Hi, 

Would you suggest I inform/contribute about this patch upstream?

Thanks,

On Sat, 10 Oct 2026 12:48:25 +0200
Theo Buehler <tb@theobuehler.org> wrote:

> On Wed, Oct 07, 2026 at 09:07:05PM -0500, izzy Meyer wrote:
> > Hi,
> > 
> > Ping!
> > 
> > Now that the tree has been unlocked, could this be reviewed?
> 
> It mostly looks good to me. There is one warning that we should fix,
> however, so I'd suggest I commit the diff below. The other warnings
> are all harmless.
> 
> This will cause a crash if the code is ever hit:
> 
> ../zoitechat-2.19.1/src/common/util.c:1463:108: warning: null passed
> to a callee that requires a non-null argument [-Wnonnull] 1463 |
>    digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned
> char *) challenge, strlen (challenge), NULL, NULL);
> 
> The penultimate argument of HMAC must not be NULL on anything but
> OpenSSL because there is no way to make the static buffer thread safe.
> We removed this feature a while back and BoringSSL about a decade ago:
> 
> https://github.com/openbsd/src/commit/9cb045229698d08f09fbd7cf9ae7f3b9b8f8b848
> 
> The patch below fixes this.
> 
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/net/zoitechat/Makefile,v
> diff -u -p -r1.2 Makefile
> --- Makefile	9 Sep 2026 15:16:53 -0000	1.2
> +++ Makefile	10 Oct 2026 10:26:31 -0000
> @@ -1,6 +1,6 @@
>  COMMENT =		GTK+ IRC Client
> -PSL_COMMIT =		d91e55ea128af6218897d3b3723b28af7138c3d6
> -DIST_TUPLE +=		github ZoiteChat zoitechat v2.19.0 .
> +PSL_COMMIT =		3955e3ec29b94c3cca7bd4509c5f14a7c0959e26
> +DIST_TUPLE +=		github ZoiteChat zoitechat v2.19.1 .
>  DIST_TUPLE +=		github publicsuffix list ${PSL_COMMIT} \
>  			src/common/publicsuffix
>  CATEGORIES =		net x11
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/net/zoitechat/distinfo,v
> diff -u -p -r1.1.1.1 distinfo
> --- distinfo	9 Sep 2026 15:15:21 -0000	1.1.1.1
> +++ distinfo	10 Oct 2026 10:26:31 -0000
> @@ -1,4 +1,4 @@
> -SHA256 (ZoiteChat-zoitechat-v2.19.0.tar.gz) =
> oBlK3zuLIaXKBtxFNED3GuSRykjsch3YOczywndbVf4= -SHA256
> (publicsuffix-list-d91e55ea128af6218897d3b3723b28af7138c3d6.tar.gz) =
> rCQCD+233k9sBvifccjFk8U7/m+Ru6YG1bIeXCu4OMA= -SIZE
> (ZoiteChat-zoitechat-v2.19.0.tar.gz) = 3522858 -SIZE
> (publicsuffix-list-d91e55ea128af6218897d3b3723b28af7138c3d6.tar.gz) =
> 306199 +SHA256 (ZoiteChat-zoitechat-v2.19.1.tar.gz) =
> pkJz7GFlhzCiFRTekUqhYLTrlU1WPF1VRQyoz+MyoJg= +SHA256
> (publicsuffix-list-3955e3ec29b94c3cca7bd4509c5f14a7c0959e26.tar.gz) =
> o1GFP6MCHOHTmVV5I6xXgSjB7EOtM8yZnMyz37u7HP8= +SIZE
> (ZoiteChat-zoitechat-v2.19.1.tar.gz) = 3523177 +SIZE
> (publicsuffix-list-3955e3ec29b94c3cca7bd4509c5f14a7c0959e26.tar.gz) =
> 306310 Index: patches/patch-src_common_util_c
> ===================================================================
> RCS file: patches/patch-src_common_util_c diff -N
> patches/patch-src_common_util_c --- /dev/null	1 Jan 1970
> 00:00:00 -0000 +++ patches/patch-src_common_util_c	10 Oct 2026
> 10:42:13 -0000 @@ -0,0 +1,24 @@ +warning: null passed to a callee
> that requires a non-null argument [-Wnonnull]
> + 1463 |         digest = HMAC (EVP_sha256 (), keyhash, strlen
> (keyhash), (unsigned char *) challenge, strlen (challenge), NULL,
> NULL); + +Index: src/common/util.c
> +--- src/common/util.c.orig
> ++++ src/common/util.c
> +@@ -1444,7 +1444,7 @@ challengeauth_response (const char *username,
> const ch
> + 	char *passhash;
> + 	char *key;
> + 	char *keyhash;
> +-	unsigned char *digest;
> ++	unsigned char digest[SHA256_DIGEST_LENGTH];
> + 	GString *buf = g_string_new_len (NULL, SHA256_DIGEST_LENGTH
> * 2);
> + 
> + 	user = rfc_strlower (username); /* convert username to
> lowercase as per the RFC */ +@@ -1460,7 +1460,7 @@
> challengeauth_response (const char *username, const ch
> + 	keyhash = str_sha256hash (key);
> + 	g_free (key);
> + 
> +-	digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash),
> (unsigned char *) challenge, strlen (challenge), NULL, NULL);
> ++	HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned
> char *) challenge, strlen (challenge), digest, NULL);
> + 	g_free (keyhash);
> + 
> + 	for (i = 0; i < SHA256_DIGEST_LENGTH; i++)
> 



-- 
iz (she/her)

> I say mundane things
> so the uninteresting
> just might get noticed.

izder456 (dot) neocities (dot) org