git: 7bcce8a1bb5c - main - security/openvpn: Update 2.7.4 => 2.7.5 (fix 6 CVEs)

The branch main has been updated by vvd:

URL: https://cgit.FreeBSD.org/ports/commit/?id=7bcce8a1bb5c23d738b378619625289403dffe37

commit 7bcce8a1bb5c23d738b378619625289403dffe37
Author:     Matthias Andree <mandree@FreeBSD.org>
AuthorDate: 2026-07-01 20:01:15 +0000
Commit:     Vladimir Druzenko <vvd@FreeBSD.org>
CommitDate: 2026-07-01 20:08:53 +0000

    security/openvpn: Update 2.7.4 => 2.7.5 (fix 6 CVEs)
    
    Changelog:
    https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst
    
    The upstream's signing sub-key expired yesterday, new key provided via
    https://swupdate.openvpn.net/community/keys/gpgkey-F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7.gpg
    
    PR:             296429
    Security:       ffa897a0-756f-11f1-b291-a74de6bb0320
    Security:       CVE-2026-11771
    Security:       CVE-2026-12932
    Security:       CVE-2026-12996
    Security:       CVE-2026-13117
    Security:       CVE-2026-13122
    Security:       CVE-2026-13698
    Sponsored by:   UNIS Labs
    MFH:            2026Q2
---
 security/openvpn/Makefile                         |  5 ++---
 security/openvpn/distinfo                         |  6 +++---
 security/openvpn/files/patch-src_openvpn_buffer.c | 14 ++++++++++++++
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/security/openvpn/Makefile b/security/openvpn/Makefile
index b2a2690571c3..a4e7892bf6e7 100644
--- a/security/openvpn/Makefile
+++ b/security/openvpn/Makefile
@@ -1,10 +1,9 @@
 PORTNAME=		openvpn
-DISTVERSION=		2.7.4
+DISTVERSION=		2.7.5
 PORTREVISION?=		0
 CATEGORIES=		security net net-vpn
 MASTER_SITES=		https://swupdate.openvpn.org/community/releases/ \
-			https://build.openvpn.net/downloads/releases/ \
-			LOCAL/mandree
+			https://build.openvpn.net/downloads/releases/
 
 MAINTAINER=		mandree@FreeBSD.org
 COMMENT?=		Secure IP/Ethernet tunnel daemon
diff --git a/security/openvpn/distinfo b/security/openvpn/distinfo
index 08cc6a4d4ed6..da36120b22fb 100644
--- a/security/openvpn/distinfo
+++ b/security/openvpn/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1777517989
-SHA256 (openvpn-2.7.4.tar.gz) = 18db05f3d5eee3663db1914590044e5f96ff5cd47b6e7846c6a350806c23dbce
-SIZE (openvpn-2.7.4.tar.gz) = 2092050
+TIMESTAMP = 1782925053
+SHA256 (openvpn-2.7.5.tar.gz) = c6864b3c7d4e059c7d6ce22d1b5fa646c8b379a06af872eeb9792b6083a44ac4
+SIZE (openvpn-2.7.5.tar.gz) = 2101063
diff --git a/security/openvpn/files/patch-src_openvpn_buffer.c b/security/openvpn/files/patch-src_openvpn_buffer.c
new file mode 100644
index 000000000000..df3c8c4cc488
--- /dev/null
+++ b/security/openvpn/files/patch-src_openvpn_buffer.c
@@ -0,0 +1,14 @@
+--- src/openvpn/buffer.c.orig	2026-07-01 08:17:40 UTC
++++ src/openvpn/buffer.c
+@@ -1376,7 +1376,10 @@ buffer_read_from_file(const char *filename, struct gc_
+         return ret;
+     }
+ 
+-    const size_t size = file_stat.st_size;
++    /* for some systems, off_t is 63 bits wide + sign bit and size_t is 32 bits
++     * wide, and we need to avoid negative garbage wrapping around */
++    ASSERT(file_stat.st_size >= 0 && file_stat.st_size <= SIZE_MAX);
++    const size_t size = (size_t)file_stat.st_size;
+     ret = alloc_buf_gc(size + 1, gc); /* space for trailing \0 */
+     size_t read_size = fread(BPTR(&ret), 1, size, fp);
+     if (read_size == 0)