From: Stuart Henderson Subject: Re: net/libslirp: update to 4.9.5 To: naddy@openbsd.org, ports@openbsd.org, brad@comstyle.com Date: Tue, 29 Sep 2026 08:18:30 +0100 On 2026/09/28 23:04, Kirill A. Korinsky wrote: > Folks, > > I had discovered that libslirp had a secirity related release which was > issues a few day ago. > > Related changelog entries: > > - Fix bounds-check in processing OEM commands (CVE-2026-95507) > - Fix bounds-check in dhcpv6 against MTU (CVE-2026-95508) > > it was tested with qemu, no regression discovered. > > Ok for 8.0? The source diff between these versions looks sane, I see no issues for it going into 8.0 > Index: Makefile > =================================================================== > RCS file: /home/cvs/ports/net/libslirp/Makefile,v > diff -u -p -r1.4 Makefile > --- Makefile 15 Jun 2026 08:19:59 -0000 1.4 > +++ Makefile 28 Sep 2026 20:55:22 -0000 > @@ -1,6 +1,6 @@ > COMMENT= general purpose TCP-IP emulator library > > -VER= 4.9.3 > +VER= 4.9.5 > DISTNAME= libslirp-v${VER} > PKGNAME= libslirp-${VER} > CATEGORIES= net > Index: distinfo > =================================================================== > RCS file: /home/cvs/ports/net/libslirp/distinfo,v > diff -u -p -r1.3 distinfo > --- distinfo 15 Jun 2026 08:19:59 -0000 1.3 > +++ distinfo 28 Sep 2026 20:55:35 -0000 > @@ -1,2 +1,2 @@ > -SHA256 (libslirp-v4.9.3.tar.bz2) = yC4ixzvcPywDjlONTwycIWbe+yQCIS1hu3yxtTC6lS8= > -SIZE (libslirp-v4.9.3.tar.bz2) = 133720 > +SHA256 (libslirp-v4.9.5.tar.bz2) = T1nfiWyzRep21/aLHoIIcv6qnYJVpnYfa/ig8tUUS80= > +SIZE (libslirp-v4.9.5.tar.bz2) = 134635 > Index: patches/patch-meson_build > =================================================================== > RCS file: patches/patch-meson_build > diff -N patches/patch-meson_build > --- patches/patch-meson_build 15 Jun 2026 08:19:59 -0000 1.1 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,22 +0,0 @@ > -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a > - > -Index: meson.build > ---- meson.build.orig > -+++ meson.build > -@@ -238,6 +238,16 @@ ncsitest = executable('ncsitest', 'test/ncsitest.c', > - > - test('ncsi', ncsitest) > - > -+guestfwdtest = executable('guestfwdtest', 'test/guestfwdtest.c', > -+ link_with: [lib], > -+ c_args : cargs, > -+ link_args : vflag, > -+ include_directories: ['src'], > -+ dependencies: libslirp_deps > -+) > -+ > -+test('guestfwd', guestfwdtest) > -+ > - if install_devel > - install_headers(['src/libslirp.h'], subdir : 'slirp') > - > Index: patches/patch-src_slirp_c > =================================================================== > RCS file: patches/patch-src_slirp_c > diff -N patches/patch-src_slirp_c > --- patches/patch-src_slirp_c 15 Jun 2026 08:19:59 -0000 1.1 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,21 +0,0 @@ > -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a > - > -Index: src/slirp.c > ---- src/slirp.c.orig > -+++ src/slirp.c > -@@ -1581,9 +1581,12 @@ static bool check_guestfwd(Slirp *slirp, struct in_add > - (htonl(0x0204) & ~slirp->vnetwork_mask.s_addr); > - } > - if ((guest_addr->s_addr & slirp->vnetwork_mask.s_addr) != > -- slirp->vnetwork_addr.s_addr || > -- guest_addr->s_addr == slirp->vhost_addr.s_addr || > -- guest_addr->s_addr == slirp->vnameserver_addr.s_addr) { > -+ slirp->vnetwork_addr.s_addr) { > -+ return false; > -+ } > -+ if (!slirp->disable_dns && > -+ guest_addr->s_addr == slirp->vnameserver_addr.s_addr && > -+ guest_port == 53) { > - return false; > - } > - > Index: patches/patch-src_tcp_input_c > =================================================================== > RCS file: patches/patch-src_tcp_input_c > diff -N patches/patch-src_tcp_input_c > --- patches/patch-src_tcp_input_c 15 Jun 2026 08:19:59 -0000 1.1 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,36 +0,0 @@ > -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a > - > -Index: src/tcp_input.c > ---- src/tcp_input.c.orig > -+++ src/tcp_input.c > -@@ -600,20 +600,17 @@ findso: > - if (af == AF_INET && > - (so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) == > - slirp->vnetwork_addr.s_addr) { > -- if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr && > -- so->so_faddr.s_addr != slirp->vnameserver_addr.s_addr) { > -- /* May be an add exec */ > -- for (ex_ptr = slirp->guestfwd_list; ex_ptr; > -- ex_ptr = ex_ptr->ex_next) { > -- if (ex_ptr->ex_fport == so->so_fport && > -- so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { > -- so->so_state |= SS_CTL; > -- break; > -- } > -+ /* May be an add exec */ > -+ for (ex_ptr = slirp->guestfwd_list; ex_ptr; > -+ ex_ptr = ex_ptr->ex_next) { > -+ if (ex_ptr->ex_fport == so->so_fport && > -+ so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { > -+ so->so_state |= SS_CTL; > -+ break; > - } > -- if (so->so_state & SS_CTL) { > -- goto cont_input; > -- } > -+ } > -+ if (so->so_state & SS_CTL) { > -+ goto cont_input; > - } > - /* CTL_ALIAS: Do nothing, tcp_fconnect will be called on it */ > - } > Index: patches/patch-src_tcp_subr_c > =================================================================== > RCS file: patches/patch-src_tcp_subr_c > diff -N patches/patch-src_tcp_subr_c > --- patches/patch-src_tcp_subr_c 15 Jun 2026 08:19:59 -0000 1.1 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,41 +0,0 @@ > -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a > - > -Index: src/tcp_subr.c > ---- src/tcp_subr.c.orig > -+++ src/tcp_subr.c > -@@ -992,22 +992,20 @@ int tcp_ctl(struct socket *so) > - DEBUG_ARG("so = %p", so); > - > - /* TODO: IPv6 */ > -- if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr) { > -- /* Check if it's pty_exec */ > -- for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { > -- if (ex_ptr->ex_fport == so->so_fport && > -- so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { > -- if (ex_ptr->write_cb) { > -- so->s = SLIRP_INVALID_SOCKET; > -- so->guestfwd = ex_ptr; > -- return 1; > -- } > -- DEBUG_MISC(" executing %s", ex_ptr->ex_exec); > -- if (ex_ptr->ex_unix) > -- return open_unix(so, ex_ptr->ex_unix); > -- else > -- return fork_exec(so, ex_ptr->ex_exec); > -+ /* Check if it's pty_exec */ > -+ for (ex_ptr = slirp->guestfwd_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { > -+ if (ex_ptr->ex_fport == so->so_fport && > -+ so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { > -+ if (ex_ptr->write_cb) { > -+ so->s = SLIRP_INVALID_SOCKET; > -+ so->guestfwd = ex_ptr; > -+ return 1; > - } > -+ DEBUG_MISC(" executing %s", ex_ptr->ex_exec); > -+ if (ex_ptr->ex_unix) > -+ return open_unix(so, ex_ptr->ex_unix); > -+ else > -+ return fork_exec(so, ex_ptr->ex_exec); > - } > - } > - sb->sb_cc = slirp_fmt(sb->sb_wptr, sb->sb_datalen - (sb->sb_wptr - sb->sb_data), > Index: patches/patch-test_guestfwdtest_c > =================================================================== > RCS file: patches/patch-test_guestfwdtest_c > diff -N patches/patch-test_guestfwdtest_c > --- patches/patch-test_guestfwdtest_c 15 Jun 2026 08:19:59 -0000 1.1 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,79 +0,0 @@ > -https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3e6e68e779c9051590250a87214dabf91e70949a > - > -Index: test/guestfwdtest.c > ---- test/guestfwdtest.c.orig > -+++ test/guestfwdtest.c > -@@ -0,0 +1,73 @@ > -+/* SPDX-License-Identifier: BSD-3-Clause */ > -+ > -+#include > -+#include > -+ > -+#include "libslirp.h" > -+ > -+static slirp_ssize_t guestfwd_write(const void *buf, size_t len, void *opaque) > -+{ > -+ return len; > -+} > -+ > -+static SlirpCb callbacks; > -+ > -+static struct in_addr in_addr4(uint32_t addr) > -+{ > -+ struct in_addr ret = { .s_addr = htonl(addr) }; > -+ > -+ return ret; > -+} > -+ > -+static Slirp *guestfwd_slirp(bool disable_dns) > -+{ > -+ SlirpConfig config = { > -+ .version = SLIRP_CONFIG_VERSION_MAX, > -+ .in_enabled = true, > -+ .vnetwork = in_addr4(0x0a000200), > -+ .vnetmask = in_addr4(0xffffff00), > -+ .vhost = in_addr4(0x0a000202), > -+ .vdhcp_start = in_addr4(0x0a00020f), > -+ .vnameserver = in_addr4(0x0a000203), > -+ .disable_dns = disable_dns, > -+ }; > -+ > -+ return slirp_new(&config, &callbacks, NULL); > -+} > -+ > -+static void assert_guestfwd(Slirp *slirp, struct in_addr addr, int port, > -+ bool expect_ok) > -+{ > -+ int ret; > -+ > -+ ret = slirp_add_guestfwd(slirp, guestfwd_write, NULL, &addr, port); > -+ assert((ret == 0) == expect_ok); > -+ > -+ if (ret == 0) { > -+ assert(slirp_remove_guestfwd(slirp, addr, port) == 0); > -+ } > -+} > -+ > -+static void test_guestfwd_validation(void) > -+{ > -+ struct in_addr vhost = in_addr4(0x0a000202); > -+ struct in_addr vnameserver = in_addr4(0x0a000203); > -+ Slirp *slirp; > -+ > -+ slirp = guestfwd_slirp(false); > -+ assert_guestfwd(slirp, vhost, 8080, true); > -+ assert_guestfwd(slirp, vnameserver, 8080, true); > -+ assert_guestfwd(slirp, vhost, 67, true); > -+ assert_guestfwd(slirp, vhost, 69, true); > -+ assert_guestfwd(slirp, vnameserver, 53, false); > -+ slirp_cleanup(slirp); > -+ > -+ slirp = guestfwd_slirp(true); > -+ assert_guestfwd(slirp, vnameserver, 53, true); > -+ slirp_cleanup(slirp); > -+} > -+ > -+int main(int argc, char *argv[]) > -+{ > -+ test_guestfwd_validation(); > -+} > > > -- > wbr, Kirill >