Folks,

I had discovered that libslirp had a secirity related release which was
issues a few day ago.

Related changelog entries:

 - Fix bounds-check in processing OEM commands (CVE-2026-95507)
 - Fix bounds-check in dhcpv6 against MTU (CVE-2026-95508)

it was tested with qemu, no regression discovered.

Ok for 8.0?

Index: Makefile
===================================================================
RCS file: /home/cvs/ports/net/libslirp/Makefile,v
diff -u -p -r1.4 Makefile
--- Makefile	15 Jun 2026 08:19:59 -0000	1.4
+++ Makefile	28 Sep 2026 20:55:22 -0000
@@ -1,6 +1,6 @@
 COMMENT=	general purpose TCP-IP emulator library
 
-VER=		4.9.3
+VER=		4.9.5
 DISTNAME=	libslirp-v${VER}
 PKGNAME=	libslirp-${VER}
 CATEGORIES=	net
Index: distinfo
===================================================================
RCS file: /home/cvs/ports/net/libslirp/distinfo,v
diff -u -p -r1.3 distinfo
--- distinfo	15 Jun 2026 08:19:59 -0000	1.3
+++ distinfo	28 Sep 2026 20:55:35 -0000
@@ -1,2 +1,2 @@
-SHA256 (libslirp-v4.9.3.tar.bz2) = yC4ixzvcPywDjlONTwycIWbe+yQCIS1hu3yxtTC6lS8=
-SIZE (libslirp-v4.9.3.tar.bz2) = 133720
+SHA256 (libslirp-v4.9.5.tar.bz2) = T1nfiWyzRep21/aLHoIIcv6qnYJVpnYfa/ig8tUUS80=
+SIZE (libslirp-v4.9.5.tar.bz2) = 134635
Index: patches/patch-meson_build
===================================================================
RCS file: patches/patch-meson_build
diff -N patches/patch-meson_build
--- patches/patch-meson_build	15 Jun 2026 08:19:59 -0000	1.1
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,22 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: meson.build
---- meson.build.orig
-+++ meson.build
-@@ -238,6 +238,16 @@ ncsitest = executable('ncsitest', 'test/ncsitest.c',
- 
- test('ncsi', ncsitest)
- 
-+guestfwdtest = executable('guestfwdtest', 'test/guestfwdtest.c',
-+  link_with: [lib],
-+  c_args : cargs,
-+  link_args : vflag,
-+  include_directories: ['src'],
-+  dependencies: libslirp_deps
-+)
-+
-+test('guestfwd', guestfwdtest)
-+
- if install_devel
-   install_headers(['src/libslirp.h'], subdir : 'slirp')
- 
Index: patches/patch-src_slirp_c
===================================================================
RCS file: patches/patch-src_slirp_c
diff -N patches/patch-src_slirp_c
--- patches/patch-src_slirp_c	15 Jun 2026 08:19:59 -0000	1.1
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,21 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: src/slirp.c
---- src/slirp.c.orig
-+++ src/slirp.c
-@@ -1581,9 +1581,12 @@ static bool check_guestfwd(Slirp *slirp, struct in_add
-                              (htonl(0x0204) & ~slirp->vnetwork_mask.s_addr);
-     }
-     if ((guest_addr->s_addr & slirp->vnetwork_mask.s_addr) !=
--            slirp->vnetwork_addr.s_addr ||
--        guest_addr->s_addr == slirp->vhost_addr.s_addr ||
--        guest_addr->s_addr == slirp->vnameserver_addr.s_addr) {
-+            slirp->vnetwork_addr.s_addr) {
-+        return false;
-+    }
-+    if (!slirp->disable_dns &&
-+        guest_addr->s_addr == slirp->vnameserver_addr.s_addr &&
-+        guest_port == 53) {
-         return false;
-     }
- 
Index: patches/patch-src_tcp_input_c
===================================================================
RCS file: patches/patch-src_tcp_input_c
diff -N patches/patch-src_tcp_input_c
--- patches/patch-src_tcp_input_c	15 Jun 2026 08:19:59 -0000	1.1
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,36 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: src/tcp_input.c
---- src/tcp_input.c.orig
-+++ src/tcp_input.c
-@@ -600,20 +600,17 @@ findso:
-         if (af == AF_INET &&
-             (so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) ==
-                 slirp->vnetwork_addr.s_addr) {
--            if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr &&
--                so->so_faddr.s_addr != slirp->vnameserver_addr.s_addr) {
--                /* May be an add exec */
--                for (ex_ptr = slirp->guestfwd_list; ex_ptr;
--                     ex_ptr = ex_ptr->ex_next) {
--                    if (ex_ptr->ex_fport == so->so_fport &&
--                        so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
--                        so->so_state |= SS_CTL;
--                        break;
--                    }
-+            /* May be an add exec */
-+            for (ex_ptr = slirp->guestfwd_list; ex_ptr;
-+                 ex_ptr = ex_ptr->ex_next) {
-+                if (ex_ptr->ex_fport == so->so_fport &&
-+                    so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
-+                    so->so_state |= SS_CTL;
-+                    break;
-                 }
--                if (so->so_state & SS_CTL) {
--                    goto cont_input;
--                }
-+            }
-+            if (so->so_state & SS_CTL) {
-+                goto cont_input;
-             }
-             /* CTL_ALIAS: Do nothing, tcp_fconnect will be called on it */
-         }
Index: patches/patch-src_tcp_subr_c
===================================================================
RCS file: patches/patch-src_tcp_subr_c
diff -N patches/patch-src_tcp_subr_c
--- patches/patch-src_tcp_subr_c	15 Jun 2026 08:19:59 -0000	1.1
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,41 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: src/tcp_subr.c
---- src/tcp_subr.c.orig
-+++ src/tcp_subr.c
-@@ -992,22 +992,20 @@ int tcp_ctl(struct socket *so)
-     DEBUG_ARG("so = %p", so);
- 
-     /* TODO: IPv6 */
--    if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr) {
--        /* Check if it's pty_exec */
--        for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
--            if (ex_ptr->ex_fport == so->so_fport &&
--                so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
--                if (ex_ptr->write_cb) {
--                    so->s = SLIRP_INVALID_SOCKET;
--                    so->guestfwd = ex_ptr;
--                    return 1;
--                }
--                DEBUG_MISC(" executing %s", ex_ptr->ex_exec);
--                if (ex_ptr->ex_unix)
--                    return open_unix(so, ex_ptr->ex_unix);
--                else
--                    return fork_exec(so, ex_ptr->ex_exec);
-+    /* Check if it's pty_exec */
-+    for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
-+        if (ex_ptr->ex_fport == so->so_fport &&
-+            so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
-+            if (ex_ptr->write_cb) {
-+                so->s = SLIRP_INVALID_SOCKET;
-+                so->guestfwd = ex_ptr;
-+                return 1;
-             }
-+            DEBUG_MISC(" executing %s", ex_ptr->ex_exec);
-+            if (ex_ptr->ex_unix)
-+                return open_unix(so, ex_ptr->ex_unix);
-+            else
-+                return fork_exec(so, ex_ptr->ex_exec);
-         }
-     }
-     sb->sb_cc = slirp_fmt(sb->sb_wptr, sb->sb_datalen - (sb->sb_wptr - sb->sb_data),
Index: patches/patch-test_guestfwdtest_c
===================================================================
RCS file: patches/patch-test_guestfwdtest_c
diff -N patches/patch-test_guestfwdtest_c
--- patches/patch-test_guestfwdtest_c	15 Jun 2026 08:19:59 -0000	1.1
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,79 +0,0 @@
-https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a
-
-Index: test/guestfwdtest.c
---- test/guestfwdtest.c.orig
-+++ test/guestfwdtest.c
-@@ -0,0 +1,73 @@
-+/* SPDX-License-Identifier: BSD-3-Clause */
-+
-+#include <assert.h>
-+#include <stddef.h>
-+
-+#include "libslirp.h"
-+
-+static slirp_ssize_t guestfwd_write(const void *buf, size_t len, void *opaque)
-+{
-+    return len;
-+}
-+
-+static SlirpCb callbacks;
-+
-+static struct in_addr in_addr4(uint32_t addr)
-+{
-+    struct in_addr ret = { .s_addr = htonl(addr) };
-+
-+    return ret;
-+}
-+
-+static Slirp *guestfwd_slirp(bool disable_dns)
-+{
-+    SlirpConfig config = {
-+        .version = SLIRP_CONFIG_VERSION_MAX,
-+        .in_enabled = true,
-+        .vnetwork = in_addr4(0x0a000200),
-+        .vnetmask = in_addr4(0xffffff00),
-+        .vhost = in_addr4(0x0a000202),
-+        .vdhcp_start = in_addr4(0x0a00020f),
-+        .vnameserver = in_addr4(0x0a000203),
-+        .disable_dns = disable_dns,
-+    };
-+
-+    return slirp_new(&config, &callbacks, NULL);
-+}
-+
-+static void assert_guestfwd(Slirp *slirp, struct in_addr addr, int port,
-+                            bool expect_ok)
-+{
-+    int ret;
-+
-+    ret = slirp_add_guestfwd(slirp, guestfwd_write, NULL, &addr, port);
-+    assert((ret == 0) == expect_ok);
-+
-+    if (ret == 0) {
-+        assert(slirp_remove_guestfwd(slirp, addr, port) == 0);
-+    }
-+}
-+
-+static void test_guestfwd_validation(void)
-+{
-+    struct in_addr vhost = in_addr4(0x0a000202);
-+    struct in_addr vnameserver = in_addr4(0x0a000203);
-+    Slirp *slirp;
-+
-+    slirp = guestfwd_slirp(false);
-+    assert_guestfwd(slirp, vhost, 8080, true);
-+    assert_guestfwd(slirp, vnameserver, 8080, true);
-+    assert_guestfwd(slirp, vhost, 67, true);
-+    assert_guestfwd(slirp, vhost, 69, true);
-+    assert_guestfwd(slirp, vnameserver, 53, false);
-+    slirp_cleanup(slirp);
-+
-+    slirp = guestfwd_slirp(true);
-+    assert_guestfwd(slirp, vnameserver, 53, true);
-+    slirp_cleanup(slirp);
-+}
-+
-+int main(int argc, char *argv[])
-+{
-+    test_guestfwd_validation();
-+}


-- 
wbr, Kirill