Stuart Henderson <[email protected]> writes: > On 2019/04/03 20:45, Nam Nguyen wrote: >> >> This is a new release of wget 1.20.2 (April 1, 2019). I successfully >> downloaded install64.iso as a test. Of note: "Fixed a buffer overflow >> vulnerability." I just wanted to get this new version out first. I will >> look into how to download the corpus of tests to reactivate fuzz tests >> in a future diff. > > Thanks, committed. I don't really see much value in adding fuzz tests > to ports if upstream doesn't see a need to include them in the main > distfile - that is more something that upstream developers would use > rather than part of the usual regression test framework. > >> Release notes: >> https://lists.gnu.org/archive/html/bug-wget/2019-04/msg00001.html >> >> Details on vulnerability: >> https://lists.gnu.org/archive/html/bug-wget/2019-02/msg00004.html >> https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=72e936e89c09bcf1a76479258881d91b0a27003f > > Those posts relate to the gnulib change which in practice isn't likely > to affect much other than cygwin crosscompiles (and is infinite recursion > not a buffer overflow). > > I *think* the buffer overflow refers to this corner-case. > > + * src/http.c (response_head_terminator): Don't access uninitialized > data > > -> > > /* p==end-2: check for \n\n directly preceding END. */ > - if (p[0] == '\n' && p[1] == '\n') > + if (peeklen >= 2 && p[0] == '\n' && p[1] == '\n') > return p + 2;
Thanks for your explanation (especially the difference between infinite recursion and buffer overflow). Here is a mailing list thread about this buffer overflow from the original reporting group, which still leaves out details. https://lists.gnu.org/archive/html/bug-wget/2019-04/msg00012.html Another unrelated buffer overflow was discovered and fixed with wget 1.20.3. https://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c Here is a diff for wget 1.20.3, released April 5, 2019. I successfully tested it on install64.iso. The ports team can decide whether it is best to add it during/after the freeze or to cvs -stable. --8<---------------cut here---------------start------------->8--- Index: Makefile =================================================================== RCS file: /cvs/ports/net/wget/Makefile,v retrieving revision 1.79 diff -u -p -r1.79 Makefile --- Makefile 4 Apr 2019 10:36:45 -0000 1.79 +++ Makefile 8 Apr 2019 00:03:30 -0000 @@ -2,7 +2,7 @@ COMMENT = retrieve files from the web via HTTP, HTTPS and FTP -DISTNAME = wget-1.20.2 +DISTNAME = wget-1.20.3 CATEGORIES = net HOMEPAGE = https://www.gnu.org/software/wget/ Index: distinfo =================================================================== RCS file: /cvs/ports/net/wget/distinfo,v retrieving revision 1.24 diff -u -p -r1.24 distinfo --- distinfo 4 Apr 2019 10:36:45 -0000 1.24 +++ distinfo 8 Apr 2019 00:03:30 -0000 @@ -1,2 +1,2 @@ -SHA256 (wget-1.20.2.tar.gz) = fkO5jLXhAjSDbr72+vJMTZbArnpIDkn/ZYEXzEeT0WY= -SIZE (wget-1.20.2.tar.gz) = 4486237 +SHA256 (wget-1.20.3.tar.gz) = MczPxmMFKNscjjoG9t7PKjcAYLmChBz6srhndAClCS4= +SIZE (wget-1.20.3.tar.gz) = 4489249 --8<---------------cut here---------------end--------------->8---
