Attachment #254927 for bug #282536




PORTNAME=		libqb
DISTVERSION=		2.0.8
PORTREVISION=		1
CATEGORIES=		devel
MASTER_SITES=		https://github.com/ClusterLabs/${PORTNAME}/releases/download/v${DISTVERSION}/

MAINTAINER=		ports@FreeBSD.org
COMMENT=		High performance logging, tracing, ipc, and polling library
WWW=			https://github.com/ClusterLabs/libqb/wiki/

LICENSE=		LGPL21
LICENSE_FILE=		${WRKSRC}/COPYING

TEST_DEPENDS=		checkmk:devel/check

GROUPS=			haclient

QB_SOCKET_DIR?=		/var/run/qb
PLIST_SUB+=		QB_SOCKET_DIR=${QB_SOCKET_DIR}

USES=			cpe gmake gnome libtool pkgconfig python tar:xz
CPE_VENDOR=		clusterlabs
GNU_CONFIGURE=		yes
GNU_CONFIGURE_MANPREFIX=       ${PREFIX}/share
USE_GNOME=		libxml2
USE_LDCONFIG=		yes

GNU_CONFIGURE=		yes
CONFIGURE_ARGS=		--with-socket-dir=${QB_SOCKET_DIR} \
			PACKAGE_STRING="${PORTNAME} ${DISTVERSION}" \
			PACKAGE_VERSION=${DISTVERSION}
LDFLAGS=		-B${LOCALBASE}/bin

INSTALL_TARGET=		install-strip
TEST_TARGET=		check

LDFLAGS+=		-B${LOCALBASE}/bin

GROUPS=			haclient

PLIST_SUB+=		QB_SOCKET_DIR=${QB_SOCKET_DIR}

OPTIONS_DEFINE=		DOCS DOXYGEN
OPTIONS_SUB=		yes

DOXYGEN_IMPLIES=	DOCS
DOXYGEN_BUILD_DEPENDS=	doxygen:devel/doxygen

QB_SOCKET_DIR?=		/var/run/qb

post-configure:
	${REINPLACE_CMD} -e 's/install: install-am/install:/g' ${WRKSRC}/doxygen2man/Makefile


Lines 1-3 Link Here

(-)b/devel/libqb/distinfo (-3 / +3 lines)
1	TIMESTAMP = 1678190523	1	TIMESTAMP = 1730659822
2	SHA256 (libqb-2.0.6.tar.xz) = f1e744208e8f69934804c14e05d9707668f99d4867de9cccf2f7a6bf4d48331c	2	SHA256 (libqb-2.0.8.tar.xz) = b42531fc20b8ac02f4c6d0a4dc49f7c4a1eef09bdb13af5f6927b7fc49522ee6
3	SIZE (libqb-2.0.6.tar.xz) = 507400	3	SIZE (libqb-2.0.8.tar.xz) = 521600

Removed Link Here

(-)a/devel/libqb/files/patch-configure (-11 lines)
1	--- configure.orig 2022-01-19 20:58:44 UTC
2	+++ configure
3	@@ -21201,7 +21201,7 @@ done
4
5	CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
6	LIBS="$LIBS $PTHREAD_LIBS"
7	-for ac_func in pthread_spin_lock pthread_setschedparam \
8	+for ac_func in pthread_setschedparam \
9	pthread_mutexattr_setpshared \
10	pthread_condattr_setpshared \
11	sem_timedwait semtimedop

Lines 1-3 Link Here

(-)b/devel/libqb/pkg-descr (-3 / +7 lines)
1	libqb is a library with the primary purpose of providing high performance	1	libqb is a library with the primary purpose of providing high-performance,
2	client server reusable features. It provides high performance logging, tracing,	2	reusable features for client-server architecture, such as logging, tracing,
3	ipc, and poll.	3	inter-process communication (IPC), and polling.
		4
		5	libqb is not intended to be an all-encompassing library, but instead provide
		6	focused APIs that are highly tuned for maximum performance for client-server
		7	applications.

Lines 15-21 include/qb/qbutil.h Link Here

(-)b/devel/libqb/pkg-plist (-1 / +1 lines)
15	lib/libqb.a	15	lib/libqb.a
16	lib/libqb.so	16	lib/libqb.so
17	lib/libqb.so.100	17	lib/libqb.so.100
18	lib/libqb.so.100.3.0	18	lib/libqb.so.100.3.2
19	libdata/pkgconfig/libqb.pc	19	libdata/pkgconfig/libqb.pc
20	sbin/qb-blackbox	20	sbin/qb-blackbox
21	%%PORTDOCS%%%%DOCSDIR%%/COPYING	21	%%PORTDOCS%%%%DOCSDIR%%/COPYING




  <vuln vid="ecf9a798-9aa9-11ef-a8f0-a8a15998b5cb">
    <topic>libqb -- Buffer overflow</topic>
    <affects>
      <package>
	<name>libqb</name>
	<range><lt>2.0.8</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>cve@mitre.org reports:</p>
	<blockquote cite="https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8">
	  <p>log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via
	long log messages because the header size is not considered.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2023-39976</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2023-39976</url>
    </references>
    <dates>
      <discovery>2023-08-08</discovery>
      <entry>2024-11-04</entry>
    </dates>
  </vuln>

  <vuln vid="e17384ef-c5e8-4b5d-bb62-c13405e7f1f7">
    <topic>chromium -- multiple security fixes</topic>
    <affects>
- 

Return to bug 282536

Lines 1-44 Link Here

(-)b/devel/libqb/Makefile (-11 / +11 lines)
1	PORTNAME= libqb	1	PORTNAME= libqb
2	DISTVERSION= 2.0.6	2	DISTVERSION= 2.0.8
3	PORTREVISION= 1
4	CATEGORIES= devel	3	CATEGORIES= devel
5	MASTER_SITES= https://github.com/ClusterLabs/${PORTNAME}/releases/download/v${DISTVERSION}/	4	MASTER_SITES= https://github.com/ClusterLabs/${PORTNAME}/releases/download/v${DISTVERSION}/
6		5
7	MAINTAINER= ports@FreeBSD.org	6	MAINTAINER= ports@FreeBSD.org
8	COMMENT= High performance logging, tracing, ipc, and polling library	7	COMMENT= High performance logging, tracing, ipc, and polling library
9	WWW= https://github.com/ClusterLabs/libqb/wiki	8	WWW= https://github.com/ClusterLabs/libqb/wiki/
10		9
11	LICENSE= LGPL21	10	LICENSE= LGPL21
12	LICENSE_FILE= ${WRKSRC}/COPYING	11	LICENSE_FILE= ${WRKSRC}/COPYING
13		12
14	TEST_DEPENDS= checkmk:devel/check	13	TEST_DEPENDS= checkmk:devel/check
15		14
16	GROUPS= haclient
17
18	QB_SOCKET_DIR?= /var/run/qb
19	PLIST_SUB+= QB_SOCKET_DIR=${QB_SOCKET_DIR}
20
21	USES= cpe gmake gnome libtool pkgconfig python tar:xz	15	USES= cpe gmake gnome libtool pkgconfig python tar:xz
22	CPE_VENDOR= clusterlabs	16	CPE_VENDOR= clusterlabs
23	GNU_CONFIGURE= yes
24	GNU_CONFIGURE_MANPREFIX= ${PREFIX}/share
25	USE_GNOME= libxml2	17	USE_GNOME= libxml2
26	USE_LDCONFIG= yes	18	USE_LDCONFIG= yes
27		19
		20	GNU_CONFIGURE= yes
28	CONFIGURE_ARGS= --with-socket-dir=${QB_SOCKET_DIR} \	21	CONFIGURE_ARGS= --with-socket-dir=${QB_SOCKET_DIR} \
29	PACKAGE_STRING="${PORTNAME} ${DISTVERSION}" \	22	PACKAGE_STRING="${PORTNAME} ${DISTVERSION}" \
30	PACKAGE_VERSION=${DISTVERSION}	23	PACKAGE_VERSION=${DISTVERSION}
31	LDFLAGS= -B${LOCALBASE}/bin
32		24
33	INSTALL_TARGET= install-strip	25	INSTALL_TARGET= install-strip
34	TEST_TARGET= check	26	TEST_TARGET= check
35		27
		28	LDFLAGS+= -B${LOCALBASE}/bin
		29
		30	GROUPS= haclient
		31
		32	PLIST_SUB+= QB_SOCKET_DIR=${QB_SOCKET_DIR}
		33
36	OPTIONS_DEFINE= DOCS DOXYGEN	34	OPTIONS_DEFINE= DOCS DOXYGEN
37	OPTIONS_SUB= yes	35	OPTIONS_SUB= yes
38		36
39	DOXYGEN_IMPLIES= DOCS	37	DOXYGEN_IMPLIES= DOCS
40	DOXYGEN_BUILD_DEPENDS= doxygen:devel/doxygen	38	DOXYGEN_BUILD_DEPENDS= doxygen:devel/doxygen
41		39
		40	QB_SOCKET_DIR?= /var/run/qb
		41
42	post-configure:	42	post-configure:
43	${REINPLACE_CMD} -e 's/install: install-am/install:/g' ${WRKSRC}/doxygen2man/Makefile	43	${REINPLACE_CMD} -e 's/install: install-am/install:/g' ${WRKSRC}/doxygen2man/Makefile
44		44

Lines 1-3 Link Here

(-)b/security/vuxml/vuln/2024.xml (-1 / +27 lines)
		1	<vuln vid="ecf9a798-9aa9-11ef-a8f0-a8a15998b5cb">
		2	<topic>libqb -- Buffer overflow</topic>
		3	<affects>
		4	<package>
		5	<name>libqb</name>
		6	<range><lt>2.0.8</lt></range>
		7	</package>
		8	</affects>
		9	<description>
		10	<body xmlns="http://www.w3.org/1999/xhtml">
		11	<p>cve@mitre.org reports:</p>
		12	<blockquote cite="https://github.com/ClusterLabs/libqb/commit/1bbaa929b77113532785c408dd1b41cd0521ffc8">
		13	<p>log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via
		14	long log messages because the header size is not considered.</p>
		15	</blockquote>
		16	</body>
		17	</description>
		18	<references>
		19	<cvename>CVE-2023-39976</cvename>
		20	<url>https://nvd.nist.gov/vuln/detail/CVE-2023-39976</url>
		21	</references>
		22	<dates>
		23	<discovery>2023-08-08</discovery>
		24	<entry>2024-11-04</entry>
		25	</dates>
		26	</vuln>
		27
1	<vuln vid="e17384ef-c5e8-4b5d-bb62-c13405e7f1f7">	28	<vuln vid="e17384ef-c5e8-4b5d-bb62-c13405e7f1f7">
2	<topic>chromium -- multiple security fixes</topic>	29	<topic>chromium -- multiple security fixes</topic>
3	<affects>	30	<affects>
4	-