Hi, Would you suggest I inform/contribute about this patch upstream?
Thanks, On Sat, 10 Oct 2026 12:48:25 +0200 Theo Buehler <[email protected]> wrote: > On Wed, Oct 07, 2026 at 09:07:05PM -0500, izzy Meyer wrote: > > Hi, > > > > Ping! > > > > Now that the tree has been unlocked, could this be reviewed? > > It mostly looks good to me. There is one warning that we should fix, > however, so I'd suggest I commit the diff below. The other warnings > are all harmless. > > This will cause a crash if the code is ever hit: > > ../zoitechat-2.19.1/src/common/util.c:1463:108: warning: null passed > to a callee that requires a non-null argument [-Wnonnull] 1463 | > digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned > char *) challenge, strlen (challenge), NULL, NULL); > > The penultimate argument of HMAC must not be NULL on anything but > OpenSSL because there is no way to make the static buffer thread safe. > We removed this feature a while back and BoringSSL about a decade ago: > > https://github.com/openbsd/src/commit/9cb045229698d08f09fbd7cf9ae7f3b9b8f8b848 > > The patch below fixes this. > > Index: Makefile > =================================================================== > RCS file: /cvs/ports/net/zoitechat/Makefile,v > diff -u -p -r1.2 Makefile > --- Makefile 9 Sep 2026 15:16:53 -0000 1.2 > +++ Makefile 10 Oct 2026 10:26:31 -0000 > @@ -1,6 +1,6 @@ > COMMENT = GTK+ IRC Client > -PSL_COMMIT = d91e55ea128af6218897d3b3723b28af7138c3d6 > -DIST_TUPLE += github ZoiteChat zoitechat v2.19.0 . > +PSL_COMMIT = 3955e3ec29b94c3cca7bd4509c5f14a7c0959e26 > +DIST_TUPLE += github ZoiteChat zoitechat v2.19.1 . > DIST_TUPLE += github publicsuffix list ${PSL_COMMIT} \ > src/common/publicsuffix > CATEGORIES = net x11 > Index: distinfo > =================================================================== > RCS file: /cvs/ports/net/zoitechat/distinfo,v > diff -u -p -r1.1.1.1 distinfo > --- distinfo 9 Sep 2026 15:15:21 -0000 1.1.1.1 > +++ distinfo 10 Oct 2026 10:26:31 -0000 > @@ -1,4 +1,4 @@ > -SHA256 (ZoiteChat-zoitechat-v2.19.0.tar.gz) = > oBlK3zuLIaXKBtxFNED3GuSRykjsch3YOczywndbVf4= -SHA256 > (publicsuffix-list-d91e55ea128af6218897d3b3723b28af7138c3d6.tar.gz) = > rCQCD+233k9sBvifccjFk8U7/m+Ru6YG1bIeXCu4OMA= -SIZE > (ZoiteChat-zoitechat-v2.19.0.tar.gz) = 3522858 -SIZE > (publicsuffix-list-d91e55ea128af6218897d3b3723b28af7138c3d6.tar.gz) = > 306199 +SHA256 (ZoiteChat-zoitechat-v2.19.1.tar.gz) = > pkJz7GFlhzCiFRTekUqhYLTrlU1WPF1VRQyoz+MyoJg= +SHA256 > (publicsuffix-list-3955e3ec29b94c3cca7bd4509c5f14a7c0959e26.tar.gz) = > o1GFP6MCHOHTmVV5I6xXgSjB7EOtM8yZnMyz37u7HP8= +SIZE > (ZoiteChat-zoitechat-v2.19.1.tar.gz) = 3523177 +SIZE > (publicsuffix-list-3955e3ec29b94c3cca7bd4509c5f14a7c0959e26.tar.gz) = > 306310 Index: patches/patch-src_common_util_c > =================================================================== > RCS file: patches/patch-src_common_util_c diff -N > patches/patch-src_common_util_c --- /dev/null 1 Jan 1970 > 00:00:00 -0000 +++ patches/patch-src_common_util_c 10 Oct 2026 > 10:42:13 -0000 @@ -0,0 +1,24 @@ +warning: null passed to a callee > that requires a non-null argument [-Wnonnull] > + 1463 | digest = HMAC (EVP_sha256 (), keyhash, strlen > (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, > NULL); + +Index: src/common/util.c > +--- src/common/util.c.orig > ++++ src/common/util.c > +@@ -1444,7 +1444,7 @@ challengeauth_response (const char *username, > const ch > + char *passhash; > + char *key; > + char *keyhash; > +- unsigned char *digest; > ++ unsigned char digest[SHA256_DIGEST_LENGTH]; > + GString *buf = g_string_new_len (NULL, SHA256_DIGEST_LENGTH > * 2); > + > + user = rfc_strlower (username); /* convert username to > lowercase as per the RFC */ +@@ -1460,7 +1460,7 @@ > challengeauth_response (const char *username, const ch > + keyhash = str_sha256hash (key); > + g_free (key); > + > +- digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), > (unsigned char *) challenge, strlen (challenge), NULL, NULL); > ++ HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned > char *) challenge, strlen (challenge), digest, NULL); > + g_free (keyhash); > + > + for (i = 0; i < SHA256_DIGEST_LENGTH; i++) > -- iz (she/her) > I say mundane things > so the uninteresting > just might get noticed. izder456 (dot) neocities (dot) org
