Skip to content

Commit 7489e69

Browse files
implausibleimplausible
committed
Bump libssh2 to 1.8.2
1 parent 86b6dcb commit 7489e69

30 files changed

Lines changed: 2190 additions & 1388 deletions

‎vendor/libssh2/Makefile.in‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
# Makefile.in generated by automake 1.15 from Makefile.am.
1+
# Makefile.in generated by automake 1.16.1 from Makefile.am.
22
# @configure_input@
33

4-
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
4+
# Copyright (C) 1994-2018 Free Software Foundation, Inc.
55

66
# This Makefile.in is free software; the Free Software Foundation
77
# gives unlimited permission to copy and/or distribute it,
@@ -174,7 +174,7 @@ am__recursive_targets = \
174174
$(RECURSIVE_CLEAN_TARGETS) \
175175
$(am__extra_recursive_targets)
176176
AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
177-
cscope distdir dist dist-all distcheck
177+
cscope distdir distdir-am dist dist-all distcheck
178178
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
179179
# Read a list of newline-separated strings from the standard input,
180180
# and print each of them once, without duplicates. Input order is
@@ -469,8 +469,8 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
469469
echo ' $(SHELL) ./config.status'; \
470470
$(SHELL) ./config.status;; \
471471
*) \
472-
echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \
473-
cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \
472+
echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles)'; \
473+
cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles);; \
474474
esac;
475475
$(srcdir)/Makefile.inc $(am__empty):
476476

@@ -642,7 +642,10 @@ distclean-tags:
642642
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
643643
-rm -f cscope.out cscope.in.out cscope.po.out cscope.files
644644

645-
distdir: $(DISTFILES)
645+
distdir: $(BUILT_SOURCES)
646+
$(MAKE) $(AM_MAKEFLAGS) distdir-am
647+
648+
distdir-am: $(DISTFILES)
646649
$(am__remove_distdir)
647650
test -d "$(distdir)" || mkdir "$(distdir)"
648651
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
@@ -710,7 +713,7 @@ distdir: $(DISTFILES)
710713
! -type d ! -perm -444 -exec $(install_sh) -c -m a+r {} {} \; \
711714
|| chmod -R a+r "$(distdir)"
712715
dist-gzip: distdir
713-
tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
716+
tardir=$(distdir) && $(am__tar) | eval GZIP= gzip $(GZIP_ENV) -c >$(distdir).tar.gz
714717
$(am__post_remove_distdir)
715718

716719
dist-bzip2: distdir
@@ -736,7 +739,7 @@ dist-shar: distdir
736739
@echo WARNING: "Support for shar distribution archives is" \
737740
"deprecated." >&2
738741
@echo WARNING: "It will be removed altogether in Automake 2.0" >&2
739-
shar $(distdir) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).shar.gz
742+
shar $(distdir) | eval GZIP= gzip $(GZIP_ENV) -c >$(distdir).shar.gz
740743
$(am__post_remove_distdir)
741744

742745
dist-zip: distdir
@@ -754,7 +757,7 @@ dist dist-all:
754757
distcheck: dist
755758
case '$(DIST_ARCHIVES)' in \
756759
*.tar.gz*) \
757-
GZIP=$(GZIP_ENV) gzip -dc $(distdir).tar.gz | $(am__untar) ;;\
760+
eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).tar.gz | $(am__untar) ;;\
758761
*.tar.bz2*) \
759762
bzip2 -dc $(distdir).tar.bz2 | $(am__untar) ;;\
760763
*.tar.lz*) \
@@ -764,7 +767,7 @@ distcheck: dist
764767
*.tar.Z*) \
765768
uncompress -c $(distdir).tar.Z | $(am__untar) ;;\
766769
*.shar.gz*) \
767-
GZIP=$(GZIP_ENV) gzip -dc $(distdir).shar.gz | unshar ;;\
770+
eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
768771
*.zip*) \
769772
unzip $(distdir).zip ;;\
770773
esac

‎vendor/libssh2/NEWS‎

Lines changed: 63 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,68 @@
11
Changelog for the libssh2 project. Generated with git2news.pl
22

3+
Version 1.8.2 (25 Mar 2019)
4+
5+
Daniel Stenberg (25 Mar 2019)
6+
- RELEASE-NOTES: version 1.8.2
7+
8+
- [Will Cosgrove brought this change]
9+
10+
moved MAX size declarations #330
11+
12+
- [Will Cosgrove brought this change]
13+
14+
Fixed misapplied patch (#327)
15+
16+
Fixes for user auth
17+
18+
Version 1.8.1 (14 Mar 2019)
19+
20+
Will Cosgrove (14 Mar 2019)
21+
- [Michael Buckley brought this change]
22+
23+
More 1.8.0 security fixes (#316)
24+
25+
* Defend against possible integer overflows in comp_method_zlib_decomp.
26+
27+
* Defend against writing beyond the end of the payload in _libssh2_transport_read().
28+
29+
* Sanitize padding_length - _libssh2_transport_read(). https://libssh2.org/CVE-2019-3861.html
30+
31+
This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent.
32+
33+
* Prevent zero-byte allocation in sftp_packet_read() which could lead to an out-of-bounds read. https://libssh2.org/CVE-2019-3858.html
34+
35+
* Check the length of data passed to sftp_packet_add() to prevent out-of-bounds reads.
36+
37+
* Add a required_size parameter to sftp_packet_require et. al. to require callers of these functions to handle packets that are too short. https://libssh2.org/CVE-2019-3860.html
38+
39+
* Additional length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add(). https://libssh2.org/CVE-2019-3862.html
40+
41+
GitHub (14 Mar 2019)
42+
- [Will Cosgrove brought this change]
43+
44+
1.8 Security fixes (#314)
45+
46+
* fixed possible integer overflow in packet_length
47+
48+
CVE https://www.libssh2.org/CVE-2019-3861.html
49+
50+
* fixed possible interger overflow with userauth_keyboard_interactive
51+
52+
CVE https://www.libssh2.org/CVE-2019-3856.html
53+
54+
* fixed possible out zero byte/incorrect bounds allocation
55+
56+
CVE https://www.libssh2.org/CVE-2019-3857.html
57+
58+
* bounds checks for response packets
59+
60+
* fixed integer overflow in userauth_keyboard_interactive
61+
62+
CVE https://www.libssh2.org/CVE-2019-3863.html
63+
64+
* 1.8.1 release notes
65+
366
Version 1.8.0 (25 Oct 2016)
467

568
Daniel Stenberg (25 Oct 2016)
@@ -5473,19 +5536,3 @@ Simon Josefsson (16 Nov 2009)
54735536

54745537
Reported by Steven Van Ingelgem <steven@vaningelgem.be>
54755538
in <http://thread.gmane.org/gmane.network.ssh.libssh2.devel/2566>.
5476-
5477-
- Mention libssh2-style.el.
5478-
5479-
- Use memmove instead of memcpy on overlapping memory areas.
5480-
5481-
Reported by Bob Alexander <balexander@expressor-software.com> in
5482-
<http://thread.gmane.org/gmane.network.ssh.libssh2.devel/2530>.
5483-
5484-
- Add.
5485-
5486-
- Protect against crash on too small SSH_MSG_IGNORE packets.
5487-
5488-
Reported by Bob Alexander <balexander@expressor-software.com>
5489-
in <http://thread.gmane.org/gmane.network.ssh.libssh2.devel/2530>.
5490-
5491-
- add copyright line

‎vendor/libssh2/RELEASE-NOTES‎

Lines changed: 6 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,12 @@
1-
libssh2 1.8.0
2-
3-
This release includes the following changes:
4-
5-
o added a basic dockerised test suite
6-
o crypto: add support for the mbedTLS backend
1+
libssh2 1.8.2
72

83
This release includes the following bugfixes:
94

10-
o libgcrypt: fixed a NULL pointer dereference on OOM
11-
o VMS: can't use %zd for off_t format
12-
o VMS: update vms/libssh2_config.h
13-
o windows: link with crypt32.lib
14-
o libssh2_channel_open: speeling error fixed in channel error message
15-
o msvc: fixed 14 compilation warnings
16-
o tests: HAVE_NETINET_IN_H was not defined correctly
17-
o openssl: add OpenSSL 1.1.0 compatibility
18-
o cmake: Add CLEAR_MEMORY option, analogously to that for autoconf
19-
o configure: make the --with-* options override the OpenSSL default
20-
o libssh2_wait_socket: set err_msg on errors
21-
o libssh2_wait_socket: Fix comparison with api_timeout to use milliseconds
22-
5+
o Fixed the misapplied userauth patch that broke 1.8.1
6+
o moved the MAX size declarations from the public header
7+
238
This release would not have looked like this without help, code, reports and
249
advice from friends like these:
2510

26-
Alexander Lamaison, Antenore Gatta, Brad Harder, Charles Collicutt,
27-
Craig A. Berry, Dan Fandrich, Daniel Stenberg, Kamil Dudka, Keno Fischer,
28-
Taylor Holberton, Viktor Szakats, Will Cosgrove, Zenju
29-
(12 contributors)
30-
31-
Thanks! (and sorry if I forgot to mention someone)
11+
Will Cosgrove
12+
(1 contributors)

0 commit comments

Comments
 (0)