# brio 1.1.2
* Input filenames are now automatically converted to UTF-8 from the native encoding (@gaborcsardi, #15)
* `read_file_raw()` now closes file handles (@pbarber, #16)
# brio 1.1.1
* `file_line_endings()` now works as expected on ARM systems (#8)
-- \footref will be added to the kernel, so we now "provide" it instead
-- as of late 2020 the caption package will now adjust it self to the
class. It will even map several of the caption styling macros the
class provides onto the the corresponding setup in the caption
package. Special thanks to Axel Sommerfeldt for this
feature. Therefore we no longer reset in preparation for caption.
-- The mparhack package is no longer marked as emulated as we did not
emulate the fix for the bug regarding \if at firstcolumn. If a document
specifies as twocolumn, we automatically load mparhack
-- some internal cleanup and added some recommended alternatives
1.27:
* fixed issue #25: Two typos in \MultlinedHook for lualatex
1.26
* LuaLaTeX has cramped primitives build in. We ought to use those when
LuaLaTeX is used.
LuaLaTeX brances added.
Special thanks to Marcel Krüger, Ulrike Fischer and Philipp Stephani.
* Fix for a critical bug with the latest LaTeX releases:
class options were messed up.
* Improved justification=kashida/elongated: lists, vowelized texts.
* Fix: Underfull \hbox with amsmath (#133).
* Improved the ini file for Basque (captions).
Version 1.14.7
Fixes broken windows build.
Version 1.14.6
Fix for a DNS Rebind exploit. A special thanks for the collaboration
of the following people:
- Alaric Senat
- Fabrice Fontaine
- Gabriel Corona
- Ian Whyman
- Jean-Francois Dockes
- Marvin Scholz
- Werner Mahr
When upnp uses ixml to parse SOAP messages which contains too many node,
services are unavailable.
Version 1.14.5
Avoid potential memory leak in http_SendMessage()
Get rid of alloca()'s.
Non-recursive version of ixmlNode_free() avoids stack overflow attack.
Fixes CVE-2021-28302.
Version 1.14.4
Add more missing CMake infrastructure to the tarball.
Version 1.14.3
Add CMake infrastructure to the tarball.
Fix for gena leak.
Version 1.14.2
upnpapi.c: Fix crash in UpnpGetIfInfo
Per getifaddrs documentation, the ifa_addr field of an ifaddrs structure
can be null. In a real world example, an entry may be provided for the
non-existent hardware address of a tunnel device. This behavior was
observed with the netlink based getifaddrs implementation in glibc.
Handle interfaces without address
I got a crash on gerbera startup because at least one interface did not have `ifa_addr` set.
The reason is quite simple: they are the physical interfaces which are part of my channel
```
2: eth1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bond0 state UP group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc fq_codel master bond0 state UP group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
4: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
```
CMake:
- Fix tests for all occasions. (Hopefully)
- Set right so-version and don't yell commands.
- Reverted libname-change till decided
Fix IPv6 GENA subscription
Use LOCAL_PORT_V6_ULA_GUA or LOCAL_PORT_V6 depending on the IPv6 address
samples: allow the user to specify the control point interface
This is useful to test UPnP on specific interface (e.g. IPv6-only).
This was already possible on the device sample.
upnp/src/api/upnpapi.c: don't set gIF_IPV4 if there is no IPv4
Don't set gIF_IPV4 if no IPv4 is found to keep the default value of '\0'
otherwise SSDP will try to register IPv4 multicast with address 0.0.0.0
which will result in a runtime failure
Version 1.14.1
CMake Github Actions, including windows build.
upnpapi.c: assume that getifaddrs is available
Assume that getifaddrs is available even if it is not POSIX-compliant,
this will simplify the code and, as a side effect, this allow pupnp to
work on an interface that does not have an IPv4 address.
CMake support.
Fixes the inclusion of alloca.h in WIN32.
Remove the now unused file ClientSubscription.c.
Remove port >= 49152 restriction.
Version 1.14.0
Reworked the miniserver code to deal with SO_REUSEADDR
Factored the common socket code and test for EADDRINUSE returning from
listen() when SO_REUSEADDR is turned on.
Removed template classes.
The files generated through template classes had some drawbacks:
1 - You could not read the code.
2 - You could not step through the code with a debugger.
3 - Doxygen was unable to document it.
This patch removes the templates and creates an auto generator for these
boilerplate generated code in the same spirit of the templates, but
solves the above problems.
Still, dealing with documentation still needs some work, but should be
much easier now.
upnpapi.c: retrieve gIF_IPV4_NETMASK with BSD
BSD is using getifaddrs, update the code to retrieve the IPv4 netmask
(used in the CallStranger fix)
Signed-off-by: Fabrice Fontaine fontaine.fabrice@gmail.com
Drop UpnpInit
This function is deprecated since a long time moreover it is vulnerable
to CallStranger a.k.a. CVE-2020-12695 and can't be fixed without
breaking the API as HostIP only allows the user to pass an IP address
and not a netmask.
If we want to discover the netmask from the HostIP provided in UPnPInit,
we'll have to loop through all the available interfaces to find the
interface with the given IP address to finally retrieve the netmask.
This is a lot of work/modification for a deprecated function. Moreover,
in the end UPnPInit will be like a "deprecated" (i.e. IPv4-only) version
of UPnPInit2.
So it is time to remove this deprecated function.
As a result, also remove getlocalhostname and DEFAULT_INTERFACE which
are not needed anymore and replace UpnpInit by UpnpInit2 in comments.
Signed-off-by: Fabrice Fontaine fontaine.fabrice@gmail.com
Partial fix for CallStranger on IPv4
This is a partial fix for CallStranger a.k.a. CVE-2020-12695
Check that DeliveryURLs are in the expected network segment as requested
by the new UPnP UDA:
https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf.
Here is an extract of the new requirement:
The subscription request containing a delivery URL not on the same
network segment as the fully qualified event subscription URL shall not
be accepted. For private networks this means that the delivery URL
provided will adhere to the following IP ranges:
. 10.0.0.0 - 10.255.255.255 (10/8 prefix)
. 172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
. 192.168.0.0 - 192.168.255.255 (192.168/16 prefix)
In the context of pupnp, this means that the IPv4 netmask is now
retrieved when using UPnPInit2. Then, each DeliveryURL is checked
against the device's IPv4 address and netmask. If one of them are not
compliant, the whole subscription is rejected.
This first commit should be enhanced / updated to:
. remove UPnPInit (it is deprecated for a long time) or update it so
. the user can also pass the netmask
. fix IPv6
. fix Windows code
. retrieve the netmask in the BSD code of UPnPInit2
Signed-off-by: Fabrice Fontaine fontaine.fabrice@gmail.com
NULL pointer dereference in FindServiceControlURLPath
Version 1.12.1
setsockopt(IP_MULTICAST_IF) fails on 64-bit CPUs
Do not use usleep when using newer POSIX C source.
usleep is deprecated and is optionally unavailable with uClibc-ng.
Add Os/UserAgent information to UpnpActionRequest and UpnpFileInfo
Add CtrlPtIPAddr to UpnpFileInfo class
List: Add extern C for C++ users
Version 1.12.0
Reduce spurious HTTP 416 errors due to ill-defined bytes header
I (re)discovered this behavior trying to use the Gerbera media server
with Chromecast (built in to my Vizio P55-F1 TV). Chromecast specifies
"bytes:0-" with no end range, which caused pupnp to return
RANGE_NOT_SATISFIABLE. Jin, the author of MediaTomb, of which Gerbera
is a continuation, fixed this in 2007 in MediaTomb's fork of pupnp, see
gerbera@ccd7994d45 "made sure that range requests specified as
"bytes=0-" do not trigger...", but never passed the fix upstream. When
restarted as Gerbera, pupnp was removed from the local tree in favor of
using the upstream version, and the patch was lost which lead to me
rediscovering it recently.
This is Jin's original patch applied to pupnp 1.8. This teaches pupnp to
ignore the bytes header if it matches "0-" and return HTTP_OK.
When building v1.8.6 (on GNU/Linux) with --disable-device, pupnp doesn't build:
/bin/bash ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I.. -I../upnp/inc -I./inc -I../ixml/inc -DNDEBUG -I./src/inc -I./src/threadutil -I/foo/contrib/x86_64-linux-gnu/include -fPIC -pthread -I/foo/contrib/x86_64-linux-gnu/include -DNDEBUG=1 -O3 -DUPNP_STATIC_LIB -Os -Wall -c -o src/genlib/util/libupnp_la-util.lo `test -f 'src/genlib/util/util.c' || echo './'`src/genlib/util/util.c
In file included from src/genlib/miniserver/miniserver.c:58:0:
./src/inc/upnpapi.h:208:2: error: unknown type name 'service_info'
service_info **serv_info
^~~~~~~~~~~~
This patch fixes compilation for the --disable-device case.
GitHub PRs:
* Remove unused files
* UpnpEnableWebserver: Error correctly when web server compiled-out
* CI: Remove .travis.yml
* Remove TRUE/FALSE defines and BOOL typedef
* CI: Add address sanitizer and leak sanitizer enabled test run
* Add list test
* Add -Wextra and -Wpedantic to get more warnings
* More warning fixes
* Doxygen changes
* Remove unused headers
* Remove IN, OUT and INOUT defines
* Remove unused defines in uri.h
* Use stdbool.h instead of BOOL typedef and defines
* Various compiler warning fixes
* configure.ac: Fix Windows detection
* configure.ac: Enable silent rules
* LinkedList: Simplify _WIN32 check
* Remove checks of __OSX__ define
* Add Github Actions based CI
Github PR * Add forgotten Windows dll export qualifiers
Github PR * Remove and replace the list.h file
Github PRs:
* Overhaul list.h to fix various issues
* Use rand_s in get_random_info on Windows
* Do not redeclare timezone struct if already defined in Mingw
* Fix interface filtering for Windows
- The mentioned fix is not only needed for MSVC, but when
cross-compiling for Windows with mingw-w64 too.
* config.h: Remove DEBUG_TARGET
- The DEBUG_TARGET is no longer used, it was previously used in
upnpdebug.c to disable logging to a file, which now is done
by just not calling UpnpSetLogFileNames.
* Check for -lpthread too
- Updates pthread m4 check from upstream
Version 1.10.1
Fix format string for ExtraHeaders
Version 1.10.0
Fix sed command for upnp patch in configure.ac
Proper allocation for an array of structs and a check for an unlikely
overflow when calling the SIOCGIFCONF ioctl().
It still bugs me the stack requirements of getlocalhostname() and
UpnpGetIfInfo().
Version 1.8.6
Fix format string for ExtraHeaders
Version 1.8.5
Fixed a wrong ifdef in ssdp_device.c that was causing problems with
ipv6.
go1.15.13 (released 2021-06-03) includes security fixes to the archive/zip,
math/big, net, and net/http/httputil packages, as well as bug fixes to the
linker, the go command, and the math/big and net/http packages. See the Go
1.15.13 milestone on our issue tracker for details.
The SetString and UnmarshalText methods of math/big.Rat
<https://pkg.go.dev/math/big#Rat> may cause a panic or an unrecoverable
fatal error if passed inputs with very large exponents.
This is issue <https://github.com/golang/go/issues/44910> and
CVE-2021-33198.
Thanks to the OSS-Fuzz project for discovering this issue and to Emmanuel
Odeke for reporting it.
ReverseProxy in net/http/httputil <https://pkg.go.dev/net/http/httputil> could
be made to forward certain hop-by-hop headers, including Connection. In
case the target of the ReverseProxy was itself a reverse proxy, this would
let an attacker drop arbitrary headers, including those set by the
ReverseProxy.Director.
This is issue <https://github.com/golang/go/issues/46313> and
CVE-2021-33197.
Thanks to Mattias Grenfeldt (https://grenfeldt.dev) and Asta Olofsson for
reporting this issue.
The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in
net <https://pkg.go.dev/net>, and their respective methods on the Resolver
<https://pkg.go.dev/net#Resolver> type may return arbitrary values
retrieved from DNS which do not follow the established RFC 1035
<https://datatracker.ietf.org/doc/html/rfc1035>rules for domain names. If
these names are used without further sanitization, for instance unsafely
included in HTML, they may allow for injection of unexpected content. Note
that LookupTXT may still return arbitrary values that could require
sanitization before further use.
This is issue <https://github.com/golang/go/issues/46241> and
CVE-2021-33195.
Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.
The NewReader and OpenReader functions in archive/zip
<https://pkg.go.dev/archive/zip> can cause a panic or an unrecoverable
fatal error when reading an archive that claims to contain a large number
of files, regardless of its actual size.
This is issue <https://github.com/golang/go/issues/46242>and
CVE-2021-33196.
Thanks to the OSS-Fuzz project for discovering this issue and to Emmanuel
Odeke for reporting it.
4.37.23 (2021-06-03)
Merged Pull Requests
* Update inspec init plugin #5536 (Vasu1105)
* Removed support for compliance and a1 server from InSpec compliance #5534
(Nik08)
* Add Ubuntu to list of FIPS platforms #5533 (clintoncwolfe)
3.4.4 (2021-06-04)
Improvements
* Rename assert_all? to assert_all. assert_all? is deprecated but is
available.
3.4.3 (2021-06-04)
Improvements
* Stopped to change result value of Test::Unit::TestCase#include.
* Added assert_all?.
* Added support for assert_raise_with_message.
3.0.4 (2021-04-08)
Fixed bugs:
- Fixed issue #1802: Improve xdebug.org home page
- Fixed issue #1944: tracing is started without trigger, when profiler is
also enabled
- Fixed issue #1947: xdebug_info() settings section does not show the modes
that are overridden by XDEBUG_MODE
- Fixed issue #1950: Assignment trace with ASSIGN_OBJ_REF crashes
- Fixed issue #1954: Calling xdebug_start_trace without mode including
tracing results in a fatal error
0.14.0
Added
Defaults ws max_size on server to 16MB
Improve user feedback if no ws library installed
Support 'reason' field in 'websocket.close' messages
Implemented lifespan.shutdown.failed
Changed
Upgraded websockets requirements
Switch to asyncio streams API
Update httptools from 0.1.* to 0.2.*
Allow Click 8.0
Add search for a trusted host in ProxyHeadersMiddleware
Up wsproto to 1.0.0
Fixed
Force reload_dirs to be a list
Fix gunicorn worker not running if extras not installed
Fix socket port 0
Prevent garbage collection of main lifespan task
