Subject: CVS commit: pkgsrc/net/libcares
From: Thomas Klausner
Date: 2021-08-10 09:27:23
Message id: 20210810072723.A64D4FA97@cvs.NetBSD.org

Log Message:
libcares: update to 1.17.2.

c-ares version 1.17.2

This is a security and bugfix release.  It addresses a few security related
issues along with various bugfixes mostly related to portability.

Security:
 o NodeJS passes NULL for addr and 0 for addrlen to ares_parse_ptr_reply() on
   systems where malloc(0) returns NULL.  This would cause a crash. [8]
 o When building c-ares with CMake, the RANDOM_FILE would not be set and
   therefore downgrade to the less secure random number generator [12]
 o If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause
   a crash [13]
 o Crash in sortaddrinfo() if the list size equals 0 due to an unexpected
   DNS response [14]
 o Expand number of escaped characters in DNS replies as per RFC1035 5.1 to
   prevent spoofing [16], [17]
 o Perform validation on hostnames to prevent possible XSS due to applications
   not performing valiation themselves [18]

Changes:
 o Use non-blocking /dev/urandom for random data to prevent early startup
   performance issues [5]
 o z/OS port [6]
 o ares_malloc(0) is now defined behavior (returns NULL) rather than
   system-specific to catch edge cases [7]

Bug fixes:
 o Fuzz testing files were not distributed with official archives [1]
 o Building tests should not force building of static libraries except on
   Windows [2]
 o Windows builds of the tools would fail if built as static due to a missing
   CARES_STATICLIB definition [3]
 o Relative headers must use double quotes to prevent pulling in a system
   library [4]
 o Fix OpenBSD building by implementing portability updates for including
   arpa/nameser.h [9]
 o Fix building out-of-tree for autotools [10]
 o Make install on MacOS/iOS with CMake was missing the bundle destination so
   libraries weren't actually installed [11]
 o Fix retrieving DNS server configuration on MacOS and iOS if the configuration
   did not include search domains [15]
 o ares_parse_a_reply and ares_parse_aaa_reply were erroneously using strdup()
   instead of ares_strdup() [19]

Files:
RevisionActionfile
1.30modifypkgsrc/net/libcares/Makefile
1.15modifypkgsrc/net/libcares/PLIST
1.23modifypkgsrc/net/libcares/distinfo