Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libtirpc for openSUSE:Factory checked in at 2026-10-23 20:21:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libtirpc (Old) and /work/SRC/openSUSE:Factory/.libtirpc.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libtirpc" Fri Oct 23 20:21:18 2026 rev:65 rq:1386751 version:1.3.8 Changes: -------- --- /work/SRC/openSUSE:Factory/libtirpc/libtirpc.changes 2025-09-17 16:43:09.008126924 +0200 +++ /work/SRC/openSUSE:Factory/.libtirpc.new.2252680/libtirpc.changes 2026-10-23 20:21:33.768662435 +0200 @@ -1,0 +2,14 @@ +Sun Oct 18 10:57:16 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 1.3.8 (bsc#1285882, CVE-2026-85977, + bsc#1285881, CVE-2026-85231): + * Security hardening against malicious-data memory exhaustion: + cap decoded pmap/rpcb XDR list lengths to 1024 nodes + (CVE-2026-85977) and RPCSEC_GSS wrapped payload decoding + at 16 MB (CVE-2026-85231, authenticated remote DoS). + * Fix off-by-one allocation when building the GSS caller name. + * Export authdes_getucred and rpc_gss_getcred under a versioned + symbol node (backward compatible, soname stays libtirpc.so.3). +- Spec cleanup: drop obsolete Group tags. + +------------------------------------------------------------------- Old: ---- libtirpc-1.3.7.tar.bz2 New: ---- libtirpc-1.3.8.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libtirpc.spec ++++++ --- /var/tmp/diff_new_pack.KgL5g3/_old 2026-10-23 20:21:34.364687377 +0200 +++ /var/tmp/diff_new_pack.KgL5g3/_new 2026-10-23 20:21:34.366687461 +0200 @@ -1,7 +1,7 @@ # # spec file for package libtirpc # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,11 +18,10 @@ %define debug_package_requires libtirpc3 = %{version}-%{release} Name: libtirpc -Version: 1.3.7 +Version: 1.3.8 Release: 0 Summary: Transport Independent RPC Library License: BSD-3-Clause -Group: Development/Libraries/C and C++ URL: https://sourceforge.net/projects/libtirpc/ Source: https://download.sourceforge.net/libtirpc/%{name}-%{version}.tar.bz2 Source1: baselibs.conf @@ -37,7 +36,6 @@ %package -n libtirpc3 Summary: Transport Independent RPC Library -Group: System/Libraries Requires: libtirpc-netconfig >= %{version} %description -n libtirpc3 @@ -48,7 +46,6 @@ %package netconfig Summary: Netconfig configuration file for TI-RPC Library -Group: System/Base %description netconfig This RPM contains the netconfig configuration file and manual page for @@ -56,7 +53,6 @@ %package devel Summary: Development files for the Transport Independent RPC Library -Group: Development/Libraries/C and C++ Requires: glibc-devel Requires: libtirpc3 = %{version} ++++++ libtirpc-1.3.7.tar.bz2 -> libtirpc-1.3.8.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/INSTALL new/libtirpc-1.3.8/INSTALL --- old/libtirpc-1.3.7/INSTALL 2026-10-23 20:21:34.651699388 +0200 +++ new/libtirpc-1.3.8/INSTALL 2026-10-23 20:21:34.661699806 +0200 @@ -1 +1 @@ -symbolic link to /usr/share/automake-1.17/INSTALL +symbolic link to /usr/share/automake-1.18/INSTALL diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/Makefile.in new/libtirpc-1.3.8/Makefile.in --- old/libtirpc-1.3.7/Makefile.in 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/Makefile.in 2026-09-13 16:05:38.000000000 +0200 @@ -1,7 +1,7 @@ -# Makefile.in generated by automake 1.17 from Makefile.am. +# Makefile.in generated by automake 1.18.1 from Makefile.am. # @configure_input@ -# Copyright (C) 1994-2024 Free Software Foundation, Inc. +# Copyright (C) 1994-2025 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -631,6 +631,7 @@ distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags -rm -f cscope.out cscope.in.out cscope.po.out cscope.files + distdir: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) distdir-am @@ -706,6 +707,10 @@ tardir=$(distdir) && $(am__tar) | BZIP2=$${BZIP2--9} bzip2 -c >$(distdir).tar.bz2 $(am__post_remove_distdir) +dist-bzip3: distdir + tardir=$(distdir) && $(am__tar) | bzip3 -c >$(distdir).tar.bz3 + $(am__post_remove_distdir) + dist-lzip: distdir tardir=$(distdir) && $(am__tar) | lzip -c $${LZIP_OPT--9} >$(distdir).tar.lz $(am__post_remove_distdir) @@ -750,6 +755,8 @@ eval GZIP= gzip -dc $(distdir).tar.gz | $(am__untar) ;;\ *.tar.bz2*) \ bzip2 -dc $(distdir).tar.bz2 | $(am__untar) ;;\ + *.tar.bz3*) \ + bzip3 -dc $(distdir).tar.bz3 | $(am__untar) ;;\ *.tar.lz*) \ lzip -dc $(distdir).tar.lz | $(am__untar) ;;\ *.tar.xz*) \ @@ -943,8 +950,8 @@ .PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am \ am--refresh check check-am clean clean-cscope clean-generic \ clean-libtool cscope cscopelist-am ctags ctags-am dist \ - dist-all dist-bzip2 dist-gzip dist-lzip dist-shar dist-tarZ \ - dist-xz dist-zip dist-zstd distcheck distclean \ + dist-all dist-bzip2 dist-bzip3 dist-gzip dist-lzip dist-shar \ + dist-tarZ dist-xz dist-zip dist-zstd distcheck distclean \ distclean-generic distclean-hdr distclean-libtool \ distclean-tags distcleancheck distdir distuninstallcheck dvi \ dvi-am html html-am info info-am install install-am \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/aclocal.m4 new/libtirpc-1.3.8/aclocal.m4 --- old/libtirpc-1.3.7/aclocal.m4 2025-08-25 17:12:28.000000000 +0200 +++ new/libtirpc-1.3.8/aclocal.m4 2026-09-13 16:05:37.000000000 +0200 @@ -1,6 +1,6 @@ -# generated automatically by aclocal 1.17 -*- Autoconf -*- +# generated automatically by aclocal 1.18.1 -*- Autoconf -*- -# Copyright (C) 1996-2024 Free Software Foundation, Inc. +# Copyright (C) 1996-2025 Free Software Foundation, Inc. # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9204,7 +9204,7 @@ m4_ifndef([_LT_PROG_FC], [AC_DEFUN([_LT_PROG_FC])]) m4_ifndef([_LT_PROG_CXX], [AC_DEFUN([_LT_PROG_CXX])]) -# Copyright (C) 2002-2024 Free Software Foundation, Inc. +# Copyright (C) 2002-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9216,10 +9216,10 @@ # generated from the m4 files accompanying Automake X.Y. # (This private macro should not be called outside this file.) AC_DEFUN([AM_AUTOMAKE_VERSION], -[am__api_version='1.17' +[am__api_version='1.18' dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to dnl require some minimum version. Point them to the right macro. -m4_if([$1], [1.17], [], +m4_if([$1], [1.18.1], [], [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl ]) @@ -9235,14 +9235,14 @@ # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced. # This function is AC_REQUIREd by AM_INIT_AUTOMAKE. AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION], -[AM_AUTOMAKE_VERSION([1.17])dnl +[AM_AUTOMAKE_VERSION([1.18.1])dnl m4_ifndef([AC_AUTOCONF_VERSION], [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))]) # AM_AUX_DIR_EXPAND -*- Autoconf -*- -# Copyright (C) 2001-2024 Free Software Foundation, Inc. +# Copyright (C) 2001-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9294,7 +9294,7 @@ # AM_CONDITIONAL -*- Autoconf -*- -# Copyright (C) 1997-2024 Free Software Foundation, Inc. +# Copyright (C) 1997-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9325,7 +9325,7 @@ Usually this means the macro was only invoked conditionally.]]) fi])]) -# Copyright (C) 1999-2024 Free Software Foundation, Inc. +# Copyright (C) 1999-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9516,7 +9516,7 @@ # Generate code to set up dependency tracking. -*- Autoconf -*- -# Copyright (C) 1999-2024 Free Software Foundation, Inc. +# Copyright (C) 1999-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9584,7 +9584,7 @@ # Do all the work for Automake. -*- Autoconf -*- -# Copyright (C) 1996-2024 Free Software Foundation, Inc. +# Copyright (C) 1996-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9684,8 +9684,9 @@ AC_REQUIRE([AC_PROG_MAKE_SET])dnl AC_REQUIRE([AM_SET_LEADING_DOT])dnl _AM_IF_OPTION([tar-ustar], [_AM_PROG_TAR([ustar])], - [_AM_IF_OPTION([tar-pax], [_AM_PROG_TAR([pax])], - [_AM_PROG_TAR([v7])])]) + [_AM_IF_OPTION([tar-pax], [_AM_PROG_TAR([pax])], + [_AM_IF_OPTION([tar-v7], [_AM_PROG_TAR([v7])], + [_AM_PROG_TAR([ustar])])])]) _AM_IF_OPTION([no-dependencies],, [AC_PROVIDE_IFELSE([AC_PROG_CC], [_AM_DEPENDENCIES([CC])], @@ -9761,7 +9762,7 @@ done echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count]) -# Copyright (C) 2001-2024 Free Software Foundation, Inc. +# Copyright (C) 2001-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9782,7 +9783,7 @@ fi AC_SUBST([install_sh])]) -# Copyright (C) 2003-2024 Free Software Foundation, Inc. +# Copyright (C) 2003-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9803,7 +9804,7 @@ # Check to see how 'make' treats includes. -*- Autoconf -*- -# Copyright (C) 2001-2024 Free Software Foundation, Inc. +# Copyright (C) 2001-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9846,7 +9847,7 @@ # Fake the existence of programs that GNU maintainers use. -*- Autoconf -*- -# Copyright (C) 1997-2024 Free Software Foundation, Inc. +# Copyright (C) 1997-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9880,7 +9881,7 @@ # Helper functions for option handling. -*- Autoconf -*- -# Copyright (C) 2001-2024 Free Software Foundation, Inc. +# Copyright (C) 2001-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9909,7 +9910,7 @@ AC_DEFUN([_AM_IF_OPTION], [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])]) -# Copyright (C) 1999-2024 Free Software Foundation, Inc. +# Copyright (C) 1999-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9941,7 +9942,10 @@ break fi done - rm -f core conftest* + # aligned with autoconf, so not including core; see bug#72225. + rm -f -r a.out a.exe b.out conftest.$ac_ext conftest.$ac_objext \ + conftest.dSYM conftest1.$ac_ext conftest1.$ac_objext conftest1.dSYM \ + conftest2.$ac_ext conftest2.$ac_objext conftest2.dSYM unset am_i]) if test "$am_cv_prog_cc_c_o" != yes; then # Losing compiler, so override with the script. @@ -9956,7 +9960,7 @@ # For backward compatibility. AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])]) -# Copyright (C) 2022-2024 Free Software Foundation, Inc. +# Copyright (C) 2022-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9972,7 +9976,7 @@ AC_SUBST(am__rm_f_notfound) ]) -# Copyright (C) 2001-2024 Free Software Foundation, Inc. +# Copyright (C) 2001-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -9991,7 +9995,7 @@ # Check to make sure that the build environment is sane. -*- Autoconf -*- -# Copyright (C) 1996-2024 Free Software Foundation, Inc. +# Copyright (C) 1996-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -10160,10 +10164,12 @@ ' case `pwd` in *[[\\\"\#\$\&\'\`$am_lf]]*) + AC_MSG_RESULT([no]) AC_MSG_ERROR([unsafe absolute working directory name]);; esac case $srcdir in *[[\\\"\#\$\&\'\`$am_lf\ \ ]]*) + AC_MSG_RESULT([no]) AC_MSG_ERROR([unsafe srcdir value: '$srcdir']);; esac @@ -10216,7 +10222,7 @@ rm -f conftest.file ]) -# Copyright (C) 2009-2024 Free Software Foundation, Inc. +# Copyright (C) 2009-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -10285,9 +10291,13 @@ # empty being verbose). AC_DEFUN([AM_SILENT_RULES], [AC_REQUIRE([_AM_SILENT_RULES]) -AM_DEFAULT_VERBOSITY=m4_if([$1], [yes], [0], [1])]) +AM_DEFAULT_VERBOSITY=m4_if([$1], [yes], [0], [1])m4_newline +dnl We intentionally force a newline after the assignment, since a) nothing +dnl good can come of more text following, and b) that was the behavior +dnl before 1.17. See https://bugs.gnu.org/72267. +]) -# Copyright (C) 2001-2024 Free Software Foundation, Inc. +# Copyright (C) 2001-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -10315,7 +10325,7 @@ INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s" AC_SUBST([INSTALL_STRIP_PROGRAM])]) -# Copyright (C) 2006-2024 Free Software Foundation, Inc. +# Copyright (C) 2006-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -10334,7 +10344,7 @@ # Check how to create a tarball. -*- Autoconf -*- -# Copyright (C) 2004-2024 Free Software Foundation, Inc. +# Copyright (C) 2004-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -10469,7 +10479,7 @@ AC_SUBST([am__untar]) ]) # _AM_PROG_TAR -# Copyright (C) 2022-2024 Free Software Foundation, Inc. +# Copyright (C) 2022-2025 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/compile new/libtirpc-1.3.8/compile --- old/libtirpc-1.3.7/compile 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/compile 2026-09-13 16:05:38.000000000 +0200 @@ -1,9 +1,9 @@ #! /bin/sh # Wrapper for compilers which do not understand '-c -o'. -scriptversion=2024-06-19.01; # UTC +scriptversion=2025-06-18.21; # UTC -# Copyright (C) 1999-2024 Free Software Foundation, Inc. +# Copyright (C) 1999-2025 Free Software Foundation, Inc. # Written by Tom Tromey <[email protected]>. # # This program is free software; you can redistribute it and/or modify @@ -37,11 +37,11 @@ file_conv= -# func_file_conv build_file lazy +# func_file_conv build_file unneeded_conversions # Convert a $build file to $host form and store it in $file # Currently only supports Windows hosts. If the determined conversion -# type is listed in (the comma separated) LAZY, no conversion will -# take place. +# type is listed in (the comma separated) UNNEEDED_CONVERSIONS, no +# conversion will take place. func_file_conv () { file=$1 @@ -51,9 +51,20 @@ # lazily determine how to convert abs files case `uname -s` in MINGW*) - file_conv=mingw + if test -n "$MSYSTEM" && (cygpath --version) >/dev/null 2>&1; then + # MSYS2 environment. + file_conv=cygwin + else + # Original MinGW environment. + file_conv=mingw + fi ;; - CYGWIN* | MSYS*) + MSYS*) + # Old MSYS environment, or MSYS2 with 32-bit MSYS2 shell. + file_conv=cygwin + ;; + CYGWIN*) + # Cygwin environment. file_conv=cygwin ;; *) @@ -63,12 +74,14 @@ fi case $file_conv/,$2, in *,$file_conv,*) + # This is the optimization mentioned above: + # If UNNEEDED_CONVERSIONS contains $file_conv, don't convert. ;; mingw/*) file=`cmd //C echo "$file " | sed -e 's/"\(.*\) " *$/\1/'` ;; - cygwin/* | msys/*) - file=`cygpath -m "$file" || echo "$file"` + cygwin/*) + file=`cygpath -w "$file" || echo "$file"` ;; wine/*) file=`winepath -w "$file" || echo "$file"` @@ -343,9 +356,9 @@ # Local Variables: # mode: shell-script # sh-indentation: 2 -# eval: (add-hook 'before-save-hook 'time-stamp) +# eval: (add-hook 'before-save-hook 'time-stamp nil t) # time-stamp-start: "scriptversion=" -# time-stamp-format: "%:y-%02m-%02d.%02H" +# time-stamp-format: "%Y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC0" # time-stamp-end: "; # UTC" # End: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/config.guess new/libtirpc-1.3.8/config.guess --- old/libtirpc-1.3.7/config.guess 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/config.guess 2026-09-13 16:05:38.000000000 +0200 @@ -1,10 +1,10 @@ #!/usr/bin/sh # Attempt to guess a canonical system name. -# Copyright 1992-2024 Free Software Foundation, Inc. +# Copyright 1992-2025 Free Software Foundation, Inc. # shellcheck disable=SC2006,SC2268 # see below for rationale -timestamp='2024-07-27' +timestamp='2025-07-10' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -60,7 +60,7 @@ GNU config.guess ($timestamp) Originally written by Per Bothner. -Copyright 1992-2024 Free Software Foundation, Inc. +Copyright 1992-2025 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -1597,8 +1597,11 @@ *:Unleashed:*:*) GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE ;; - *:Ironclad:*:*) - GUESS=$UNAME_MACHINE-unknown-ironclad + x86_64:[Ii]ronclad:*:*|i?86:[Ii]ronclad:*:*) + GUESS=$UNAME_MACHINE-pc-ironclad-mlibc + ;; + *:[Ii]ronclad:*:*) + GUESS=$UNAME_MACHINE-unknown-ironclad-mlibc ;; esac @@ -1808,8 +1811,8 @@ exit 1 # Local variables: -# eval: (add-hook 'before-save-hook 'time-stamp) +# eval: (add-hook 'before-save-hook 'time-stamp nil t) # time-stamp-start: "timestamp='" -# time-stamp-format: "%:y-%02m-%02d" +# time-stamp-format: "%Y-%02m-%02d" # time-stamp-end: "'" # End: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/config.sub new/libtirpc-1.3.8/config.sub --- old/libtirpc-1.3.7/config.sub 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/config.sub 2026-09-13 16:05:38.000000000 +0200 @@ -1,10 +1,10 @@ #!/usr/bin/sh # Configuration validation subroutine script. -# Copyright 1992-2024 Free Software Foundation, Inc. +# Copyright 1992-2025 Free Software Foundation, Inc. # shellcheck disable=SC2006,SC2268,SC2162 # see below for rationale -timestamp='2024-05-27' +timestamp='2025-07-10' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -76,7 +76,7 @@ version="\ GNU config.sub ($timestamp) -Copyright 1992-2024 Free Software Foundation, Inc. +Copyright 1992-2025 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -145,6 +145,7 @@ | kfreebsd*-gnu* \ | knetbsd*-gnu* \ | kopensolaris*-gnu* \ + | ironclad-* \ | linux-* \ | managarm-* \ | netbsd*-eabi* \ @@ -242,7 +243,6 @@ | rombug \ | semi \ | sequent* \ - | siemens \ | sgi* \ | siemens \ | sim \ @@ -261,7 +261,7 @@ basic_machine=$field1-$field2 basic_os= ;; - zephyr*) + tock* | zephyr*) basic_machine=$field1-unknown basic_os=$field2 ;; @@ -1194,7 +1194,7 @@ xscale-* | xscalee[bl]-*) cpu=`echo "$cpu" | sed 's/^xscale/arm/'` ;; - arm64-* | aarch64le-*) + arm64-* | aarch64le-* | arm64_32-*) cpu=aarch64 ;; @@ -1321,6 +1321,7 @@ | i960 \ | ia16 \ | ia64 \ + | intelgt \ | ip2k \ | iq2000 \ | javascript \ @@ -1522,6 +1523,10 @@ kernel=nto os=`echo "$basic_os" | sed -e 's|nto|qnx|'` ;; + ironclad*) + kernel=ironclad + os=`echo "$basic_os" | sed -e 's|ironclad|mlibc|'` + ;; linux*) kernel=linux os=`echo "$basic_os" | sed -e 's|linux|gnu|'` @@ -1976,6 +1981,7 @@ | atheos* \ | auroraux* \ | aux* \ + | banan_os* \ | beos* \ | bitrig* \ | bme* \ @@ -2022,7 +2028,6 @@ | ios* \ | iris* \ | irix* \ - | ironclad* \ | isc* \ | its* \ | l4re* \ @@ -2118,6 +2123,7 @@ | sysv* \ | tenex* \ | tirtos* \ + | tock* \ | toppers* \ | tops10* \ | tops20* \ @@ -2214,6 +2220,8 @@ ;; uclinux-uclibc*- | uclinux-gnu*- ) ;; + ironclad-mlibc*-) + ;; managarm-mlibc*- | managarm-kernel*- ) ;; windows*-msvc*-) @@ -2249,6 +2257,8 @@ ;; *-eabi*- | *-gnueabi*-) ;; + ios*-simulator- | tvos*-simulator- | watchos*-simulator- ) + ;; none--*) # None (no kernel, i.e. freestanding / bare metal), # can be paired with an machine code file format @@ -2347,8 +2357,8 @@ exit # Local variables: -# eval: (add-hook 'before-save-hook 'time-stamp) +# eval: (add-hook 'before-save-hook 'time-stamp nil t) # time-stamp-start: "timestamp='" -# time-stamp-format: "%:y-%02m-%02d" +# time-stamp-format: "%Y-%02m-%02d" # time-stamp-end: "'" # End: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/configure new/libtirpc-1.3.8/configure --- old/libtirpc-1.3.7/configure 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/configure 2026-09-13 16:05:39.000000000 +0200 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.72 for libtirpc 1.3.7. +# Generated by GNU Autoconf 2.72 for libtirpc 1.3.8. # # # Copyright (C) 1992-1996, 1998-2017, 2020-2023 Free Software Foundation, @@ -611,8 +611,8 @@ # Identity of this package. PACKAGE_NAME='libtirpc' PACKAGE_TARNAME='libtirpc' -PACKAGE_VERSION='1.3.7' -PACKAGE_STRING='libtirpc 1.3.7' +PACKAGE_VERSION='1.3.8' +PACKAGE_STRING='libtirpc 1.3.8' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -1377,7 +1377,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -'configure' configures libtirpc 1.3.7 to adapt to many kinds of systems. +'configure' configures libtirpc 1.3.8 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1448,7 +1448,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of libtirpc 1.3.7:";; + short | recursive ) echo "Configuration of libtirpc 1.3.8:";; esac cat <<\_ACEOF @@ -1564,7 +1564,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -libtirpc configure 1.3.7 +libtirpc configure 1.3.8 generated by GNU Autoconf 2.72 Copyright (C) 2023 Free Software Foundation, Inc. @@ -1886,7 +1886,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by libtirpc $as_me 1.3.7, which was +It was created by libtirpc $as_me 1.3.8, which was generated by GNU Autoconf 2.72. Invocation command line was $ $0$ac_configure_args_raw @@ -2659,7 +2659,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu -am__api_version='1.17' +am__api_version='1.18' @@ -2929,10 +2929,14 @@ ' case `pwd` in *[\\\"\#\$\&\'\`$am_lf]*) + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 +printf "%s\n" "no" >&6; } as_fn_error $? "unsafe absolute working directory name" "$LINENO" 5;; esac case $srcdir in *[\\\"\#\$\&\'\`$am_lf\ \ ]*) + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 +printf "%s\n" "no" >&6; } as_fn_error $? "unsafe srcdir value: '$srcdir'" "$LINENO" 5;; esac @@ -3359,7 +3363,7 @@ # Define the identity of the package. PACKAGE='libtirpc' - VERSION='1.3.7' + VERSION='1.3.8' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -3397,9 +3401,133 @@ # We'll loop over all known methods to create a tar archive until one works. -_am_tools='gnutar pax cpio none' +_am_tools='gnutar plaintar pax cpio none' -am__tar='$${TAR-tar} chof - "$$tardir"' am__untar='$${TAR-tar} xf -' +# The POSIX 1988 'ustar' format is defined with fixed-size fields. + # There is notably a 21 bits limit for the UID and the GID. In fact, + # the 'pax' utility can hang on bigger UID/GID (see automake bug#8343 + # and bug#13588). + am_max_uid=2097151 # 2^21 - 1 + am_max_gid=$am_max_uid + # The $UID and $GID variables are not portable, so we need to resort + # to the POSIX-mandated id(1) utility. Errors in the 'id' calls + # below are definitely unexpected, so allow the users to see them + # (that is, avoid stderr redirection). + am_uid=`id -u || echo unknown` + am_gid=`id -g || echo unknown` + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether UID '$am_uid' is supported by ustar format" >&5 +printf %s "checking whether UID '$am_uid' is supported by ustar format... " >&6; } + if test x$am_uid = xunknown; then + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: ancient id detected; assuming current UID is ok, but dist-ustar might not work" >&5 +printf "%s\n" "$as_me: WARNING: ancient id detected; assuming current UID is ok, but dist-ustar might not work" >&2;} + elif test $am_uid -le $am_max_uid; then + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +printf "%s\n" "yes" >&6; } + else + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 +printf "%s\n" "no" >&6; } + _am_tools=none + fi + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether GID '$am_gid' is supported by ustar format" >&5 +printf %s "checking whether GID '$am_gid' is supported by ustar format... " >&6; } + if test x$gm_gid = xunknown; then + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: ancient id detected; assuming current GID is ok, but dist-ustar might not work" >&5 +printf "%s\n" "$as_me: WARNING: ancient id detected; assuming current GID is ok, but dist-ustar might not work" >&2;} + elif test $am_gid -le $am_max_gid; then + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +printf "%s\n" "yes" >&6; } + else + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5 +printf "%s\n" "no" >&6; } + _am_tools=none + fi + + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to create a ustar tar archive" >&5 +printf %s "checking how to create a ustar tar archive... " >&6; } + + # Go ahead even if we have the value already cached. We do so because we + # need to set the values for the 'am__tar' and 'am__untar' variables. + _am_tools=${am_cv_prog_tar_ustar-$_am_tools} + + for _am_tool in $_am_tools; do + case $_am_tool in + gnutar) + for _am_tar in tar gnutar gtar; do + { echo "$as_me:$LINENO: $_am_tar --version" >&5 + ($_am_tar --version) >&5 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } && break + done + am__tar="$_am_tar --format=ustar -chf - "'"$$tardir"' + am__tar_="$_am_tar --format=ustar -chf - "'"$tardir"' + am__untar="$_am_tar -xf -" + ;; + plaintar) + # Must skip GNU tar: if it does not support --format= it doesn't create + # ustar tarball either. + (tar --version) >/dev/null 2>&1 && continue + am__tar='tar chf - "$$tardir"' + am__tar_='tar chf - "$tardir"' + am__untar='tar xf -' + ;; + pax) + am__tar='pax -L -x ustar -w "$$tardir"' + am__tar_='pax -L -x ustar -w "$tardir"' + am__untar='pax -r' + ;; + cpio) + am__tar='find "$$tardir" -print | cpio -o -H ustar -L' + am__tar_='find "$tardir" -print | cpio -o -H ustar -L' + am__untar='cpio -i -H ustar -d' + ;; + none) + am__tar=false + am__tar_=false + am__untar=false + ;; + esac + + # If the value was cached, stop now. We just wanted to have am__tar + # and am__untar set. + test -n "${am_cv_prog_tar_ustar}" && break + + # tar/untar a dummy directory, and stop if the command works. + rm -rf conftest.dir + mkdir conftest.dir + echo GrepMe > conftest.dir/file + { echo "$as_me:$LINENO: tardir=conftest.dir && eval $am__tar_ >conftest.tar" >&5 + (tardir=conftest.dir && eval $am__tar_ >conftest.tar) >&5 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } + rm -rf conftest.dir + if test -s conftest.tar; then + { echo "$as_me:$LINENO: $am__untar <conftest.tar" >&5 + ($am__untar <conftest.tar) >&5 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } + { echo "$as_me:$LINENO: cat conftest.dir/file" >&5 + (cat conftest.dir/file) >&5 2>&5 + ac_status=$? + echo "$as_me:$LINENO: \$? = $ac_status" >&5 + (exit $ac_status); } + grep GrepMe conftest.dir/file >/dev/null 2>&1 && break + fi + done + rm -rf conftest.dir + + if test ${am_cv_prog_tar_ustar+y} +then : + printf %s "(cached) " >&6 +else case e in #( + e) am_cv_prog_tar_ustar=$_am_tool ;; +esac +fi + + { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_prog_tar_ustar" >&5 +printf "%s\n" "$am_cv_prog_tar_ustar" >&6; } @@ -3437,6 +3565,8 @@ + + ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' @@ -4494,7 +4624,10 @@ break fi done - rm -f core conftest* + # aligned with autoconf, so not including core; see bug#72225. + rm -f -r a.out a.exe b.out conftest.$ac_ext conftest.$ac_objext \ + conftest.dSYM conftest1.$ac_ext conftest1.$ac_objext conftest1.dSYM \ + conftest2.$ac_ext conftest2.$ac_objext conftest2.dSYM unset am_i ;; esac fi @@ -16115,7 +16248,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by libtirpc $as_me 1.3.7, which was +This file was extended by libtirpc $as_me 1.3.8, which was generated by GNU Autoconf 2.72. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -16183,7 +16316,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -libtirpc config.status 1.3.7 +libtirpc config.status 1.3.8 configured by $0, generated by GNU Autoconf 2.72, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/configure.ac new/libtirpc-1.3.8/configure.ac --- old/libtirpc-1.3.7/configure.ac 2025-08-25 17:10:30.000000000 +0200 +++ new/libtirpc-1.3.8/configure.ac 2026-09-13 05:52:10.000000000 +0200 @@ -1,4 +1,4 @@ -AC_INIT([libtirpc],[1.3.7]) +AC_INIT([libtirpc],[1.3.8]) AM_INIT_AUTOMAKE([silent-rules]) AM_SILENT_RULES([yes]) AC_CONFIG_SRCDIR([src/auth_des.c]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/depcomp new/libtirpc-1.3.8/depcomp --- old/libtirpc-1.3.7/depcomp 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/depcomp 2026-09-13 16:05:38.000000000 +0200 @@ -1,9 +1,9 @@ #! /bin/sh # depcomp - compile a program generating dependencies as side-effects -scriptversion=2024-06-19.01; # UTC +scriptversion=2025-06-18.21; # UTC -# Copyright (C) 1999-2024 Free Software Foundation, Inc. +# Copyright (C) 1999-2025 Free Software Foundation, Inc. # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -784,9 +784,9 @@ # Local Variables: # mode: shell-script # sh-indentation: 2 -# eval: (add-hook 'before-save-hook 'time-stamp) +# eval: (add-hook 'before-save-hook 'time-stamp nil t) # time-stamp-start: "scriptversion=" -# time-stamp-format: "%:y-%02m-%02d.%02H" +# time-stamp-format: "%Y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC0" # time-stamp-end: "; # UTC" # End: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/doc/Makefile.in new/libtirpc-1.3.8/doc/Makefile.in --- old/libtirpc-1.3.7/doc/Makefile.in 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/doc/Makefile.in 2026-09-13 16:05:38.000000000 +0200 @@ -1,7 +1,7 @@ -# Makefile.in generated by automake 1.17 from Makefile.am. +# Makefile.in generated by automake 1.18.1 from Makefile.am. # @configure_input@ -# Copyright (C) 1994-2024 Free Software Foundation, Inc. +# Copyright (C) 1994-2025 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -356,6 +356,7 @@ cscope cscopelist: + distdir: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) distdir-am diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/install-sh new/libtirpc-1.3.8/install-sh --- old/libtirpc-1.3.7/install-sh 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/install-sh 2026-09-13 16:05:38.000000000 +0200 @@ -1,7 +1,7 @@ #!/bin/sh # install - install a program, script, or datafile -scriptversion=2024-06-19.01; # UTC +scriptversion=2025-06-18.21; # UTC # This originates from X11R5 (mit/util/scripts/install.sh), which was # later released in X11R6 (xc/config/util/install.sh) with the @@ -533,9 +533,9 @@ done # Local variables: -# eval: (add-hook 'before-save-hook 'time-stamp) +# eval: (add-hook 'before-save-hook 'time-stamp nil t) # time-stamp-start: "scriptversion=" -# time-stamp-format: "%:y-%02m-%02d.%02H" +# time-stamp-format: "%Y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC0" # time-stamp-end: "; # UTC" # End: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/man/Makefile.in new/libtirpc-1.3.8/man/Makefile.in --- old/libtirpc-1.3.7/man/Makefile.in 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/man/Makefile.in 2026-09-13 16:05:38.000000000 +0200 @@ -1,7 +1,7 @@ -# Makefile.in generated by automake 1.17 from Makefile.am. +# Makefile.in generated by automake 1.18.1 from Makefile.am. # @configure_input@ -# Copyright (C) 1994-2024 Free Software Foundation, Inc. +# Copyright (C) 1994-2025 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -444,6 +444,7 @@ cscope cscopelist: + distdir: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) distdir-am diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/missing new/libtirpc-1.3.8/missing --- old/libtirpc-1.3.7/missing 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/missing 2026-09-13 16:05:38.000000000 +0200 @@ -1,11 +1,11 @@ #! /bin/sh # Common wrapper for a few potentially missing GNU and other programs. -scriptversion=2024-06-07.14; # UTC +scriptversion=2025-06-18.21; # UTC # shellcheck disable=SC2006,SC2268 # we must support pre-POSIX shells -# Copyright (C) 1996-2024 Free Software Foundation, Inc. +# Copyright (C) 1996-2025 Free Software Foundation, Inc. # Originally written by Fran,cois Pinard <[email protected]>, 1996. # This program is free software; you can redistribute it and/or modify @@ -228,9 +228,9 @@ exit $st # Local variables: -# eval: (add-hook 'before-save-hook 'time-stamp) +# eval: (add-hook 'before-save-hook 'time-stamp nil t) # time-stamp-start: "scriptversion=" -# time-stamp-format: "%:y-%02m-%02d.%02H" +# time-stamp-format: "%Y-%02m-%02d.%02H" # time-stamp-time-zone: "UTC0" # time-stamp-end: "; # UTC" # End: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/src/Makefile.in new/libtirpc-1.3.8/src/Makefile.in --- old/libtirpc-1.3.7/src/Makefile.in 2025-08-25 17:12:29.000000000 +0200 +++ new/libtirpc-1.3.8/src/Makefile.in 2026-09-13 16:05:38.000000000 +0200 @@ -1,7 +1,7 @@ -# Makefile.in generated by automake 1.17 from Makefile.am. +# Makefile.in generated by automake 1.18.1 from Makefile.am. # @configure_input@ -# Copyright (C) 1994-2024 Free Software Foundation, Inc. +# Copyright (C) 1994-2025 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -1225,6 +1225,7 @@ distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags + distdir: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) distdir-am diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/src/authgss_prot.c new/libtirpc-1.3.8/src/authgss_prot.c --- old/libtirpc-1.3.7/src/authgss_prot.c 2025-08-25 17:10:30.000000000 +0200 +++ new/libtirpc-1.3.8/src/authgss_prot.c 2026-09-13 05:52:10.000000000 +0200 @@ -51,6 +51,9 @@ /* additional space needed for encoding */ #define RPC_SLACK_SPACE 1024 +/* upper bound on decoded RPCSEC_GSS wrapped payload (16 MB) */ +#define RPCSEC_GSS_MAX_UNWRAP (16U * 1024U * 1024U) + bool_t xdr_rpc_gss_buf(XDR *xdrs, gss_buffer_t buf, u_int maxsize) { @@ -227,12 +230,12 @@ if (svc == RPCSEC_GSS_SVC_INTEGRITY) { /* Decode databody_integ. */ - if (!xdr_rpc_gss_buf(xdrs, &databuf, (u_int)-1)) { + if (!xdr_rpc_gss_buf(xdrs, &databuf, RPCSEC_GSS_MAX_UNWRAP)) { LIBTIRPC_DEBUG(1, ("xdr_rpc_gss_unwrap_data: decode databody_integ failed")); return (FALSE); } /* Decode checksum. */ - if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, (u_int)-1)) { + if (!xdr_rpc_gss_buf(xdrs, &wrapbuf, RPCSEC_GSS_MAX_UNWRAP)) { gss_release_buffer(&min_stat, &databuf); LIBTIRPC_DEBUG(1, ("xdr_rpc_gss_unwrap_data: decode checksum failed")); return (FALSE); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/src/libtirpc.map new/libtirpc-1.3.8/src/libtirpc.map --- old/libtirpc-1.3.7/src/libtirpc.map 2025-08-25 17:10:30.000000000 +0200 +++ new/libtirpc-1.3.8/src/libtirpc.map 2026-09-13 05:52:10.000000000 +0200 @@ -295,6 +295,11 @@ svc_max_pollfd; } TIRPC_0.3.2; +TIRPC_1.3.7 { + authdes_getucred; + rpc_gss_getcred; +} TIRPC_0.3.3; + TIRPC_PRIVATE { global: __libc_clntudp_bufcreate; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/src/libtirpc.map.in new/libtirpc-1.3.8/src/libtirpc.map.in --- old/libtirpc-1.3.7/src/libtirpc.map.in 2025-08-25 17:10:30.000000000 +0200 +++ new/libtirpc-1.3.8/src/libtirpc.map.in 2026-09-13 05:52:10.000000000 +0200 @@ -295,6 +295,11 @@ svc_max_pollfd; } TIRPC_0.3.2; +TIRPC_1.3.7 { + authdes_getucred; + rpc_gss_getcred; +} TIRPC_0.3.3; + TIRPC_PRIVATE { global: __libc_clntudp_bufcreate; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/src/pmap_prot2.c new/libtirpc-1.3.8/src/pmap_prot2.c --- old/libtirpc-1.3.7/src/pmap_prot2.c 2025-08-25 17:10:30.000000000 +0200 +++ new/libtirpc-1.3.8/src/pmap_prot2.c 2026-09-13 05:52:10.000000000 +0200 @@ -39,6 +39,8 @@ #include <rpc/xdr.h> #include <rpc/pmap_prot.h> +/* Cap decoded list length to prevent memory exhaustion from malicious data */ +#define PMAPLIST_DECODE_MAX_NODES 1024 /* * What is going on with linked lists? (!) @@ -87,8 +89,9 @@ * xdr_bool when the direction is XDR_DECODE. */ bool_t more_elements; - int freeing; - struct pmaplist **next = NULL; /* pacify gcc */ + int freeing, node_count = 0; + struct pmaplist *next = NULL; + struct pmaplist *next_copy; assert(xdrs != NULL); assert(rp != NULL); @@ -101,17 +104,27 @@ return (FALSE); if (! more_elements) return (TRUE); /* we are done */ + if (xdrs->x_op == XDR_DECODE && + ++node_count > PMAPLIST_DECODE_MAX_NODES) { + return (FALSE); + } + /* * the unfortunate side effect of non-recursion is that in * the case of freeing we must remember the next object * before we free the current object ... */ if (freeing) - next = &((*rp)->pml_next); + next = (*rp)->pml_next; if (! xdr_reference(xdrs, (caddr_t *)rp, (u_int)sizeof(struct pmaplist), (xdrproc_t)xdr_pmap)) return (FALSE); - rp = (freeing) ? next : &((*rp)->pml_next); + if (freeing) { + next_copy = next; + rp = &next_copy; + } else { + rp = &((*rp)->pml_next); + } } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/src/rpcb_prot.c new/libtirpc-1.3.8/src/rpcb_prot.c --- old/libtirpc-1.3.7/src/rpcb_prot.c 2025-08-25 17:10:30.000000000 +0200 +++ new/libtirpc-1.3.8/src/rpcb_prot.c 2026-09-13 05:52:10.000000000 +0200 @@ -89,6 +89,9 @@ * serialize the rpcb elements. */ +/* Cap decoded list length to prevent memory exhaustion from malicious data */ +#define RPCBLIST_DECODE_MAX_NODES 1024 + bool_t xdr_rpcblist_ptr( XDR *xdrs, @@ -101,6 +104,7 @@ */ bool_t more_elements; int freeing = (xdrs->x_op == XDR_FREE); + int node_count = 0; rpcblist_ptr next; rpcblist_ptr next_copy; @@ -113,6 +117,10 @@ if (! more_elements) { return (TRUE); /* we are done */ } + if (xdrs->x_op == XDR_DECODE && + ++node_count > RPCBLIST_DECODE_MAX_NODES) { + return (FALSE); + } /* * the unfortunate side effect of non-recursion is that in * the case of freeing we must remember the next object @@ -178,6 +186,9 @@ return (TRUE); } +/* Cap decoded list length to prevent memory exhaustion from malicious data */ +#define RPCB_ENTRY_LIST_DECODE_MAX_NODES 1024 + bool_t xdr_rpcb_entry_list_ptr( XDR *xdrs, @@ -190,6 +201,7 @@ */ bool_t more_elements; int freeing = (xdrs->x_op == XDR_FREE); + int node_count = 0; rpcb_entry_list_ptr next; rpcb_entry_list_ptr next_copy; @@ -202,6 +214,10 @@ if (! more_elements) { return (TRUE); /* we are done */ } + if (xdrs->x_op == XDR_DECODE && + ++node_count > RPCB_ENTRY_LIST_DECODE_MAX_NODES) { + return (FALSE); + } /* * the unfortunate side effect of non-recursion is that in * the case of freeing we must remember the next object diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libtirpc-1.3.7/src/svc_auth_gss.c new/libtirpc-1.3.8/src/svc_auth_gss.c --- old/libtirpc-1.3.7/src/svc_auth_gss.c 2025-08-25 17:10:30.000000000 +0200 +++ new/libtirpc-1.3.8/src/svc_auth_gss.c 2026-09-13 05:52:10.000000000 +0200 @@ -1117,7 +1117,7 @@ { OM_uint32 maj_stat, min_stat; rpc_gss_principal_t result; - size_t nodelen, secdomlen; + size_t nodelen, secdomlen, alloclen; gss_name_t name, mechname; gss_buffer_desc namebuf; rpc_gss_OID oid; @@ -1135,7 +1135,8 @@ if (secdomain != NULL) secdomlen = strlen(secdomain) + 1; namebuf.length = strlen(user_name) + nodelen + secdomlen; - namebuf.value = calloc(1, namebuf.length); + alloclen = namebuf.length + 1; /* include terminating NULL for C-string ops */ + namebuf.value = calloc(1, alloclen); if (namebuf.value == NULL) return FALSE; (void)strcpy(namebuf.value, user_name);
