Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package tftp for openSUSE:Factory checked in at 2026-11-03 17:51:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tftp (Old) and /work/SRC/openSUSE:Factory/.tftp.new.1257 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tftp" Tue Nov 3 17:51:21 2026 rev:52 rq:1394336 version:5.4 Changes: -------- --- /work/SRC/openSUSE:Factory/tftp/tftp.changes 2026-07-02 20:06:48.415882860 +0200 +++ /work/SRC/openSUSE:Factory/.tftp.new.1257/tftp.changes 2026-11-03 17:51:24.641900726 +0100 @@ -1,0 +2,34 @@ +Tue Oct 27 11:00:30 UTC 2026 - David Anes <[email protected]> + +- update to 5.4: + * Much stricter validation of path names in non-chroot mode + * remap: labels/jump targets, file existence probe, new "gg" + modifier + * cleaner handling of restricted user namespaces on Linux + * new --enable-werror configure option + * fix several security-relevant path validation bugs (tftpd/path.c) + * fix buffer overflows in the tftp client (unbounded strcpy in + request building, OOB write on multi-file put, unbounded write in + the interactive command-line argument array) + * fix an out-of-bounds read while scanning request fields in tftpd + * fix the --map-steps option rejecting valid numeric arguments + * fix the \x remap macro returning the wrong substitution length + * fix synchnet() passing the wrong nfds argument to select() + * add IPv6 support on MacOS X +- fix CVE-2026-85234 (bsc#1280621): out-of-bounds read in + genmatchstring() when a remap rule with the inverse (~) modifier and + an abort (a) action formats a custom error message. Fixed upstream + in 5.4 (commit 4b493532f5ce) +- drop tftp-hpa-0.48-macros-crash.patch: fixed upstream in 5.4 +- drop tftp-hpa-0.49-fortify-strcpy-crash.patch: fixed upstream in 5.4 +- drop tftp-config_h.patch: config.h ships with the source tree +- adapt tftp-hpa-0.43_include_sys_params.patch, + tftp-hpa-0.46_colon_check.patch, tftp-hpa-0.48-tzfix.patch and + tftp-hpa-0.48-macros-v6mapped.patch to 5.4 +- add tftp-hpa-5.4-stdbool.patch: include <stdbool.h> in tftpd/path.h + so that bool/true/false are defined under -std=gnu11 +- add tftp-hpa-5.4-macro-dirs.patch: declare AC_CONFIG_MACRO_DIRS in + configure.ac so that autoreconf -fiv finds the project m4 macros in + autoconf/m4 (5.4 ships no pre-generated aclocal.m4) + +------------------------------------------------------------------- Old: ---- tftp-config_h.patch tftp-hpa-0.48-macros-crash.patch tftp-hpa-0.49-fortify-strcpy-crash.patch tftp-hpa-5.3.tar.gz New: ---- tftp-hpa-5.4-macro-dirs.patch tftp-hpa-5.4-stdbool.patch tftp-hpa-5.4.tar.gz ----------(Old B)---------- Old:- drop tftp-hpa-0.49-fortify-strcpy-crash.patch: fixed upstream in 5.4 - drop tftp-config_h.patch: config.h ships with the source tree - adapt tftp-hpa-0.43_include_sys_params.patch, Old: in 5.4 (commit 4b493532f5ce) - drop tftp-hpa-0.48-macros-crash.patch: fixed upstream in 5.4 - drop tftp-hpa-0.49-fortify-strcpy-crash.patch: fixed upstream in 5.4 Old:- drop tftp-hpa-0.48-macros-crash.patch: fixed upstream in 5.4 - drop tftp-hpa-0.49-fortify-strcpy-crash.patch: fixed upstream in 5.4 - drop tftp-config_h.patch: config.h ships with the source tree ----------(Old E)---------- ----------(New B)---------- New: so that bool/true/false are defined under -std=gnu11 - add tftp-hpa-5.4-macro-dirs.patch: declare AC_CONFIG_MACRO_DIRS in configure.ac so that autoreconf -fiv finds the project m4 macros in New: tftp-hpa-0.48-macros-v6mapped.patch to 5.4 - add tftp-hpa-5.4-stdbool.patch: include <stdbool.h> in tftpd/path.h so that bool/true/false are defined under -std=gnu11 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tftp.spec ++++++ --- /var/tmp/diff_new_pack.Pu1Erl/_old 2026-11-03 17:51:25.702945077 +0100 +++ /var/tmp/diff_new_pack.Pu1Erl/_new 2026-11-03 17:51:25.704945160 +0100 @@ -21,7 +21,7 @@ %define _fillupdir %{_localstatedir}/adm/fillup-templates %endif Name: tftp -Version: 5.3 +Version: 5.4 Release: 0 Summary: Trivial File Transfer Protocol (TFTP) License: BSD-3-Clause @@ -33,12 +33,12 @@ Source5: tftp.sysconfig Patch0: tftp-hpa-0.43_include_sys_params.patch Patch1: tftp-hpa-0.46_colon_check.patch -Patch4: tftp-hpa-0.49-fortify-strcpy-crash.patch Patch5: tftp-hpa-0.48-tzfix.patch -Patch7: tftp-hpa-0.48-macros-crash.patch Patch8: tftp-hpa-0.48-macros-v6mapped.patch -Patch43: tftp-config_h.patch +Patch9: tftp-hpa-5.4-stdbool.patch +Patch10: tftp-hpa-5.4-macro-dirs.patch BuildRequires: autoconf +BuildRequires: automake BuildRequires: binutils-devel BuildRequires: pkgconfig BuildRequires: shadow @@ -60,7 +60,7 @@ %autosetup -p1 -n %{name}-hpa-%{version} %build -autoreconf -fi +autoreconf -fiv export CFLAGS="%{optflags} -fcommon -std=gnu11" %configure \ --enable-largefile \ ++++++ tftp-hpa-0.43_include_sys_params.patch ++++++ --- /var/tmp/diff_new_pack.Pu1Erl/_old 2026-11-03 17:51:25.743946791 +0100 +++ /var/tmp/diff_new_pack.Pu1Erl/_new 2026-11-03 17:51:25.748947000 +0100 @@ -1,12 +1,9 @@ ---- - tftp/main.c | 1 + - 1 file changed, 1 insertion(+) +# Add the <sys/param.h> include to the tftp client (tftp/main.c). +# Kept from the 0.43 package. -Index: tftp-hpa-5.2/tftp/main.c -=================================================================== ---- tftp-hpa-5.2.orig/tftp/main.c -+++ tftp-hpa-5.2/tftp/main.c -@@ -39,6 +39,7 @@ +--- a/tftp/main.c ++++ b/tftp/main.c +@@ -13,6 +13,7 @@ * TFTP User Program -- Command Interface. */ #include <sys/file.h> ++++++ tftp-hpa-0.46_colon_check.patch ++++++ --- /var/tmp/diff_new_pack.Pu1Erl/_old 2026-11-03 17:51:25.763947627 +0100 +++ /var/tmp/diff_new_pack.Pu1Erl/_new 2026-11-03 17:51:25.769947877 +0100 @@ -1,21 +1,20 @@ ---- - tftp/main.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) +# Fix the host:port argument check in the tftp client (tftp/main.c). +# Call setpeer() only when a host is present (peerargc > 1). Stop the colon +# check after the first argument when the command line has three arguments. +# Kept from the 0.46 package. -Index: tftp-hpa-5.3/tftp/main.c -=================================================================== ---- tftp-hpa-5.3.orig/tftp/main.c -+++ tftp-hpa-5.3/tftp/main.c -@@ -308,7 +308,7 @@ int main(int argc, char *argv[]) +--- a/tftp/main.c ++++ b/tftp/main.c +@@ -280,7 +281,7 @@ - tftp_signal(SIGINT, intr); + tftp_signal(SIGINT, intr, 0); - if (peerargc) { + if (peerargc > 1) { /* Set peer */ if (sigsetjmp(toplevel, 1) != 0) exit(EX_NOHOST); -@@ -634,11 +634,14 @@ void get(int argc, char *argv[]) +@@ -609,11 +610,14 @@ return; } if (!connected) { ++++++ tftp-hpa-0.48-macros-v6mapped.patch ++++++ --- /var/tmp/diff_new_pack.Pu1Erl/_old 2026-11-03 17:51:25.784948504 +0100 +++ /var/tmp/diff_new_pack.Pu1Erl/_new 2026-11-03 17:51:25.789948713 +0100 @@ -1,14 +1,13 @@ ---- - tftpd/tftpd.c | 33 +++++++++++++++++++++++++++++---- - 1 file changed, 29 insertions(+), 4 deletions(-) +# Expand the %H remap macro to IPv4 for IPv6-mapped clients (tftpd/tftpd.c). +# Add is_v6_mapped(). In rewrite_macros(), convert an IPv6-mapped address +# (::ffff:a.b.c.d) to its IPv4 form so %H expands to the dotted quad. +# Kept from the 0.48 package. -Index: tftp-hpa-5.3/tftpd/tftpd.c -=================================================================== ---- tftp-hpa-5.3.orig/tftpd/tftpd.c -+++ tftp-hpa-5.3/tftpd/tftpd.c -@@ -1349,6 +1349,21 @@ static void do_opt(const char *opt, cons - - #ifdef WITH_REGEX +diff --git a/tftpd/tftpd.c b/tftpd/tftpd.c +index 6dcf14f..e44f834 100644 +@@ -1401,6 +1410,21 @@ static char hexchar(unsigned char c) + return c >= 10 ? (c + 'A' - 10) : c + '0'; + } +#ifdef HAVE_IPV6 +static inline int is_v6_mapped(const union sock_addr* pa) @@ -25,13 +24,13 @@ +} +#endif + - /* - * This is called by the remap engine when it encounters macros such - * as \i. It should write the output in "output" if non-NULL, and -@@ -1360,10 +1375,20 @@ static int rewrite_macros(char macro, ch + static size_t rewrite_macros(char macro, char **output) { - char *p, tb[INET6_ADDRSTRLEN]; - int l=0; + #ifdef INET6_ADDRSTRLEN +@@ -1410,17 +1434,27 @@ static size_t rewrite_macros(char macro, char **output) + #endif + const unsigned char *cp; + size_t bytes; + const union sock_addr *pfrom = &from; + +#ifdef HAVE_IPV6 @@ -43,29 +42,29 @@ + } +#endif - switch (macro) { - case 'i': -- p = (char *)inet_ntop(from.sa.sa_family, SOCKADDR_P(&from), -+ p = (char *)inet_ntop(pfrom->sa.sa_family, SOCKADDR_P(pfrom), - tb, INET6_ADDRSTRLEN); - if (output && p) - strcpy(output, p); -@@ -1373,14 +1398,14 @@ static int rewrite_macros(char macro, ch - return strlen(p); + *output = obuf; - case 'x': -- if (from.sa.sa_family == AF_INET) { -+ if (pfrom->sa.sa_family == AF_INET) { - if (output) - sprintf(output, "%08lX", -- (unsigned long)ntohl(from.si.sin_addr.s_addr)); -+ (unsigned long)ntohl(pfrom->si.sin_addr.s_addr)); - l = 8; +- switch (from.sa.sa_family) { ++ switch (pfrom->sa.sa_family) { + case AF_INET: +- cp = (const unsigned char *)&from.si.sin_addr; ++ cp = (const unsigned char *)&pfrom->si.sin_addr; + bytes = 4; + break; #ifdef HAVE_IPV6 - } else { -- unsigned char *c = (unsigned char *)SOCKADDR_P(&from); -+ unsigned char *c = (unsigned char *)SOCKADDR_P(pfrom); - p = tb; - for (l = 0; l < 16; l++) { - sprintf(p, "%02X", *c); + case AF_INET6: +- cp = (const unsigned char *)&from.s6.sin6_addr; ++ cp = (const unsigned char *)&pfrom->s6.sin6_addr; + bytes = 16; + break; + #endif +@@ -1431,7 +1465,7 @@ static size_t rewrite_macros(char macro, char **output) + switch (macro) { + case 'i': + { +- const char *p = inet_ntop(from.sa.sa_family, SOCKADDR_P(&from), ++ const char *p = inet_ntop(pfrom->sa.sa_family, SOCKADDR_P(pfrom), + obuf, sizeof obuf); + return p ? strlen(p) : 0; + } ++++++ tftp-hpa-0.48-tzfix.patch ++++++ --- /var/tmp/diff_new_pack.Pu1Erl/_old 2026-11-03 17:51:25.810949591 +0100 +++ /var/tmp/diff_new_pack.Pu1Erl/_new 2026-11-03 17:51:25.814949758 +0100 @@ -1,20 +1,24 @@ -Index: tftp-hpa-5.3/tftpd/tftpd.c -=================================================================== ---- tftp-hpa-5.3.orig/tftpd/tftpd.c -+++ tftp-hpa-5.3/tftpd/tftpd.c -@@ -383,6 +383,14 @@ int main(int argc, char **argv) - const char *pidfile = NULL; +# Make tftpd log in the local time zone (tftpd/tftpd.c). +# Set the TZ environment variable to the local UTC offset in main(), for +# example "UTC+2". The log timestamps then use the local time zone. +# Kept from the 0.48 package. + +diff --git a/tftpd/tftpd.c b/tftpd/tftpd.c +index 6dcf14f..e44f834 100644 +@@ -390,6 +390,15 @@ int main(int argc, char **argv) u_short tp_opcode; + bool patherr; + time_t my_time = 0; + struct tm* p_tm; + char envtz[10]; + my_time = time(NULL); + p_tm = localtime(&my_time); -+ snprintf(envtz, sizeof(envtz) - 1, "UTC%+d", (p_tm->tm_gmtoff * -1)/3600); ++ snprintf(envtz, sizeof(envtz) - 1, "UTC%+d", ++ (int)((p_tm->tm_gmtoff * -1) / 3600)); + setenv("TZ", envtz, 0); + - /* basename() is way too much of a pain from a portability standpoint */ - - p = strrchr(argv[0], '/'); + #ifdef HAVE_LOCALE_H + setlocale(LC_CTYPE, ""); /* For to(w)(lower|upper)() */ + #endif ++++++ tftp-hpa-5.4-macro-dirs.patch ++++++ # Add AC_CONFIG_MACRO_DIRS([autoconf/m4]) to configure.ac. # 5.4 uses project m4 macros in autoconf/m4/ and ships no pre-generated # aclocal.m4. Without the macro dir, aclocal does not find the macros and # does not generate aclocal.m4. autoreconf -fiv then fails with an # "undefined macro" error. This line tells aclocal and autoconf where to # find the project m4 macros, so autoreconf -fiv works. --- a/configure.ac +++ b/configure.ac @@ -8,6 +8,7 @@ dnl a configure script. AC_PREREQ([2.71]) AC_INIT +AC_CONFIG_MACRO_DIRS([autoconf/m4]) AC_CONFIG_SRCDIR([MRULES]) AC_PREFIX_DEFAULT([/usr]) AC_CONFIG_AUX_DIR([autoconf/helpers]) ++++++ tftp-hpa-5.4-stdbool.patch ++++++ # Add the <stdbool.h> include to tftpd/path.h. # 5.4 uses bool, true, and false in tftpd/path.h, tftpd/path.c, and # tftpd/tftpd.c without <stdbool.h>. The spec builds with -std=gnu11, so the # build fails. The include in path.h covers the three files. --- a/tftpd/path.h +++ b/tftpd/path.h @@ -4,6 +4,8 @@ #ifndef TFTPD_PATH_H #define TFTPD_PATH_H 1 +#include <stdbool.h> + const char **parse_path(const char *path, bool strict); char *build_path(const char * const *dirs); unsigned int compare_paths(const char * const *a, const char * const *b); ++++++ tftp-hpa-5.3.tar.gz -> tftp-hpa-5.4.tar.gz ++++++ ++++ 6433 lines of diff (skipped)
