefe1c39e146bbe23fce2 commit a0bac3ef72b259e93cafefe1c39e146bbe23fce2 Author: leper AuthorDate: 2025-07-13 22:48:24 +0000 Commit: Renato Botelho CommitDate: 2025-12-23 10:54:45 +0000 net/igmpproxy: Fix buffer overflow and use after free Taken from upstream pull requests: https://github.com/pali/igmpproxy/pull/98 https://github.com/pali/igmpproxy/pull/99 PR: 291642 MFH: 2025Q4 --- net/igmpproxy/Makefile | 3 +- .../files/patch-fix-buffer-overflow_igmp.c | 22 +++++++++++++++ net/igmpproxy/files/patch-src_rttable.c | 33 ++++++++++++++++++++++ 3 files changed, 56 insertions(+), 2 deletions(-) diff --git a/net/igmpproxy/Makefile b/net/igmpproxy/Makefile index d11554273288..5375fea7dff7 100644 --- a/net/igmpproxy/Makefile +++ b/net/igmpproxy/Makefile @@ -1,6 +1,6 @@ PORTNAME= igmpproxy DISTVERSION= 0.4 -PORTREVISION= 2 +PORTREVISION= 3 PORTEPOCH= 1 CATEGORIES= net @@ -15,7 +15,6 @@ USES= autoreconf USE_GITHUB= yes GH_ACCOUNT= pali GNU_CONFIGURE= yes -GNU_CONFIGURE_MANPREFIX=${PREFIX}/share USE_RC_SUBR= igmpproxy post-install: diff --git a/net/igmpproxy/files/patch-fix-buffer-overflow_igmp.c b/net/igmpproxy/files/patch-fix-buffer-overflow_igmp.c new file mode 100644 index 000000000000..47f7a0b5866b --- /dev/null +++ b/net/igmpproxy/files/patch-fix-buffer-overflow_igmp.c @@ -0,0 +1,22 @@ +From 2b30c36e6ab5b21defb76ec6458ab7687984484c Mon Sep 17 00:00:00 2001 +From: Jan Klemkow +Date: Thu, 17 Apr 2025 19:02:16 +0200 +Subject: [PATCH] Fix Buffer Overflow #97 + +--- + src/igmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/igmp.c b/src/igmp.c +index a80c4e5..838694c 100644 +--- src/igmp.c ++++ src/igmp.c +@@ -94,7 +94,7 @@ static const char *igmpPacketKind(unsigned int type, unsigned int code) { + case IGMP_V2_LEAVE_GROUP: return "Leave message "; + + default: +- sprintf(unknown, "unk: 0x%02x/0x%02x ", type, code); ++ snprintf(unknown, sizeof unknown, "unk: 0x%02x/0x%02x ", type, code); + return unknown; + } + } diff --git a/net/igmpproxy/files/patch-src_rttable.c b/net/igmpproxy/files/patch-src_rttable.c new file mode 100644 index 000000000000..14cdf8b868fe --- /dev/null +++ b/net/igmpproxy/files/patch-src_rttable.c @@ -0,0 +1,33 @@ +From e49fb373da9044dfb00ffbcd3e1f68ca7107af75 Mon Sep 17 00:00:00 2001 +From: Jan Klemkow +Date: Thu, 17 Apr 2025 18:53:18 +0200 +Subject: [PATCH] Fix use after free(3) in internAgeRoute(). + +removeRoute(croute) calls free(croute). Thus, the zeroing of +croute->ageVifBits afterwards is unnecessary, illegal and an +undefined behavior. +--- + src/rttable.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/rttable.c b/src/rttable.c +index bcafa3fe..04e24f3b 100644 +--- src/rttable.c ++++ src/rttable.c +@@ -704,13 +704,15 @@ int internAgeRoute(struct RouteTable* croute) { + + // No activity was registered within the timelimit, so remove the route. + removeRoute(croute); ++ croute = NULL; + } + // Tell that the route was updated... + result = 1; + } + + // The aging vif bits must be reset for each round... +- BIT_ZERO(croute->ageVifBits); ++ if (croute != NULL) ++ BIT_ZERO(croute->ageVifBits); + + return result; + }