On 2026/09/28 23:04, Kirill A. Korinsky wrote:
> Folks,
>
> I had discovered that libslirp had a secirity related release which was
> issues a few day ago.
>
> Related changelog entries:
>
> - Fix bounds-check in processing OEM commands (CVE-2026-95507)
> - Fix bounds-check in dhcpv6 against MTU (CVE-2026-95508)
>
> it was tested with qemu, no regression discovered.
>
> Ok for 8.0?
The source diff between these versions looks sane, I see no issues
for it going into 8.0
> Index: Makefile
> ===================================================================
> RCS file: /home/cvs/ports/net/libslirp/Makefile,v
> diff -u -p -r1.4 Makefile
> --- Makefile 15 Jun 2026 08:19:59 -0000 1.4
> +++ Makefile 28 Sep 2026 20:55:22 -0000
> @@ -1,6 +1,6 @@
> COMMENT= general purpose TCP-IP emulator library
>
> -VER= 4.9.3
> +VER= 4.9.5
> DISTNAME= libslirp-v${VER}
> PKGNAME= libslirp-${VER}
> CATEGORIES= net
> Index: distinfo
> ===================================================================
> RCS file: /home/cvs/ports/net/libslirp/distinfo,v
> diff -u -p -r1.3 distinfo
> --- distinfo 15 Jun 2026 08:19:59 -0000 1.3
> +++ distinfo 28 Sep 2026 20:55:35 -0000
> @@ -1,2 +1,2 @@
> -SHA256 (libslirp-v4.9.3.tar.bz2) =
> yC4ixzvcPywDjlONTwycIWbe+yQCIS1hu3yxtTC6lS8=
> -SIZE (libslirp-v4.9.3.tar.bz2) = 133720
> +SHA256 (libslirp-v4.9.5.tar.bz2) =
> T1nfiWyzRep21/aLHoIIcv6qnYJVpnYfa/ig8tUUS80=
> +SIZE (libslirp-v4.9.5.tar.bz2) = 134635
> Index: patches/patch-meson_build
> ===================================================================
> RCS file: patches/patch-meson_build
> diff -N patches/patch-meson_build
> --- patches/patch-meson_build 15 Jun 2026 08:19:59 -0000 1.1
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,22 +0,0 @@
> -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
> -
> -Index: meson.build
> ---- meson.build.orig
> -+++ meson.build
> -@@ -238,6 +238,16 @@ ncsitest = executable('ncsitest', 'test/ncsitest.c',
> -
> - test('ncsi', ncsitest)
> -
> -+guestfwdtest = executable('guestfwdtest', 'test/guestfwdtest.c',
> -+ link_with: [lib],
> -+ c_args : cargs,
> -+ link_args : vflag,
> -+ include_directories: ['src'],
> -+ dependencies: libslirp_deps
> -+)
> -+
> -+test('guestfwd', guestfwdtest)
> -+
> - if install_devel
> - install_headers(['src/libslirp.h'], subdir : 'slirp')
> -
> Index: patches/patch-src_slirp_c
> ===================================================================
> RCS file: patches/patch-src_slirp_c
> diff -N patches/patch-src_slirp_c
> --- patches/patch-src_slirp_c 15 Jun 2026 08:19:59 -0000 1.1
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,21 +0,0 @@
> -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
> -
> -Index: src/slirp.c
> ---- src/slirp.c.orig
> -+++ src/slirp.c
> -@@ -1581,9 +1581,12 @@ static bool check_guestfwd(Slirp *slirp, struct in_add
> - (htonl(0x0204) & ~slirp->vnetwork_mask.s_addr);
> - }
> - if ((guest_addr->s_addr & slirp->vnetwork_mask.s_addr) !=
> -- slirp->vnetwork_addr.s_addr ||
> -- guest_addr->s_addr == slirp->vhost_addr.s_addr ||
> -- guest_addr->s_addr == slirp->vnameserver_addr.s_addr) {
> -+ slirp->vnetwork_addr.s_addr) {
> -+ return false;
> -+ }
> -+ if (!slirp->disable_dns &&
> -+ guest_addr->s_addr == slirp->vnameserver_addr.s_addr &&
> -+ guest_port == 53) {
> - return false;
> - }
> -
> Index: patches/patch-src_tcp_input_c
> ===================================================================
> RCS file: patches/patch-src_tcp_input_c
> diff -N patches/patch-src_tcp_input_c
> --- patches/patch-src_tcp_input_c 15 Jun 2026 08:19:59 -0000 1.1
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,36 +0,0 @@
> -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
> -
> -Index: src/tcp_input.c
> ---- src/tcp_input.c.orig
> -+++ src/tcp_input.c
> -@@ -600,20 +600,17 @@ findso:
> - if (af == AF_INET &&
> - (so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) ==
> - slirp->vnetwork_addr.s_addr) {
> -- if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr &&
> -- so->so_faddr.s_addr != slirp->vnameserver_addr.s_addr) {
> -- /* May be an add exec */
> -- for (ex_ptr = slirp->guestfwd_list; ex_ptr;
> -- ex_ptr = ex_ptr->ex_next) {
> -- if (ex_ptr->ex_fport == so->so_fport &&
> -- so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
> -- so->so_state |= SS_CTL;
> -- break;
> -- }
> -+ /* May be an add exec */
> -+ for (ex_ptr = slirp->guestfwd_list; ex_ptr;
> -+ ex_ptr = ex_ptr->ex_next) {
> -+ if (ex_ptr->ex_fport == so->so_fport &&
> -+ so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
> -+ so->so_state |= SS_CTL;
> -+ break;
> - }
> -- if (so->so_state & SS_CTL) {
> -- goto cont_input;
> -- }
> -+ }
> -+ if (so->so_state & SS_CTL) {
> -+ goto cont_input;
> - }
> - /* CTL_ALIAS: Do nothing, tcp_fconnect will be called on it */
> - }
> Index: patches/patch-src_tcp_subr_c
> ===================================================================
> RCS file: patches/patch-src_tcp_subr_c
> diff -N patches/patch-src_tcp_subr_c
> --- patches/patch-src_tcp_subr_c 15 Jun 2026 08:19:59 -0000 1.1
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,41 +0,0 @@
> -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
> -
> -Index: src/tcp_subr.c
> ---- src/tcp_subr.c.orig
> -+++ src/tcp_subr.c
> -@@ -992,22 +992,20 @@ int tcp_ctl(struct socket *so)
> - DEBUG_ARG("so = %p", so);
> -
> - /* TODO: IPv6 */
> -- if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr) {
> -- /* Check if it's pty_exec */
> -- for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr =
> ex_ptr->ex_next) {
> -- if (ex_ptr->ex_fport == so->so_fport &&
> -- so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
> -- if (ex_ptr->write_cb) {
> -- so->s = SLIRP_INVALID_SOCKET;
> -- so->guestfwd = ex_ptr;
> -- return 1;
> -- }
> -- DEBUG_MISC(" executing %s", ex_ptr->ex_exec);
> -- if (ex_ptr->ex_unix)
> -- return open_unix(so, ex_ptr->ex_unix);
> -- else
> -- return fork_exec(so, ex_ptr->ex_exec);
> -+ /* Check if it's pty_exec */
> -+ for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
> -+ if (ex_ptr->ex_fport == so->so_fport &&
> -+ so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
> -+ if (ex_ptr->write_cb) {
> -+ so->s = SLIRP_INVALID_SOCKET;
> -+ so->guestfwd = ex_ptr;
> -+ return 1;
> - }
> -+ DEBUG_MISC(" executing %s", ex_ptr->ex_exec);
> -+ if (ex_ptr->ex_unix)
> -+ return open_unix(so, ex_ptr->ex_unix);
> -+ else
> -+ return fork_exec(so, ex_ptr->ex_exec);
> - }
> - }
> - sb->sb_cc = slirp_fmt(sb->sb_wptr, sb->sb_datalen - (sb->sb_wptr -
> sb->sb_data),
> Index: patches/patch-test_guestfwdtest_c
> ===================================================================
> RCS file: patches/patch-test_guestfwdtest_c
> diff -N patches/patch-test_guestfwdtest_c
> --- patches/patch-test_guestfwdtest_c 15 Jun 2026 08:19:59 -0000 1.1
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,79 +0,0 @@
> -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
> -
> -Index: test/guestfwdtest.c
> ---- test/guestfwdtest.c.orig
> -+++ test/guestfwdtest.c
> -@@ -0,0 +1,73 @@
> -+/* SPDX-License-Identifier: BSD-3-Clause */
> -+
> -+#include <assert.h>
> -+#include <stddef.h>
> -+
> -+#include "libslirp.h"
> -+
> -+static slirp_ssize_t guestfwd_write(const void *buf, size_t len, void
> *opaque)
> -+{
> -+ return len;
> -+}
> -+
> -+static SlirpCb callbacks;
> -+
> -+static struct in_addr in_addr4(uint32_t addr)
> -+{
> -+ struct in_addr ret = { .s_addr = htonl(addr) };
> -+
> -+ return ret;
> -+}
> -+
> -+static Slirp *guestfwd_slirp(bool disable_dns)
> -+{
> -+ SlirpConfig config = {
> -+ .version = SLIRP_CONFIG_VERSION_MAX,
> -+ .in_enabled = true,
> -+ .vnetwork = in_addr4(0x0a000200),
> -+ .vnetmask = in_addr4(0xffffff00),
> -+ .vhost = in_addr4(0x0a000202),
> -+ .vdhcp_start = in_addr4(0x0a00020f),
> -+ .vnameserver = in_addr4(0x0a000203),
> -+ .disable_dns = disable_dns,
> -+ };
> -+
> -+ return slirp_new(&config, &callbacks, NULL);
> -+}
> -+
> -+static void assert_guestfwd(Slirp *slirp, struct in_addr addr, int port,
> -+ bool expect_ok)
> -+{
> -+ int ret;
> -+
> -+ ret = slirp_add_guestfwd(slirp, guestfwd_write, NULL, &addr, port);
> -+ assert((ret == 0) == expect_ok);
> -+
> -+ if (ret == 0) {
> -+ assert(slirp_remove_guestfwd(slirp, addr, port) == 0);
> -+ }
> -+}
> -+
> -+static void test_guestfwd_validation(void)
> -+{
> -+ struct in_addr vhost = in_addr4(0x0a000202);
> -+ struct in_addr vnameserver = in_addr4(0x0a000203);
> -+ Slirp *slirp;
> -+
> -+ slirp = guestfwd_slirp(false);
> -+ assert_guestfwd(slirp, vhost, 8080, true);
> -+ assert_guestfwd(slirp, vnameserver, 8080, true);
> -+ assert_guestfwd(slirp, vhost, 67, true);
> -+ assert_guestfwd(slirp, vhost, 69, true);
> -+ assert_guestfwd(slirp, vnameserver, 53, false);
> -+ slirp_cleanup(slirp);
> -+
> -+ slirp = guestfwd_slirp(true);
> -+ assert_guestfwd(slirp, vnameserver, 53, true);
> -+ slirp_cleanup(slirp);
> -+}
> -+
> -+int main(int argc, char *argv[])
> -+{
> -+ test_guestfwd_validation();
> -+}
>
>
> --
> wbr, Kirill
>
