Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libhtp for openSUSE:Factory checked in at 2026-09-04 12:39:11 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libhtp (Old) and /work/SRC/openSUSE:Factory/.libhtp.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libhtp" Fri Sep 4 12:39:11 2026 rev:22 rq:1375461 version:0.5.53 Changes: -------- --- /work/SRC/openSUSE:Factory/libhtp/libhtp.changes 2025-07-10 22:11:28.434031794 +0200 +++ /work/SRC/openSUSE:Factory/.libhtp.new.1265/libhtp.changes 2026-09-04 12:40:00.922752935 +0200 @@ -1,0 +2,11 @@ +Sat Aug 22 16:21:26 UTC 2026 - Dirk Müller <[email protected]> + +- update to 0.5.53: + * htp: checks a hostname does not begin with a slash + * htp: typo fix for Content-Encoding: identity + * ci: bump version for cifuzz upload-artifact action + * htp: do not log anomaly for Content-Encoding: identity + * decompressors: fix leak in lzma error case + * request: do not fully error on data after HTTP/0.9 + +------------------------------------------------------------------- Old: ---- libhtp-0.5.50.tar.gz New: ---- libhtp-0.5.53.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libhtp.spec ++++++ --- /var/tmp/diff_new_pack.FSrzv6/_old 2026-09-04 12:40:01.594776534 +0200 +++ /var/tmp/diff_new_pack.FSrzv6/_new 2026-09-04 12:40:01.596776604 +0200 @@ -1,7 +1,7 @@ # # spec file for package libhtp # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # Copyright (c) 2024 Andreas Stieger <[email protected]> # # All modifications and additions to the file contributed by third parties @@ -21,7 +21,7 @@ %define lname %{name}%{sover} %bcond_without tests Name: libhtp -Version: 0.5.50 +Version: 0.5.53 Release: 0 Summary: HTTP normalizer and parser License: BSD-3-Clause ++++++ libhtp-0.5.50.tar.gz -> libhtp-0.5.53.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libhtp-0.5.50/.github/workflows/cifuzz.yml new/libhtp-0.5.53/.github/workflows/cifuzz.yml --- old/libhtp-0.5.50/.github/workflows/cifuzz.yml 2025-03-18 06:53:49.000000000 +0100 +++ new/libhtp-0.5.53/.github/workflows/cifuzz.yml 2026-03-11 21:28:41.000000000 +0100 @@ -19,7 +19,7 @@ dry-run: false language: c++ - name: Upload Crash - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 if: failure() && steps.build.outcome == 'success' with: name: artifacts diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libhtp-0.5.50/ChangeLog new/libhtp-0.5.53/ChangeLog --- old/libhtp-0.5.50/ChangeLog 2025-03-18 06:53:49.000000000 +0100 +++ new/libhtp-0.5.53/ChangeLog 2026-03-11 21:28:41.000000000 +0100 @@ -1,3 +1,24 @@ +0.5.53 (11 March 2026) +---------------------- + +- htp: checks a hostname does not begin with a slash + +0.5.52 (15 September 2025) +-------------------------- + +- htp: typo fix for Content-Encoding: identity + +- ci: bump version for cifuzz upload-artifact action + +- htp: do not log anomaly for Content-Encoding: identity + +0.5.51 (07 July 2025) +--------------------- + +- decompressors: fix leak in lzma error case + +- request: do not fully error on data after HTTP/0.9 + 0.5.50 (18 March 2025) ---------------------- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libhtp-0.5.50/VERSION new/libhtp-0.5.53/VERSION --- old/libhtp-0.5.50/VERSION 2025-03-18 06:53:49.000000000 +0100 +++ new/libhtp-0.5.53/VERSION 2026-03-11 21:28:41.000000000 +0100 @@ -1,2 +1,2 @@ # This file is intended to be sourced by sh -PKG_VERSION=0.5.50 +PKG_VERSION=0.5.53 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libhtp-0.5.50/htp/htp_decompressors.c new/libhtp-0.5.53/htp/htp_decompressors.c --- old/libhtp-0.5.50/htp/htp_decompressors.c 2025-03-18 06:53:49.000000000 +0100 +++ new/libhtp-0.5.53/htp/htp_decompressors.c 2026-03-11 21:28:41.000000000 +0100 @@ -350,6 +350,9 @@ // There is data even if there is an error // So use this data and log a warning htp_log(d->tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "GZip decompressor: inflate failed with %d", rc); + if (drec->zlib_initialized == HTP_COMPRESSION_LZMA) { + LzmaDec_Free(&drec->state, &lzma_Alloc); + } drec->zlib_initialized = HTP_COMPRESSION_OVER; return HTP_ERROR; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libhtp-0.5.50/htp/htp_request.c new/libhtp-0.5.53/htp/htp_request.c --- old/libhtp-0.5.50/htp/htp_request.c 2025-03-18 06:53:49.000000000 +0100 +++ new/libhtp-0.5.53/htp/htp_request.c 2026-03-11 21:28:41.000000000 +0100 @@ -1006,7 +1006,8 @@ } // Sanity check: we must have a transaction pointer if the state is not IDLE (no inbound transaction) - if ((connp->in_tx == NULL)&&(connp->in_state != htp_connp_REQ_IDLE)) { + if ((connp->in_tx == NULL)&& + (connp->in_state != htp_connp_REQ_IDLE && connp->in_state != htp_connp_REQ_IGNORE_DATA_AFTER_HTTP_0_9)) { connp->in_status = HTP_STREAM_ERROR; htp_log(connp, HTP_LOG_MARK, HTP_LOG_ERROR, 0, "Missing inbound transaction data"); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libhtp-0.5.50/htp/htp_transaction.c new/libhtp-0.5.53/htp/htp_transaction.c --- old/libhtp-0.5.50/htp/htp_transaction.c 2025-03-18 06:53:49.000000000 +0100 +++ new/libhtp-0.5.53/htp/htp_transaction.c 2026-03-11 21:28:41.000000000 +0100 @@ -1347,7 +1347,8 @@ tx->response_content_encoding = HTP_COMPRESSION_DEFLATE; } else if (bstr_cmp_c_nocasenorzero(ce->value, "lzma") == 0) { tx->response_content_encoding = HTP_COMPRESSION_LZMA; - } else if (bstr_cmp_c_nocasenorzero(ce->value, "inflate") == 0) { + } else if (bstr_cmp_c_nocasenorzero(ce->value, "inflate") == 0 || + bstr_cmp_c_nocasenorzero(ce->value, "identity") == 0) { // ignore } else { /* exceptional cases: enter slow path */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libhtp-0.5.50/htp/htp_util.c new/libhtp-0.5.53/htp/htp_util.c --- old/libhtp-0.5.50/htp/htp_util.c 2025-03-18 06:53:49.000000000 +0100 +++ new/libhtp-0.5.53/htp/htp_util.c 2026-03-11 21:28:41.000000000 +0100 @@ -623,6 +623,12 @@ unsigned char *colon = memchr(data, ':', len); if (colon == NULL) { // Hostname alone, no port. + if (data[0] == '/' && (len == 1 || data[1] != '/')) { + //If it starts with "//", we should skip (might have parsed a scheme and no creds) + //If it starts with '/', this is a path, not a hostname + *invalid = 1; + return HTP_OK; + } *hostname = bstr_dup_mem(data, len); if (*hostname == NULL) return HTP_ERROR;
