Folks,
I had discovered that libslirp had a secirity related release which was
issues a few day ago.
Related changelog entries:
- Fix bounds-check in processing OEM commands (CVE-2026-95507)
- Fix bounds-check in dhcpv6 against MTU (CVE-2026-95508)
it was tested with qemu, no regression discovered.
Ok for 8.0?
Index: Makefile
===================================================================
RCS file: /home/cvs/ports/net/libslirp/Makefile,v
diff -u -p -r1.4 Makefile
--- Makefile 15 Jun 2026 08:19:59 -0000 1.4
+++ Makefile 28 Sep 2026 20:55:22 -0000
@@ -1,6 +1,6 @@
COMMENT= general purpose TCP-IP emulator library
-VER= 4.9.3
+VER= 4.9.5
DISTNAME= libslirp-v${VER}
PKGNAME= libslirp-${VER}
CATEGORIES= net
Index: distinfo
===================================================================
RCS file: /home/cvs/ports/net/libslirp/distinfo,v
diff -u -p -r1.3 distinfo
--- distinfo 15 Jun 2026 08:19:59 -0000 1.3
+++ distinfo 28 Sep 2026 20:55:35 -0000
@@ -1,2 +1,2 @@
-SHA256 (libslirp-v4.9.3.tar.bz2) = yC4ixzvcPywDjlONTwycIWbe+yQCIS1hu3yxtTC6lS8=
-SIZE (libslirp-v4.9.3.tar.bz2) = 133720
+SHA256 (libslirp-v4.9.5.tar.bz2) = T1nfiWyzRep21/aLHoIIcv6qnYJVpnYfa/ig8tUUS80=
+SIZE (libslirp-v4.9.5.tar.bz2) = 134635
Index: patches/patch-meson_build
===================================================================
RCS file: patches/patch-meson_build
diff -N patches/patch-meson_build
--- patches/patch-meson_build 15 Jun 2026 08:19:59 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,22 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: meson.build
---- meson.build.orig
-+++ meson.build
-@@ -238,6 +238,16 @@ ncsitest = executable('ncsitest', 'test/ncsitest.c',
-
- test('ncsi', ncsitest)
-
-+guestfwdtest = executable('guestfwdtest', 'test/guestfwdtest.c',
-+ link_with: [lib],
-+ c_args : cargs,
-+ link_args : vflag,
-+ include_directories: ['src'],
-+ dependencies: libslirp_deps
-+)
-+
-+test('guestfwd', guestfwdtest)
-+
- if install_devel
- install_headers(['src/libslirp.h'], subdir : 'slirp')
-
Index: patches/patch-src_slirp_c
===================================================================
RCS file: patches/patch-src_slirp_c
diff -N patches/patch-src_slirp_c
--- patches/patch-src_slirp_c 15 Jun 2026 08:19:59 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,21 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: src/slirp.c
---- src/slirp.c.orig
-+++ src/slirp.c
-@@ -1581,9 +1581,12 @@ static bool check_guestfwd(Slirp *slirp, struct in_add
- (htonl(0x0204) & ~slirp->vnetwork_mask.s_addr);
- }
- if ((guest_addr->s_addr & slirp->vnetwork_mask.s_addr) !=
-- slirp->vnetwork_addr.s_addr ||
-- guest_addr->s_addr == slirp->vhost_addr.s_addr ||
-- guest_addr->s_addr == slirp->vnameserver_addr.s_addr) {
-+ slirp->vnetwork_addr.s_addr) {
-+ return false;
-+ }
-+ if (!slirp->disable_dns &&
-+ guest_addr->s_addr == slirp->vnameserver_addr.s_addr &&
-+ guest_port == 53) {
- return false;
- }
-
Index: patches/patch-src_tcp_input_c
===================================================================
RCS file: patches/patch-src_tcp_input_c
diff -N patches/patch-src_tcp_input_c
--- patches/patch-src_tcp_input_c 15 Jun 2026 08:19:59 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,36 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: src/tcp_input.c
---- src/tcp_input.c.orig
-+++ src/tcp_input.c
-@@ -600,20 +600,17 @@ findso:
- if (af == AF_INET &&
- (so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) ==
- slirp->vnetwork_addr.s_addr) {
-- if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr &&
-- so->so_faddr.s_addr != slirp->vnameserver_addr.s_addr) {
-- /* May be an add exec */
-- for (ex_ptr = slirp->guestfwd_list; ex_ptr;
-- ex_ptr = ex_ptr->ex_next) {
-- if (ex_ptr->ex_fport == so->so_fport &&
-- so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
-- so->so_state |= SS_CTL;
-- break;
-- }
-+ /* May be an add exec */
-+ for (ex_ptr = slirp->guestfwd_list; ex_ptr;
-+ ex_ptr = ex_ptr->ex_next) {
-+ if (ex_ptr->ex_fport == so->so_fport &&
-+ so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
-+ so->so_state |= SS_CTL;
-+ break;
- }
-- if (so->so_state & SS_CTL) {
-- goto cont_input;
-- }
-+ }
-+ if (so->so_state & SS_CTL) {
-+ goto cont_input;
- }
- /* CTL_ALIAS: Do nothing, tcp_fconnect will be called on it */
- }
Index: patches/patch-src_tcp_subr_c
===================================================================
RCS file: patches/patch-src_tcp_subr_c
diff -N patches/patch-src_tcp_subr_c
--- patches/patch-src_tcp_subr_c 15 Jun 2026 08:19:59 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,41 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: src/tcp_subr.c
---- src/tcp_subr.c.orig
-+++ src/tcp_subr.c
-@@ -992,22 +992,20 @@ int tcp_ctl(struct socket *so)
- DEBUG_ARG("so = %p", so);
-
- /* TODO: IPv6 */
-- if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr) {
-- /* Check if it's pty_exec */
-- for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
{
-- if (ex_ptr->ex_fport == so->so_fport &&
-- so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
-- if (ex_ptr->write_cb) {
-- so->s = SLIRP_INVALID_SOCKET;
-- so->guestfwd = ex_ptr;
-- return 1;
-- }
-- DEBUG_MISC(" executing %s", ex_ptr->ex_exec);
-- if (ex_ptr->ex_unix)
-- return open_unix(so, ex_ptr->ex_unix);
-- else
-- return fork_exec(so, ex_ptr->ex_exec);
-+ /* Check if it's pty_exec */
-+ for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
-+ if (ex_ptr->ex_fport == so->so_fport &&
-+ so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
-+ if (ex_ptr->write_cb) {
-+ so->s = SLIRP_INVALID_SOCKET;
-+ so->guestfwd = ex_ptr;
-+ return 1;
- }
-+ DEBUG_MISC(" executing %s", ex_ptr->ex_exec);
-+ if (ex_ptr->ex_unix)
-+ return open_unix(so, ex_ptr->ex_unix);
-+ else
-+ return fork_exec(so, ex_ptr->ex_exec);
- }
- }
- sb->sb_cc = slirp_fmt(sb->sb_wptr, sb->sb_datalen - (sb->sb_wptr -
sb->sb_data),
Index: patches/patch-test_guestfwdtest_c
===================================================================
RCS file: patches/patch-test_guestfwdtest_c
diff -N patches/patch-test_guestfwdtest_c
--- patches/patch-test_guestfwdtest_c 15 Jun 2026 08:19:59 -0000 1.1
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,79 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: test/guestfwdtest.c
---- test/guestfwdtest.c.orig
-+++ test/guestfwdtest.c
-@@ -0,0 +1,73 @@
-+/* SPDX-License-Identifier: BSD-3-Clause */
-+
-+#include <assert.h>
-+#include <stddef.h>
-+
-+#include "libslirp.h"
-+
-+static slirp_ssize_t guestfwd_write(const void *buf, size_t len, void *opaque)
-+{
-+ return len;
-+}
-+
-+static SlirpCb callbacks;
-+
-+static struct in_addr in_addr4(uint32_t addr)
-+{
-+ struct in_addr ret = { .s_addr = htonl(addr) };
-+
-+ return ret;
-+}
-+
-+static Slirp *guestfwd_slirp(bool disable_dns)
-+{
-+ SlirpConfig config = {
-+ .version = SLIRP_CONFIG_VERSION_MAX,
-+ .in_enabled = true,
-+ .vnetwork = in_addr4(0x0a000200),
-+ .vnetmask = in_addr4(0xffffff00),
-+ .vhost = in_addr4(0x0a000202),
-+ .vdhcp_start = in_addr4(0x0a00020f),
-+ .vnameserver = in_addr4(0x0a000203),
-+ .disable_dns = disable_dns,
-+ };
-+
-+ return slirp_new(&config, &callbacks, NULL);
-+}
-+
-+static void assert_guestfwd(Slirp *slirp, struct in_addr addr, int port,
-+ bool expect_ok)
-+{
-+ int ret;
-+
-+ ret = slirp_add_guestfwd(slirp, guestfwd_write, NULL, &addr, port);
-+ assert((ret == 0) == expect_ok);
-+
-+ if (ret == 0) {
-+ assert(slirp_remove_guestfwd(slirp, addr, port) == 0);
-+ }
-+}
-+
-+static void test_guestfwd_validation(void)
-+{
-+ struct in_addr vhost = in_addr4(0x0a000202);
-+ struct in_addr vnameserver = in_addr4(0x0a000203);
-+ Slirp *slirp;
-+
-+ slirp = guestfwd_slirp(false);
-+ assert_guestfwd(slirp, vhost, 8080, true);
-+ assert_guestfwd(slirp, vnameserver, 8080, true);
-+ assert_guestfwd(slirp, vhost, 67, true);
-+ assert_guestfwd(slirp, vhost, 69, true);
-+ assert_guestfwd(slirp, vnameserver, 53, false);
-+ slirp_cleanup(slirp);
-+
-+ slirp = guestfwd_slirp(true);
-+ assert_guestfwd(slirp, vnameserver, 53, true);
-+ slirp_cleanup(slirp);
-+}
-+
-+int main(int argc, char *argv[])
-+{
-+ test_guestfwd_validation();
-+}
--
wbr, Kirill
