[packages/wget] - release 4; backport CVE-2021-31879, CVE-2026-15146, CVE-2026-16599, CVE-2026-58469..58472
arekm
arekm at pld-linux.org
Mon Oct 19 14:50:21 CEST 2026
commit 02e0ece8a87ac4788be10b505453211fc94be9b1
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Mon Oct 19 14:49:58 2026 +0200
- release 4; backport CVE-2021-31879, CVE-2026-15146, CVE-2026-16599, CVE-2026-58469..58472
wget-CVE-2021-31879.patch | 138 +++++++++++++++++++++++++++++++++++++++++
wget-CVE-2026-15146.patch | 84 +++++++++++++++++++++++++
wget-CVE-2026-16599.patch | 40 ++++++++++++
wget-CVE-2026-58469.patch | 50 +++++++++++++++
wget-CVE-2026-58470.patch | 85 +++++++++++++++++++++++++
wget-CVE-2026-58471.patch | 56 +++++++++++++++++
wget-CVE-2026-58472.patch | 62 ++++++++++++++++++
wget-tests-ipv4-loopback.patch | 23 +++++++
wget.spec | 18 +++++-
9 files changed, 555 insertions(+), 1 deletion(-)
---
diff --git a/wget.spec b/wget.spec
index 987e791..24a673c 100644
--- a/wget.spec
+++ b/wget.spec
@@ -20,7 +20,7 @@ Summary(uk.UTF-8): Утиліта для отримання файлів по п
Summary(zh_CN.UTF-8): [通讯]功能强大的下载程序,支持断点续传
Name: wget
Version: 1.25.0
-Release: 3
+Release: 4
License: GPL v3+ with OpenSSL exception
Group: Networking/Utilities
Source0: http://ftp.gnu.org/gnu/wget/%{name}-%{version}.tar.lz
@@ -33,6 +33,14 @@ Patch2: %{name}-home_etc.patch
Patch3: %{name}-ssl-certs.patch
Patch4: user.xdg.origin.url.patch
Patch5: prepend-silence.patch
+Patch6: wget-CVE-2021-31879.patch
+Patch7: wget-CVE-2026-15146.patch
+Patch8: wget-CVE-2026-16599.patch
+Patch9: wget-CVE-2026-58469.patch
+Patch10: wget-CVE-2026-58470.patch
+Patch11: wget-CVE-2026-58471.patch
+Patch12: wget-CVE-2026-58472.patch
+Patch13: wget-tests-ipv4-loopback.patch
URL: http://www.gnu.org/software/wget/
BuildRequires: autoconf >= 2.64
BuildRequires: autoconf-archive
@@ -148,6 +156,14 @@ Proxy серверів, настроюваність.
%patch -P3 -p1
%patch -P4 -p1
%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+%patch -P8 -p1
+%patch -P9 -p1
+%patch -P10 -p1
+%patch -P11 -p1
+%patch -P12 -p1
+%patch -P13 -p1
%{__rm} doc/wget.info doc/sample.wgetrc.munged_for_texi_inclusion po/stamp-po
diff --git a/wget-CVE-2021-31879.patch b/wget-CVE-2021-31879.patch
new file mode 100644
index 0000000..0f94ac6
--- /dev/null
+++ b/wget-CVE-2021-31879.patch
@@ -0,0 +1,138 @@
+# CVE-2021-31879: do not send Authorization/Cookie headers after a
+# redirect to a different origin (scheme, host or port).
+# Upstream commits:
+# https://gitlab.com/gnuwget/wget/-/commit/581b53633159200125bcdee697762c62449b1067
+# https://gitlab.com/gnuwget/wget/-/commit/34b9afbafb52f9296e5a9105c71059aea9c38987
+diff --git a/src/http.c b/src/http.c
+index 95b7a56..db3e5a7 100644
+--- a/src/http.c
++++ b/src/http.c
+@@ -3162,6 +3162,17 @@ fail:
+ }
+ #endif /* HAVE_METALINK */
+
++/*
++ * Check if the corresponding header line should not
++ * be sent after a redirect
++ */
++static bool
++unredirectable_headerline(const char *line)
++{
++ return c_strncasecmp(line, "Authorization:", 14) == 0
++ || c_strncasecmp(line, "Cookie:", 7) == 0;
++}
++
+ /* Retrieve a document through HTTP protocol. It recognizes status
+ code, and correctly handles redirections. It closes the network
+ socket. If it receives an error from the functions below it, it
+@@ -3174,7 +3185,7 @@ fail:
+ server, and u->url will be requested. */
+ static uerr_t
+ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
+- int *dt, struct url *proxy, struct iri *iri, int count)
++ int *dt, struct url *proxy, struct iri *iri, int count, bool location_changed)
+ {
+ struct request *req = NULL;
+
+@@ -3316,9 +3327,13 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
+ /* Add the user headers. */
+ if (opt.user_headers)
+ {
+- int i;
+- for (i = 0; opt.user_headers[i]; i++)
+- request_set_user_header (req, opt.user_headers[i]);
++ for (int i = 0; opt.user_headers[i]; i++)
++ {
++ if (location_changed
++ && (opt.trustservernames || unredirectable_headerline(opt.user_headers[i])))
++ continue;
++ request_set_user_header (req, opt.user_headers[i]);
++ }
+ }
+
+ proxyauth = NULL;
+@@ -4243,7 +4258,7 @@ check_retry_on_http_error (const int statcode)
+ uerr_t
+ http_loop (const struct url *u, struct url *original_url, char **newloc,
+ char **local_file, const char *referer, int *dt, struct url *proxy,
+- struct iri *iri)
++ struct iri *iri, bool location_changed)
+ {
+ int count;
+ bool got_head = false; /* used for time-stamping and filename detection */
+@@ -4430,7 +4445,7 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
+ *dt &= ~SEND_NOCACHE;
+
+ /* Try fetching the document, or at least its head. */
+- err = gethttp (u, original_url, &hstat, dt, proxy, iri, count);
++ err = gethttp (u, original_url, &hstat, dt, proxy, iri, count, location_changed);
+
+ /* Time? */
+ tms = datetime_str (time (NULL));
+diff --git a/src/http.h b/src/http.h
+index 570f768..55f9b82 100644
+--- a/src/http.h
++++ b/src/http.h
+@@ -36,7 +36,7 @@ as that of the covered work. */
+ struct url;
+
+ uerr_t http_loop (const struct url *, struct url *, char **, char **, const char *,
+- int *, struct url *, struct iri *);
++ int *, struct url *, struct iri *, bool);
+ void save_cookies (void);
+ void http_cleanup (void);
+ time_t http_atotm (const char *);
+diff --git a/src/retr.c b/src/retr.c
+index 26eb9f1..e8c8ac8 100644
+--- a/src/retr.c
++++ b/src/retr.c
+@@ -874,7 +874,7 @@ retrieve_url (struct url * orig_parsed, const char *origurl, char **file,
+ {
+ uerr_t result;
+ char *url;
+- bool location_changed;
++ bool location_changed = false;
+ bool iri_fallbacked = 0;
+ int dummy;
+ char *mynewloc, *proxy;
+@@ -971,7 +971,7 @@ retrieve_url (struct url * orig_parsed, const char *origurl, char **file,
+ }
+ #endif
+ result = http_loop (u, orig_parsed, &mynewloc, &local_file, refurl, dt,
+- proxy_url, iri);
++ proxy_url, iri, location_changed);
+ }
+ else if (u->scheme == SCHEME_FTP
+ #ifdef HAVE_SSL
+@@ -1011,8 +1011,7 @@ retrieve_url (struct url * orig_parsed, const char *origurl, char **file,
+ proxy_url = NULL;
+ }
+
+- location_changed = (result == NEWLOCATION || result == NEWLOCATION_KEEP_POST);
+- if (location_changed)
++ if (result == NEWLOCATION || result == NEWLOCATION_KEEP_POST)
+ {
+ char *construced_newloc;
+ struct url *newloc_parsed;
+@@ -1080,10 +1079,18 @@ retrieve_url (struct url * orig_parsed, const char *origurl, char **file,
+
+ xfree (url);
+ url = mynewloc;
++
++ /* Scope sensitive user-provided headers to the initial origin. An
++ origin consists of scheme, host, and port (RFC 6454). Compute this
++ before freeing an intermediate URL. */
++ location_changed = (orig_parsed->scheme != newloc_parsed->scheme
++ || strcasecmp (orig_parsed->host,
++ newloc_parsed->host) != 0
++ || orig_parsed->port != newloc_parsed->port);
++
+ if (orig_parsed != u)
+- {
+- url_free (u);
+- }
++ url_free (u);
++
+ u = newloc_parsed;
+
+ /* If we're being redirected from POST, and we received a
diff --git a/wget-CVE-2026-15146.patch b/wget-CVE-2026-15146.patch
new file mode 100644
index 0000000..412c6c7
--- /dev/null
+++ b/wget-CVE-2026-15146.patch
@@ -0,0 +1,84 @@
+# CVE-2026-15146: validate the address in FTP PASV/LPSV responses
+# against the control connection peer (SSRF).
+# Upstream commit:
+# https://gitlab.com/gnuwget/wget/-/commit/4f85853f641863d5915786a8413e1a213726a62b
+diff --git a/src/ftp-basic.c b/src/ftp-basic.c
+index 8f7d19c..9c7bba1 100644
+--- a/src/ftp-basic.c
++++ b/src/ftp-basic.c
+@@ -623,10 +623,19 @@ ftp_pasv (int csock, ip_address *addr, int *port)
+ int nwritten, i;
+ uerr_t err;
+ unsigned char tmp[6];
++ ip_address peer_addr;
+
+ assert (addr != NULL);
+ assert (port != NULL);
+
++ /* Remember who we are talking to on the control connection, so that
++ the address returned in the PASV response can be checked below.
++ Accepting an arbitrary server-supplied address would let a
++ malicious FTP server redirect our data connection to any host of
++ its choosing (SSRF). */
++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER))
++ return FTPINVPASV;
++
+ xzero (*addr);
+
+ /* Form the request. */
+@@ -677,6 +686,16 @@ ftp_pasv (int csock, ip_address *addr, int *port)
+ memcpy (IP_INADDR_DATA (addr), tmp, 4);
+ *port = ((tmp[4] << 8) & 0xff00) + tmp[5];
+
++ /* Reject the response if the advertised address does not match the
++ control connection's peer. */
++ if (peer_addr.family != AF_INET
++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0)
++ {
++ xzero (*addr);
++ *port = 0;
++ return FTPINVPASV;
++ }
++
+ return FTPOK;
+ }
+
+@@ -692,10 +711,19 @@ ftp_lpsv (int csock, ip_address *addr, int *port)
+ uerr_t err;
+ unsigned char tmp[16];
+ unsigned char tmpprt[2];
++ ip_address peer_addr;
+
+ assert (addr != NULL);
+ assert (port != NULL);
+
++ /* Remember who we are talking to on the control connection, so that
++ the address returned in the LPSV response can be checked below.
++ Accepting an arbitrary server-supplied address would let a
++ malicious FTP server redirect our data connection to any host of
++ its choosing (SSRF). */
++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER))
++ return FTPINVPASV;
++
+ xzero (*addr);
+
+ /* Form the request. */
+@@ -842,6 +870,18 @@ ftp_lpsv (int csock, ip_address *addr, int *port)
+ DEBUGP (("*port is: %d\n", *port));
+ }
+
++ /* Reject the response if the advertised address does not match the
++ control connection's peer. */
++ if (peer_addr.family != addr->family
++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr),
++ af == 4 ? 4 : 16) != 0)
++ {
++ xzero (*addr);
++ *port = 0;
++ xfree (respline);
++ return FTPINVPASV;
++ }
++
+ xfree (respline);
+ return FTPOK;
+ }
diff --git a/wget-CVE-2026-16599.patch b/wget-CVE-2026-16599.patch
new file mode 100644
index 0000000..12c4c77
--- /dev/null
+++ b/wget-CVE-2026-16599.patch
@@ -0,0 +1,40 @@
+# CVE-2026-16599: bound the server-supplied OPIE/S-KEY sequence
+# number to avoid an unbounded MD5 loop (DoS).
+# Upstream commit:
+# https://gitlab.com/gnuwget/wget/-/commit/e9697d98e7249b0f68a6be040a4f3dcc5bc101fa
+diff --git a/src/ftp-basic.c b/src/ftp-basic.c
+index 9c7bba1..f592548 100644
+--- a/src/ftp-basic.c
++++ b/src/ftp-basic.c
+@@ -204,12 +204,11 @@ ftp_login (int csock, const char *acc, const char *pass)
+ "331 s/key ",
+ "331 opiekey "
+ };
+- size_t i;
+ const char *seed = NULL;
+
+- for (i = 0; i < countof (skey_head); i++)
++ for (size_t i = 0; i < countof (skey_head); i++)
+ {
+- int l = strlen (skey_head[i]);
++ size_t l = strlen (skey_head[i]);
+ if (0 == c_strncasecmp (skey_head[i], respline, l))
+ {
+ seed = respline + l;
+@@ -222,7 +221,15 @@ ftp_login (int csock, const char *acc, const char *pass)
+
+ /* Extract the sequence from SEED. */
+ for (; c_isdigit (*seed); seed++)
+- skey_sequence = 10 * skey_sequence + *seed - '0';
++ {
++ skey_sequence = 10 * skey_sequence + *seed - '0';
++ if (skey_sequence > 9999)
++ {
++ xfree (respline);
++ return FTPLOGREFUSED;
++ }
++ }
++
+ if (*seed == ' ')
+ ++seed;
+ else
diff --git a/wget-CVE-2026-58469.patch b/wget-CVE-2026-58469.patch
new file mode 100644
index 0000000..df7e39b
--- /dev/null
+++ b/wget-CVE-2026-58469.patch
@@ -0,0 +1,50 @@
+# CVE-2026-58469: fix a heap buffer underread in
+# clean_metalink_string() for whitespace-only Metalink URLs.
+# Upstream commits:
+# https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826
+# https://gitlab.com/gnuwget/wget/-/commit/7b1cdecc49bc77bde220fc575c8a00386c3f3bcf
+# https://gitlab.com/gnuwget/wget/-/commit/82d945ff5dc9942b78b2bf736aac298c24fe00a1
+diff --git a/src/metalink.c b/src/metalink.c
+index de2439c..9bea18f 100644
+--- a/src/metalink.c
++++ b/src/metalink.c
+@@ -46,6 +46,7 @@ as that of the covered work. */
+ #include "c-strcase.h"
+ #include <errno.h>
+ #include <unistd.h> /* For unlink. */
++#include <ctype.h>
+ #include <metalink/metalink_parser.h>
+ #ifdef HAVE_GPGME
+ #include <gpgme.h>
+@@ -1041,7 +1042,6 @@ void
+ clean_metalink_string (char **str)
+ {
+ int c;
+- size_t len;
+ char *new, *beg, *end;
+
+ if (!str || !*str)
+@@ -1049,7 +1049,7 @@ clean_metalink_string (char **str)
+
+ beg = *str;
+
+- while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
++ while (isspace(*beg))
+ beg++;
+
+ end = beg;
+@@ -1062,12 +1062,10 @@ clean_metalink_string (char **str)
+ /* If we are at the end of the string, search the first legit
+ character going backward. */
+ if (*end == '\0')
+- while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
++ while (end > beg && isspace(*(end - 1)))
+ end--;
+
+- len = end - beg;
+-
+- new = xmemdup0 (beg, len);
++ new = xmemdup0 (beg, end - beg);
+ xfree (*str);
+ *str = new;
+ }
diff --git a/wget-CVE-2026-58470.patch b/wget-CVE-2026-58470.patch
new file mode 100644
index 0000000..f053d42
--- /dev/null
+++ b/wget-CVE-2026-58470.patch
@@ -0,0 +1,85 @@
+# CVE-2026-58470: fix a signed integer overflow when parsing
+# server-supplied Content-Range headers.
+# Upstream commits:
+# https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf
+# https://gitlab.com/gnuwget/wget/-/commit/01ff771caac1958662ca8665eed2021ec386a7af
+# https://gitlab.com/gnuwget/wget/-/commit/a6d20d8ffa7926ac6e4ad1a1303886a6ace621b0
+diff --git a/src/http.c b/src/http.c
+index 07af186..c3a3484 100644
+--- a/src/http.c
++++ b/src/http.c
+@@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
+ wgint *last_byte_ptr, wgint *entity_length_ptr)
+ {
+ wgint num;
++ char *end;
+
+ /* Ancient versions of Netscape proxy server, presumably predating
+ rfc2068, sent out `Content-Range' without the "bytes"
+@@ -932,27 +933,39 @@ parse_content_range (const char *hdr, wgint *first_byte_ptr,
+ }
+ if (!c_isdigit (*hdr))
+ return false;
+- for (num = 0; c_isdigit (*hdr); hdr++)
+- num = 10 * num + (*hdr - '0');
+- if (*hdr != '-' || !c_isdigit (*(hdr + 1)))
++
++ errno = 0;
++ num = strtoll(hdr, &end, 10);
++ if (errno == ERANGE)
++ return false;
++ hdr = end;
++
++ if (*hdr++ != '-' || !c_isdigit (*hdr))
+ return false;
+ *first_byte_ptr = num;
+- ++hdr;
+- for (num = 0; c_isdigit (*hdr); hdr++)
+- num = 10 * num + (*hdr - '0');
+- if (*hdr != '/')
++
++ errno = 0;
++ num = strtoll(hdr, &end, 10);
++ if (errno == ERANGE)
++ return false;
++ hdr = end;
++
++ if (*hdr++ != '/')
+ return false;
+ *last_byte_ptr = num;
+- if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*'))
++ if (!(c_isdigit (*hdr) || *hdr == '*'))
+ return false;
+ if (*last_byte_ptr < *first_byte_ptr)
+ return false;
+- ++hdr;
+ if (*hdr == '*')
+ num = -1;
+ else
+- for (num = 0; c_isdigit (*hdr); hdr++)
+- num = 10 * num + (*hdr - '0');
++ {
++ errno = 0;
++ num = strtoll(hdr, NULL, 10);
++ if (errno == ERANGE)
++ return false;
++ }
+ *entity_length_ptr = num;
+ if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1)
+ return false;
+@@ -5425,6 +5438,15 @@ test_parse_range_header (void)
+ { "bytes 42-1233/*", 42, 1233, -1, true },
+ { "bytes 0-2147483648/2147483649", 0, 2147483648U, 2147483649U, true },
+ { "bytes 2147483648-4294967296/4294967297", 2147483648U, 4294967296ULL, 4294967297ULL, true },
++ /* An entity-length that overflows wgint must be rejected rather
++ than silently wrapped: parse_content_range() parses it with
++ strtoll() and returns false on ERANGE. Before that fix the
++ value "99999999999999999999" wrapped to a bogus positive
++ number and the function returned true (CVE-2026-58470). The
++ expected first/last/length match the values the function leaves
++ in the output pointers, which this harness reuses across
++ iterations without resetting. */
++ { "bytes 0-1000/99999999999999999999", 0, 1000, 4294967297ULL, false },
+ };
+
+ wgint firstbyteptr[sizeof(wgint)];
diff --git a/wget-CVE-2026-58471.patch b/wget-CVE-2026-58471.patch
new file mode 100644
index 0000000..a33bb11
--- /dev/null
+++ b/wget-CVE-2026-58471.patch
@@ -0,0 +1,56 @@
+# CVE-2026-58471: fix a heap buffer overflow in convert_fname()
+# when iconv reports E2BIG.
+# Upstream commit:
+# https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
+diff --git a/src/url.c b/src/url.c
+index 2f27c48..7e7a3ce 100644
+--- a/src/url.c
++++ b/src/url.c
+@@ -1603,7 +1603,7 @@ convert_fname (char *fname)
+ const char *from_encoding = opt.encoding_remote;
+ const char *to_encoding = opt.locale;
+ iconv_t cd;
+- size_t len, done, inlen, outlen;
++ size_t len, inlen, outlen;
+ char *s;
+ const char *orig_fname;
+
+@@ -1625,7 +1625,6 @@ convert_fname (char *fname)
+ inlen = strlen (fname);
+ len = outlen = inlen * 2;
+ converted_fname = s = xmalloc (outlen + 1);
+- done = 0;
+
+ for (;;)
+ {
+@@ -1633,7 +1632,7 @@ convert_fname (char *fname)
+ if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
+ && iconv (cd, NULL, NULL, &s, &outlen) == 0)
+ {
+- *(converted_fname + len - outlen - done) = '\0';
++ *s = '\0';
+ iconv_close (cd);
+ DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
+ orig_fname, from_encoding, converted_fname, to_encoding));
+@@ -1656,10 +1655,17 @@ convert_fname (char *fname)
+ }
+ else if (errno == E2BIG) /* Output buffer full */
+ {
+- done = len;
+- len = outlen = done + inlen * 2;
+- converted_fname = xrealloc (converted_fname, outlen + 1);
+- s = converted_fname + done;
++ size_t used = s - converted_fname;
++ size_t newlen = used + inlen * 2 + 1;
++
++ /* Ensure we actually grow the buffer */
++ if (newlen <= len)
++ newlen = len * 2;
++
++ converted_fname = xrealloc (converted_fname, newlen + 1);
++ len = newlen;
++ s = converted_fname + used;
++ outlen = len - used;
+ }
+ else /* Weird, we got an unspecified error */
+ {
diff --git a/wget-CVE-2026-58472.patch b/wget-CVE-2026-58472.patch
new file mode 100644
index 0000000..1e864cc
--- /dev/null
+++ b/wget-CVE-2026-58472.patch
@@ -0,0 +1,62 @@
+# CVE-2026-58472: fix integer and heap buffer overflow in
+# html_quote_string() when quoting HTML attributes.
+# Upstream commits:
+# https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812
+# https://gitlab.com/gnuwget/wget/-/commit/f76978a51ba9365e7ecaed96c1cfb73197a38ca2
+diff --git a/src/convert.c b/src/convert.c
+index 2e5bc22..c22b54a 100644
+--- a/src/convert.c
++++ b/src/convert.c
+@@ -36,6 +36,7 @@ as that of the covered work. */
+ #include <unistd.h>
+ #include <errno.h>
+ #include <assert.h>
++#include <intprops.h>
+ #include "convert.h"
+ #include "url.h"
+ #include "recur.h"
+@@ -1178,21 +1179,37 @@ html_quote_string (const char *s)
+ {
+ const char *b = s;
+ char *p, *res;
+- int i;
++ size_t i;
++ int ok;
+
+ /* Pass through the string, and count the new size. */
+- for (i = 0; *s; s++, i++)
++ for (i = 0; *s; s++)
+ {
+ if (*s == '&')
+- i += 4; /* `amp;' */
++ ok = INT_ADD_OK (i, 4 + 1, &i); /* `amp;' */
+ else if (*s == '<' || *s == '>')
+- i += 3; /* `lt;' and `gt;' */
++ ok = INT_ADD_OK (i, 3 + 1, &i); /* `lt;' and `gt;' */
+ else if (*s == '\"')
+- i += 5; /* `quot;' */
++ ok = INT_ADD_OK (i, 5 + 1, &i); /* `quot;' */
+ else if (*s == ' ')
+- i += 4; /* #32; */
++ ok = INT_ADD_OK (i, 4 + 1, &i); /* #32; */
++ else
++ ok = INT_ADD_OK (i, 1, &i);
++
++ if (!ok)
++ {
++ DEBUGP (("Overflow detected in html_quote_string().\n"));
++ abort();
++ }
+ }
+- res = xmalloc (i + 1);
++
++ if (!INT_ADD_OK (i, 1, &i))
++ {
++ DEBUGP (("Overflow detected in html_quote_string().\n"));
++ abort();
++ }
++
++ res = xmalloc (i);
+ s = b;
+ for (p = res; *s; s++)
+ {
diff --git a/wget-tests-ipv4-loopback.patch b/wget-tests-ipv4-loopback.patch
new file mode 100644
index 0000000..7a3a853
--- /dev/null
+++ b/wget-tests-ipv4-loopback.patch
@@ -0,0 +1,23 @@
+# PLD-local test fix: bind the HTTPS test server to the IPv4 loopback
+# explicitly. The tests map the test hostname to localhost and expect
+# 127.0.0.1, but on dual-stack systems the server and client may pick
+# different address families, making the test suite fail intermittently
+# with "Connection refused".
+diff --git a/tests/SSLServer.pm b/tests/SSLServer.pm
+index 37a8bfa..a278128 100644
+--- a/tests/SSLServer.pm
++++ b/tests/SSLServer.pm
+@@ -66,7 +66,12 @@ sub init
+
+ sub ssl_setup_conn
+ {
+- $sslsock = IO::Socket::SSL->new(LocalAddr => $ssl_params{'lhostname'},
++ # Bind to the IPv4 loopback explicitly. The tests map the test
++ # hostname to localhost and check that it resolves to 127.0.0.1,
++ # but on dual-stack systems getaddrinfo may return ::1 first here,
++ # while wget connects to 127.0.0.1 (or vice versa), making the
++ # tests fail intermittently with "Connection refused".
++ $sslsock = IO::Socket::SSL->new(LocalAddr => '127.0.0.1',
+ LocalPort => $ssl_params{'sslport'},
+ Listen => 10,
+ Timeout => 30,
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/wget.git/commitdiff/02e0ece8a87ac4788be10b505453211fc94be9b1
More information about the pld-cvs-commit
mailing list