From: Theo Buehler Subject: Re: maintainer update: net/zoitechat -> 2.19.1 To: izzy Meyer Cc: ports@openbsd.org Date: Sat, 10 Oct 2026 12:48:25 +0200 On Wed, Oct 07, 2026 at 09:07:05PM -0500, izzy Meyer wrote: > Hi, > > Ping! > > Now that the tree has been unlocked, could this be reviewed? It mostly looks good to me. There is one warning that we should fix, however, so I'd suggest I commit the diff below. The other warnings are all harmless. This will cause a crash if the code is ever hit: ../zoitechat-2.19.1/src/common/util.c:1463:108: warning: null passed to a callee that requires a non-null argument [-Wnonnull] 1463 | digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL); The penultimate argument of HMAC must not be NULL on anything but OpenSSL because there is no way to make the static buffer thread safe. We removed this feature a while back and BoringSSL about a decade ago: https://github.com/openbsd/src/commit/9cb045229698d08f09fbd7cf9ae7f3b9b8f8b848 The patch below fixes this. Index: Makefile =================================================================== RCS file: /cvs/ports/net/zoitechat/Makefile,v diff -u -p -r1.2 Makefile --- Makefile 9 Sep 2026 15:16:53 -0000 1.2 +++ Makefile 10 Oct 2026 10:26:31 -0000 @@ -1,6 +1,6 @@ COMMENT = GTK+ IRC Client -PSL_COMMIT = d91e55ea128af6218897d3b3723b28af7138c3d6 -DIST_TUPLE += github ZoiteChat zoitechat v2.19.0 . +PSL_COMMIT = 3955e3ec29b94c3cca7bd4509c5f14a7c0959e26 +DIST_TUPLE += github ZoiteChat zoitechat v2.19.1 . DIST_TUPLE += github publicsuffix list ${PSL_COMMIT} \ src/common/publicsuffix CATEGORIES = net x11 Index: distinfo =================================================================== RCS file: /cvs/ports/net/zoitechat/distinfo,v diff -u -p -r1.1.1.1 distinfo --- distinfo 9 Sep 2026 15:15:21 -0000 1.1.1.1 +++ distinfo 10 Oct 2026 10:26:31 -0000 @@ -1,4 +1,4 @@ -SHA256 (ZoiteChat-zoitechat-v2.19.0.tar.gz) = oBlK3zuLIaXKBtxFNED3GuSRykjsch3YOczywndbVf4= -SHA256 (publicsuffix-list-d91e55ea128af6218897d3b3723b28af7138c3d6.tar.gz) = rCQCD+233k9sBvifccjFk8U7/m+Ru6YG1bIeXCu4OMA= -SIZE (ZoiteChat-zoitechat-v2.19.0.tar.gz) = 3522858 -SIZE (publicsuffix-list-d91e55ea128af6218897d3b3723b28af7138c3d6.tar.gz) = 306199 +SHA256 (ZoiteChat-zoitechat-v2.19.1.tar.gz) = pkJz7GFlhzCiFRTekUqhYLTrlU1WPF1VRQyoz+MyoJg= +SHA256 (publicsuffix-list-3955e3ec29b94c3cca7bd4509c5f14a7c0959e26.tar.gz) = o1GFP6MCHOHTmVV5I6xXgSjB7EOtM8yZnMyz37u7HP8= +SIZE (ZoiteChat-zoitechat-v2.19.1.tar.gz) = 3523177 +SIZE (publicsuffix-list-3955e3ec29b94c3cca7bd4509c5f14a7c0959e26.tar.gz) = 306310 Index: patches/patch-src_common_util_c =================================================================== RCS file: patches/patch-src_common_util_c diff -N patches/patch-src_common_util_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-src_common_util_c 10 Oct 2026 10:42:13 -0000 @@ -0,0 +1,24 @@ +warning: null passed to a callee that requires a non-null argument [-Wnonnull] + 1463 | digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL); + +Index: src/common/util.c +--- src/common/util.c.orig ++++ src/common/util.c +@@ -1444,7 +1444,7 @@ challengeauth_response (const char *username, const ch + char *passhash; + char *key; + char *keyhash; +- unsigned char *digest; ++ unsigned char digest[SHA256_DIGEST_LENGTH]; + GString *buf = g_string_new_len (NULL, SHA256_DIGEST_LENGTH * 2); + + user = rfc_strlower (username); /* convert username to lowercase as per the RFC */ +@@ -1460,7 +1460,7 @@ challengeauth_response (const char *username, const ch + keyhash = str_sha256hash (key); + g_free (key); + +- digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL); ++ HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), digest, NULL); + g_free (keyhash); + + for (i = 0; i < SHA256_DIGEST_LENGTH; i++)