Created attachment 271531 [details] update to 0.2.23 ### Release notes This release fixes a critical bug, other bug fixes and some small features and test improvements. The critical bug was discovered during a manual audit performed by iphy. You can find more on the issue at https://github.com/TokTok/c-toxcore/security/advisories/GHSA-42vg-9mg3-399f . Other bug fixes where applied all over the codebase and should result in an even more stable core experience. A minor noteworthy feature that was added is a function to get a list of group chats, further improving ngc quality of life. As always, none of the public facing apis (tox.h/toxav.h/toxencryptsave.h/etc) where modified or removed, which should make this update seamless. #### Bug Fixes - limit number of saved group peers when loading from disk And add `unpack_gc_saved_peers` bounds test. ([de31d805](https://github.com/TokTok/c-toxcore/commit/de31d80571ed2e8520db41a88c3354545ba16d9a)) - wrong comment in group code ([147dbe11](https://github.com/TokTok/c-toxcore/commit/147dbe11d1b077a8861bcbff6a96247e31b083b2)) - **DHT:** - refactor memory handling of loaded dht state Previous code could double-free if more than one dht states per tox-file and a following allocation fails. ([6e959f36](https://github.com/TokTok/c-toxcore/commit/6e959f36734f8baacba60c2e7dbe7d2f5f3f8164)) - Suppress the warning about IPv6 nodes when IPv6 is turned off ([71c354bf](https://github.com/TokTok/c-toxcore/commit/71c354bfea8720f0fbdc40d3c67290799a64df51)) - **av:** Fix Use-After-Free when peer goes offline. ([dbb65223](https://github.com/TokTok/c-toxcore/commit/dbb652239a228c7536ac473856bee42b6e3698c2)) - **gca:** announce max sizes where 32bytes too large ([5080b21c](https://github.com/TokTok/c-toxcore/commit/5080b21ca5fe2404cba70139fc3cf19dd3992127)) - **onion:** Size GCA announce response buffer to actual content length. ([23853004](https://github.com/TokTok/c-toxcore/commit/23853004d933cadb53439353c1d156f2db856755)) - **test:** fix mypy failure ([8016a502](https://github.com/TokTok/c-toxcore/commit/8016a5023bffb85ac0386ed14f57c96cb29e79ea)) #### Features - Add `Tox_Iterate_Options` for granular control over `tox_iterate`. ([10975240](https://github.com/TokTok/c-toxcore/commit/109752403e3a9bc4f9d1a72a5da40441bbcfa95c)) - Add a function to get the list of valid group chat numbers. ([8f37a2f1](https://github.com/TokTok/c-toxcore/commit/8f37a2f17aa4e77d91f80953b89c7b7bd39034f4))
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=d71a613b8f54c2140b05ff3c4b3f3535a5684ba9 commit d71a613b8f54c2140b05ff3c4b3f3535a5684ba9 Author: Eric Camachat <eric@camachat.org> AuthorDate: 2026-06-05 18:46:23 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-06-05 18:46:23 +0000 net-im/tox: Update 0.2.22 => 0.2.23 (security fix) Changelog: https://github.com/TokTok/c-toxcore/releases/tag/v0.2.23 PR: 295879 Security: GHSA-42vg-9mg3-399f Sponsored by: UNIS Labs MFH: 2026Q2 net-im/tox/Makefile | 3 +-- net-im/tox/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-)
A commit in branch 2026Q2 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=d700e96c512a9b8d2c04a3a8e00ed9748bd67dbb commit d700e96c512a9b8d2c04a3a8e00ed9748bd67dbb Author: Eric Camachat <eric@camachat.org> AuthorDate: 2026-06-05 18:46:23 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-06-05 18:49:27 +0000 net-im/tox: Update 0.2.22 => 0.2.23 (security fix) Changelog: https://github.com/TokTok/c-toxcore/releases/tag/v0.2.23 PR: 295879 Security: GHSA-42vg-9mg3-399f Sponsored by: UNIS Labs MFH: 2026Q2 (cherry picked from commit d71a613b8f54c2140b05ff3c4b3f3535a5684ba9) net-im/tox/Makefile | 2 +- net-im/tox/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
Thanks.