NetBSD Problem Report #57179

From www@netbsd.org  Mon Jan  9 18:53:40 2023
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 9B37D1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Mon,  9 Jan 2023 18:53:40 +0000 (UTC)
Message-Id: <20230109185339.2DBAE1A923A@mollari.NetBSD.org>
Date: Mon,  9 Jan 2023 18:53:39 +0000 (UTC)
From: cmeerw@cmeerw.org
Reply-To: cmeerw@cmeerw.org
To: gnats-bugs@NetBSD.org
Subject: occasional pkg_add core dumps
X-Send-Pr-Version: www-1.0

>Number:         57179
>Notify-List:    riastradh@NetBSD.org
>Category:       bin
>Synopsis:       occasional pkg_add core dumps
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    riastradh
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jan 09 18:55:00 +0000 2023
>Closed-Date:    
>Last-Modified:  Thu Apr 16 10:52:12 +0000 2026
>Originator:     Christof Meerwald
>Release:        10.0_BETA
>Organization:
>Environment:
NetBSD arm-netbsd 10.0_BETA NetBSD 10.0_BETA (GENERIC64) #0: Wed Jan  4 12:17:54 UTC 2023  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/evbarm/compile/GENERIC64 evbarm
>Description:
I am seeing occasional core dumps from pkg_add, e.g.

gdb /usr/sbin/pkg_add /usr/pkg/pkg_add.core 
GNU gdb (GDB) 11.0.50.20200914-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/pkg_add...
(No debugging symbols found in /usr/sbin/pkg_add)
[New process 1969]
Core was generated by `pkg_add'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000f05b79f80098 in free () from /usr/lib/libc.so.12
(gdb) where
#0  0x0000f05b79f80098 in free () from /usr/lib/libc.so.12
#1  0x0000f05b7a7996bc in fetch_close () from /usr/lib/libfetch.so.3
#2  0x0000f05b7a798e84 in fetch_cache_put () from /usr/lib/libfetch.so.3
#3  0x0000f05b7a794558 in ?? () from /usr/lib/libfetch.so.3
#4  0x0000f05b7a79a010 in fetchIO_close () from /usr/lib/libfetch.so.3
#5  0x000000000315eabc in fetch_archive_close ()
#6  0x0000f05b7a3d9214 in ?? () from /usr/lib/libarchive.so.4
#7  0x0000f05b7a3d9420 in ?? () from /usr/lib/libarchive.so.4
#8  0x0000f05b7a3d94bc in ?? () from /usr/lib/libarchive.so.4
#9  0x0000f05b7a3da1ac in ?? () from /usr/lib/libarchive.so.4
#10 0x0000000003156f40 in pkg_do ()
#11 0x0000000003158178 in check_dependencies ()
#12 0x0000000003157d78 in pkg_do ()
#13 0x00000000031583a4 in pkg_perform ()
#14 0x000000000316227c in main ()

This was from doing a "pkg_add groff" on an aarch64 system (Free Oracle Cloud instance, but also seen it on a local Raspberry Pi 3)

>How-To-Repeat:
Not sure if it's always reproducible, but have seen it on two separate systems, both when doing "pkg_add groff"

Note, that I had changed PKG_PATH to use http (instead of https, see PR #57124):

http://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/aarch64/10.0/All
>Fix:

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->feedback
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Mon, 11 Dec 2023 01:34:44 +0000
State-Changed-Why:
Can you install the debug.tgz (or .tar.xz) set and see if you can get
more information from the stack trace, such as the local variables with
`frame 0', `frame 1', `frame 2', ..., and `info locals'?

Guessing this is a double-free, so all we'll need is the line number of
the free return address, but just in case the extra info won't hurt.


From: Christof Meerwald <cmeerw@cmeerw.org>
To: gnats-bugs@netbsd.org
Cc: gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, riastradh@netbsd.org
Subject: Re: bin/57179 (occasional pkg_add core dumps)
Date: Mon, 11 Dec 2023 20:31:30 +0100

 Ok, just did some debugging on this now.

 To reproduce the issue it seems to be important that PKG_PATH is
 actually set to

   http://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/aarch64/10.0/All

 A consequence of this is that this URL actually redirects to

   http://cdn.netbsd.org/pub/pkgsrc/packages/NetBSD/aarch64/10.0/All/

 So we'll actually see two different hosts in the connection cache:
 cdn.NetBSD.org and cdn.netbsd.org

 Source code I am referring to is
 http://cvsweb.netbsd.org/bsdweb.cgi/src/external/bsd/fetch/dist/libfetch/common.c?annotate=1.4&only_with_tag=MAIN

 First bug I noticed is in "fetch_cache_get" where last_conn is
 initialized to NULL, but never updated. This is probably just a
 resource/memory leak as we'll always get into the "else" branch in
 line 382 (and throw away the initial part of the connection_cache).

 But the main issue (the one that is then resulting in the core dumps)
 is in fetch_cache_put. There is actually two parts to it.

 First part (the one that leads to the memory corruption) is that after
 closing a connection in line 421, on the next iteration, "last" will
 be set to that closed connection. So if we then also close the next
 connection on that next iteration, the "next_cached" link in the list
 isn't updated correctly (as we are updating the "next_cached" of the
 closed connection). This then leads to the core dump on the next call
 to "fetch_cache_put".

 Now the remaining issue is, why are we even closing two connections
 from the connection_cache in one single call to fetch_cache_put? The
 issue here is that once we reach the host_count limit, we don't reset
 the "host_count" and ultimately close all remaining connections in
 connection_cache (even if those connections are for different hosts
 that haven't reached the host_count limit). In my case
 connection_cache contained 4 connections for "cdn.NetBSD.org",
 followed by a connection for "cdn.netbsd.org". When trying to put
 another "cdn.NetBSD.org" connection into the cache, it realised that
 the fourth connection in the cache is over the host limit, closed it,
 and continued to the last "cdn.netbsd.org" connection. But as
 host_count wasn't decremented, it then proceeded to also close that
 "cdn.netbsd.org" connection (resulting in the linked-list corruption).

 Hope that helps.

From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/57179 CVS commit: src/external/bsd/fetch/dist/libfetch
Date: Thu, 28 Dec 2023 19:55:46 -0500

 Module Name:	src
 Committed By:	christos
 Date:		Fri Dec 29 00:55:46 UTC 2023

 Modified Files:
 	src/external/bsd/fetch/dist/libfetch: common.c

 Log Message:
 PR/57179: Christof Meerwald: Fix bugs in fetch_cache_{get,put}.


 To generate a diff of this commit:
 cvs rdiff -u -r1.4 -r1.5 src/external/bsd/fetch/dist/libfetch/common.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Christof Meerwald <cmeerw@cmeerw.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: bin/57179 (occasional pkg_add core dumps)
Date: Thu, 1 Feb 2024 19:59:08 +0100

 Finally managed to test on NetBSD HEAD and I am still seeing core
 dumps.

 I believe the loop in fetch_cache_put should look somewhat like this:

 	for (iter = connection_cache; iter; ) {
 		++global_count;
 		if (strcmp(conn->cache_url->host, iter->cache_url->host) == 0)
 			++host_count;
 		if (global_count < cache_global_limit &&
 		    host_count < cache_per_host_limit) {
 			oiter = NULL;
 			last = iter;
 		} else {
 			--global_count;
 			if (host_count >= cache_per_host_limit)
 				--host_count;
 			if (last != NULL)
 				last->next_cached = iter->next_cached;
 			else
 				connection_cache = iter->next_cached;
 			oiter = iter;
 		}
 		iter = iter->next_cached;
 		if (oiter)
 			(*oiter->cache_close)(oiter);
 	}

 I have moved "last = iter;" into the "then" branch (so "last" won't
 end up pointing to an entry that has been closed), and I have added a
 conditional "--host_count" into the "else" branch, so we don't end up
 closing all remaining cache entries (with mismatched host names).

 This is completely untested as I don't have the system set up to
 re-compile the library.


 Christof

 -- 

 https://cmeerw.org                             sip:cmeerw at cmeerw.org
 mailto:cmeerw at cmeerw.org                   xmpp:cmeerw at cmeerw.org

From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/57179 CVS commit: src/external/bsd/fetch/dist/libfetch
Date: Fri, 2 Feb 2024 17:19:05 -0500

 Module Name:	src
 Committed By:	christos
 Date:		Fri Feb  2 22:19:05 UTC 2024

 Modified Files:
 	src/external/bsd/fetch/dist/libfetch: common.c common.h fetch.3 ftp.c
 	    http.c

 Log Message:
 Sync with pkgsrc and try to fix more memory corruption from PR/57179.


 To generate a diff of this commit:
 cvs rdiff -u -r1.6 -r1.7 src/external/bsd/fetch/dist/libfetch/common.c
 cvs rdiff -u -r1.2 -r1.3 src/external/bsd/fetch/dist/libfetch/common.h
 cvs rdiff -u -r1.4 -r1.5 src/external/bsd/fetch/dist/libfetch/fetch.3 \
     src/external/bsd/fetch/dist/libfetch/http.c
 cvs rdiff -u -r1.7 -r1.8 src/external/bsd/fetch/dist/libfetch/ftp.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Christof Meerwald <cmeerw@cmeerw.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: bin/57179 (occasional pkg_add core dumps)
Date: Sat, 3 Feb 2024 11:31:44 +0100

 Seems to be fixed now, I am no longer seeing any core dumps.

 Thank you very much.

State-Changed-From-To: feedback->closed
State-Changed-By: wiz@NetBSD.org
State-Changed-When: Sat, 03 Feb 2024 15:42:18 +0000
State-Changed-Why:
Confirmed fixed, thanks!


State-Changed-From-To: closed->needs-pullups
State-Changed-By: rin@NetBSD.org
State-Changed-When: Wed, 25 Sep 2024 15:15:48 +0000
State-Changed-Why:
Originally reported for 10.0_BETA, and worth pulling up into -10 at least.


Responsible-Changed-From-To: bin-bug-people->wiz
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Fri, 11 Oct 2024 18:21:08 +0000
Responsible-Changed-Why:
wiz, can I trouble you to take care of pullups for this?


From: Thomas Klausner <wiz@NetBSD.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: bin/57179 (occasional pkg_add core dumps)
Date: Fri, 11 Oct 2024 20:21:57 +0200

 On Fri, Oct 11, 2024 at 06:21:09PM +0000, Taylor R Campbell wrote:
 > Synopsis: occasional pkg_add core dumps
 > 
 > Responsible-Changed-From-To: bin-bug-people->wiz
 > Responsible-Changed-By: riastradh@NetBSD.org
 > Responsible-Changed-When: Fri, 11 Oct 2024 18:21:08 +0000
 > Responsible-Changed-Why:
 > wiz, can I trouble you to take care of pullups for this?

 Yes, but we wanted to let this settle down a bit more first. Not for 10.1.
  Thomas

From: Taylor R Campbell <riastradh@NetBSD.org>
To: wiz@NetBSD.org
Cc: gnats-bugs@NetBSD.org, netbsd-bugs@NetBSD.org
Subject: Re: bin/57179: occasional pkg_add core dumps
Date: Sat, 12 Oct 2024 22:40:45 +0000

 > Date: Fri, 11 Oct 2024 20:21:57 +0200
 > From: Thomas Klausner <wiz@NetBSD.org>
 > 
 > On Fri, Oct 11, 2024 at 06:21:09PM +0000, Taylor R Campbell wrote:
 > > wiz, can I trouble you to take care of pullups for this?
 > 
 > Yes, but we wanted to let this settle down a bit more first. Not for 10.1.

 These changes all happened more than six months ago, didn't they?
 Surely they should be pretty well settled by now?


  Committed By:	christos
  Date:		Fri Dec 29 00:55:46 UTC 2023

  Modified Files:
  	src/external/bsd/fetch/dist/libfetch: common.c

  Log Message:
  PR/57179: Christof Meerwald: Fix bugs in fetch_cache_{get,put}.


  Committed By:	christos
  Date:		Fri Feb  2 22:19:05 UTC 2024

  Modified Files:
  	src/external/bsd/fetch/dist/libfetch: common.c common.h fetch.3 ftp.c
  	    http.c

  Log Message:
  Sync with pkgsrc and try to fix more memory corruption from PR/57179.

State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: wiz@NetBSD.org
State-Changed-When: Mon, 14 Oct 2024 20:47:47 +0000
State-Changed-Why:
[pullup-10 #980] libfetch update


From: Thomas Klausner <wiz@NetBSD.org>
To: Taylor R Campbell <riastradh@NetBSD.org>
Cc: gnats-bugs@NetBSD.org
Subject: Re: bin/57179: occasional pkg_add core dumps
Date: Mon, 14 Oct 2024 22:46:52 +0200

 On Sat, Oct 12, 2024 at 10:40:45PM +0000, Taylor R Campbell wrote:
 > > Date: Fri, 11 Oct 2024 20:21:57 +0200
 > > From: Thomas Klausner <wiz@NetBSD.org>
 > > 
 > > On Fri, Oct 11, 2024 at 06:21:09PM +0000, Taylor R Campbell wrote:
 > > > wiz, can I trouble you to take care of pullups for this?
 > > 
 > > Yes, but we wanted to let this settle down a bit more first. Not for 10.1.
 > 
 > These changes all happened more than six months ago, didn't they?
 > Surely they should be pretty well settled by now?

 Sorry, I had this confused with something else.

 Now requested in :
 [pullup-10 #980] libfetch update

  Thomas

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/57179 CVS commit: [netbsd-10] src/external/bsd/fetch/dist/libfetch
Date: Tue, 15 Oct 2024 06:29:10 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Tue Oct 15 06:29:09 UTC 2024

 Modified Files:
 	src/external/bsd/fetch/dist/libfetch [netbsd-10]: common.c common.h
 	    fetch.3 ftp.c http.c

 Log Message:
 Pull up the following revisions, requested by wiz in ticket #980:

 	external/bsd/fetch/dist/libfetch/common.c       up to 1.7
 	external/bsd/fetch/dist/libfetch/common.h       up to 1.3
 	external/bsd/fetch/dist/libfetch/fetch.3        up to 1.5
 	external/bsd/fetch/dist/libfetch/ftp.c          up to 1.8
 	external/bsd/fetch/dist/libfetch/http.c         up to 1.6

 libfetch: fix pkg_install core dumps reported in PR 57179


 To generate a diff of this commit:
 cvs rdiff -u -r1.2.54.2 -r1.2.54.3 \
     src/external/bsd/fetch/dist/libfetch/common.c
 cvs rdiff -u -r1.2 -r1.2.36.1 src/external/bsd/fetch/dist/libfetch/common.h
 cvs rdiff -u -r1.4 -r1.4.26.1 src/external/bsd/fetch/dist/libfetch/fetch.3
 cvs rdiff -u -r1.7 -r1.7.36.1 src/external/bsd/fetch/dist/libfetch/ftp.c
 cvs rdiff -u -r1.4 -r1.4.6.1 src/external/bsd/fetch/dist/libfetch/http.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: pending-pullups->closed
State-Changed-By: wiz@NetBSD.org
State-Changed-When: Tue, 15 Oct 2024 07:20:30 +0000
State-Changed-Why:
Pulled up, thanks.


State-Changed-From-To: closed->open
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 08 Apr 2026 17:05:44 +0000
State-Changed-Why:
It looks like the fix for this never got applied to pkgsrc libfetch?

From a pkg_install I built in January (based on probably ~Decemberish
sources), I got a similar crash, and when I look at the changes to
pkgsrc/net/libfetch/files/common.c, I don't see any of the changes
christos@ put in to fix this PR -- nothing changed in common.c between
2016 and now except my early-2024 change to neable HTTPS certificate
validation by default.

[1]   Segmentation fault (core dumped) ${TOOL_PKG_ADD:-pkg_add} -v -f -I -P "${mnt}" ...
$ gdb .../pkg_add pkg_add.core
...
Core was generated by `pkg_add'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000070951676b52b in strcmp () from /usr/lib/libc.so.12
(gdb) bt
#0  0x000070951676b52b in strcmp () from /usr/lib/libc.so.12
#1  0x0000000168a30bd1 in fetch_cache_put (conn=0x7095181a9460,
    closecb=0x168a31451 <fetch_close>) at common.c:417
#2  0x0000000168a331ff in http_closefn (v=0x709516ec8df0) at http.c:337
#3  0x0000000168a31ddf in fetchIO_close (f=0x7095172b1e80) at common.c:1051
#4  0x0000000168a0ce02 in fetch_archive_close (a=<optimized out>,
    client_data=0x709517356040) at pkg_io.c:138
#5  0x0000709517477a2f in client_close_proxy (self=0x709517248e40)
    at /usr/src/9/external/bsd/libarchive/dist/libarchive/archive_read.c:257
#6  0x0000709517477a77 in close_filters (a=<optimized out>)
    at /usr/src/9/external/bsd/libarchive/dist/libarchive/archive_read.c:1009
#7  0x0000709517477af1 in _archive_read_close (_a=0x709518181800)
    at /usr/src/9/external/bsd/libarchive/dist/libarchive/archive_read.c:1069
#8  0x0000709517478775 in _archive_read_free (_a=0x709518181800)
    at /usr/src/9/external/bsd/libarchive/dist/libarchive/archive_read.c:1094
#9  0x0000000168a08a74 in pkg_do (
    pkgpath=pkgpath@entry=0x709517265d80 "perl>=5.42.0<5.43.0",
    mark_automatic=mark_automatic@entry=1, top_level=top_level@entry=0)
    at perform.c:1697
#10 0x0000000168a4450a in install_depend_pkg (
    dep=0x709517265d80 "perl>=5.42.0<5.43.0") at perform.c:1206
#11 check_dependencies (pkg=pkg@entry=0x7095182486c0) at perform.c:1246
#12 0x0000000168a098cb in pkg_do (
    1.647nb1", mark_automatic=mark_automatic@entry=1, top_level=top_level@entry=0) at perform.c:1626
#13 0x0000000168a4450a in install_depend_pkg (dep=0x7095177fd840 "p5-DBI>=1.647nb1") at perform.c:1206
#14 check_dependencies (pkg=pkg@entry=0x709518248440) at perform.c:1246
#15 0x0000000168a098cb in pkg_do (pkgpath=pkgpath@entry=0x7095177b5e20 "p5-DBD-SQLite>=0", mark_automatic=mark_automatic@entry=1, top_level=top_level@entry=0) at perform.c:1626
#16 0x0000000168a4450a in install_depend_pkg (dep=0x7095177b5e20 "p5-DBD-SQLite>=0") at perform.c:1206
#17 check_dependencies (pkg=pkg@entry=0x709518247b80) at perform.c:1246
#18 0x0000000168a098cb in pkg_do (pkgpath=pkgpath@entry=0x70951810c4c0 "git-perlscripts>=2.47.1", mark_automatic=mark_automatic@entry=1, top_level=top_level@entry=0) at perform.c:1626
#19 0x0000000168a4450a in install_depend_pkg (dep=0x70951810c4c0 "git-perlscripts>=2.47.1") at perform.c:1206
#20 check_dependencies (pkg=pkg@entry=0x709518246000) at perform.c:1246
#21 0x0000000168a098cb in pkg_do (pkgpath=<optimized out>, mark_automatic=0, top_level=top_level@entry=1) at perform.c:1626
#22 0x0000000168a09cda in pkg_perform (pkgs=0x7f7fff1749e0) at perform.c:1713
#23 0x0000000168a4497a in main (argc=<optimized out>, argv=<optimized out>) at main.c:204


Responsible-Changed-From-To: wiz->bin-bug-people
Responsible-Changed-By: wiz@NetBSD.org
Responsible-Changed-When: Wed, 08 Apr 2026 20:33:59 +0000
Responsible-Changed-Why:
back to role account
(last updater of libfetch package was riastradh btw ;-) )


Responsible-Changed-From-To: bin-bug-people->pkg-manager
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Wed, 08 Apr 2026 20:54:08 +0000
Responsible-Changed-Why:
pkgsrc pkg_add is the one that's busted, not base pkg_add, so use the
pkgsrc role account


From: Thomas Klausner <wiz@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: Taylor R Campbell <riastradh@netbsd.org>
Subject: Re: bin/57179 (occasional pkg_add core dumps)
Date: Sat, 11 Apr 2026 16:20:21 +0200

 --5a4ne2b4mjjpywwl
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline

 This is a mess.

 The pkgsrc version and the base version have diverged in lots of small
 details.

 I've tried merging the changes both ways. It compiles for me with no
 warnings on 11.99.5/x86_64.

 Please review carefully.

 Thanks,
  Thomas

 --5a4ne2b4mjjpywwl
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: attachment; filename="src.fetch.diff"

 Index: common.c
 ===================================================================
 RCS file: /cvsroot/src/external/bsd/fetch/dist/libfetch/common.c,v
 retrieving revision 1.8
 diff -u -r1.8 common.c
 --- common.c	11 Apr 2026 10:42:32 -0000	1.8
 +++ common.c	11 Apr 2026 14:19:07 -0000
 @@ -41,14 +41,11 @@
  #include <sys/socket.h>
  #include <sys/time.h>
  #include <sys/uio.h>
 -#if defined(HAVE_POLL_H) || defined(NETBSD)
 +#if HAVE_POLL_H
  #include <poll.h>
 -#define HAVE_POLL
  #elif HAVE_SYS_POLL_H
 -#define HAVE_POLL
  #include <sys/poll.h>
  #endif
 -
  #include <netinet/in.h>
  #include <arpa/inet.h>

 @@ -243,9 +240,7 @@
  	conn->next_buf = NULL;
  	conn->next_len = 0;
  	conn->sd = sd;
 -#ifdef HAVE_POLL
  	conn->buf_events = POLLIN;
 -#endif
  	return (conn);
  }

 @@ -479,8 +474,7 @@
  	conn->buf_events = 0;
  	SSL_set_fd(conn->ssl, conn->sd);
  #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
 -	if (!SSL_set_tlsext_host_name(conn->ssl, (char *)(uintptr_t)URL->host))
 -	{
 +	if (!SSL_set_tlsext_host_name(conn->ssl, (char *)(uintptr_t)URL->host)) {
  		fprintf(stderr,
  		    "TLS server name indication extension failed for host %s\n",
  		    URL->host);
 @@ -518,17 +512,16 @@
  #endif
  }

 -#ifdef HAVE_POLL
  static int
  compute_timeout(const struct timeval *tv)
  {
  	struct timeval cur;
 +	int timeout;

  	gettimeofday(&cur, NULL);
 -	return (tv->tv_sec - cur.tv_sec) * 1000
 -	    + (tv->tv_usec - cur.tv_usec) / 1000;
 +	timeout = (tv->tv_sec - cur.tv_sec) * 1000 + (tv->tv_usec - cur.tv_usec) / 1000;
 +	return timeout;
  }
 -#endif

  /*
   * Read a character from a connection w/ timeout
 @@ -537,11 +530,7 @@
  fetch_read(conn_t *conn, char *buf, size_t len)
  {
  	struct timeval timeout_end;
 -#ifdef HAVE_POLL
  	struct pollfd pfd;
 -#else
 -	fd_set readfds;
 -#endif
  	int timeout_cur;
  	ssize_t rlen;
  	int r;
 @@ -559,16 +548,12 @@
  	}

  	if (fetchTimeout) {
 -#ifndef HAVE_POLL
 -		FD_ZERO(&readfds);
 -#endif
  		gettimeofday(&timeout_end, NULL);
  		timeout_end.tv_sec += fetchTimeout;
  	}

 +	pfd.fd = conn->sd;
  	for (;;) {
 -#ifdef HAVE_POLL
 -		pfd.fd = conn->sd;
  		pfd.events = conn->buf_events;
  		if (fetchTimeout && pfd.events) {
  			do {
 @@ -587,31 +572,6 @@
  					return (-1);
  				}
  			} while (pfd.revents == 0);
 -#else
 -		while (fetchTimeout && !FD_ISSET(conn->sd, &readfds)) {
 -			struct timeval waittv, now;
 -			FD_SET(conn->sd, &readfds);
 -			gettimeofday(&now, NULL);
 -			waittv.tv_sec = timeout_end.tv_sec - now.tv_sec;
 -			waittv.tv_usec = timeout_end.tv_usec - now.tv_usec;
 -			if (waittv.tv_usec < 0) {
 -				waittv.tv_usec += 1000000;
 -				waittv.tv_sec--;
 -			}
 -			if (waittv.tv_sec < 0) {
 -				errno = ETIMEDOUT;
 -				fetch_syserr();
 -				return (-1);
 -			}
 -			errno = 0;
 -			r = select(conn->sd + 1, &readfds, NULL, NULL, &waittv);
 -			if (r == -1) {
 -				if (errno == EINTR && fetchRestartCalls)
 -					continue;
 -				fetch_syserr();
 -				return (-1);
 -			}
 -#endif
  		}
  #ifdef WITH_SSL
  		if (conn->ssl != NULL) {
 Index: common.h
 ===================================================================
 RCS file: /cvsroot/src/external/bsd/fetch/dist/libfetch/common.h,v
 retrieving revision 1.4
 diff -u -r1.4 common.h
 --- common.h	11 Apr 2026 10:42:32 -0000	1.4
 +++ common.h	11 Apr 2026 14:19:07 -0000
 @@ -54,7 +54,8 @@

  #if !defined(__sun) && !defined(__hpux) && !defined(__INTERIX) && \
      !defined(__digital__) && !defined(__linux) && !defined(__MINT__) && \
 -    !defined(__sgi) && !defined(__minix) && !defined(__CYGWIN__)
 +    !defined(__sgi) && !defined(__minix) && !defined(__CYGWIN__) && \
 +    !defined(_M_XENIX)
  #define HAVE_SA_LEN
  #endif

 Index: ftp.c
 ===================================================================
 RCS file: /cvsroot/src/external/bsd/fetch/dist/libfetch/ftp.c,v
 retrieving revision 1.9
 diff -u -r1.9 ftp.c
 --- ftp.c	11 Apr 2026 10:42:32 -0000	1.9
 +++ ftp.c	11 Apr 2026 14:19:07 -0000
 @@ -98,6 +98,7 @@
  #include "common.h"
  #include "ftperr.h"

 +static int ftp_cmd(conn_t *, const char *, ...) LIBFETCH_PRINTFLIKE(2, 3);
  #define FTP_ANONYMOUS_USER	"anonymous"

  #define FTP_CONNECTION_ALREADY_OPEN	125
 @@ -691,14 +692,13 @@
  	const char *filename;
  	size_t filenamelen;
  	int type;
 -	int low, pasv, verbose;
 +	int pasv, verbose;
  	int e, sd = -1;
  	socklen_t l;
  	char *s;
  	fetchIO *df;

  	/* check flags */
 -	low = CHECK_FLAG('l');
  	pasv = !CHECK_FLAG('a');
  	verbose = CHECK_FLAG('v');

 @@ -864,6 +864,7 @@
  		uint16_t p;
  #if defined(IPV6_PORTRANGE) || defined(IP_PORTRANGE)
  		int arg;
 +		int low = CHECK_FLAG('l');
  #endif
  		int d;
  		char hname[INET6_ADDRSTRLEN];
 @@ -919,18 +920,21 @@
  					goto ouch;
  			}
  			if (e != FTP_OK) {
 -				uint8_t aa[sizeof(u.sin6.sin6_addr)];
 -				memcpy(aa, &u.sin6.sin6_addr, sizeof(aa));
 -				p = ntohs(u.sin6.sin6_port);
 +				unsigned char *ap = (void *)&u.sin6.sin6_addr.s6_addr;
 +				uint16_t port = ntohs(u.sin6.sin6_port);
  				e = ftp_cmd(conn,
 -				    "LPRT %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d\r\n",
 +				    "LPRT %d,%d,%u,%u,%u,%u,%u,%u,%u,%u,"
 +				    "%u,%u,%u,%u,%u,%u,%u,%u,%d,%d,%d\r\n",
  				    6, 16,
 -				    aa[ 0], aa[ 1], aa[ 2], aa[ 3],
 -				    aa[ 4], aa[ 5], aa[ 6], aa[ 7],
 -				    aa[ 8], aa[ 9], aa[10], aa[11],
 -				    aa[12], aa[13], aa[14], aa[15],
 -				    2,
 -				    ((unsigned int)p >> 8) & 0xff, p & 0xff);
 +				    (unsigned)ap[0], (unsigned)ap[1],
 +				    (unsigned)ap[2], (unsigned)ap[3],
 +				    (unsigned)ap[4], (unsigned)ap[5],
 +				    (unsigned)ap[6], (unsigned)ap[7],
 +				    (unsigned)ap[8], (unsigned)ap[9],
 +				    (unsigned)ap[10], (unsigned)ap[11],
 +				    (unsigned)ap[12], (unsigned)ap[13],
 +				    (unsigned)ap[14], (unsigned)ap[15],
 +				    2, port >> 8, port & 0xff);
  			}
  			break;
  		default:
 @@ -1110,22 +1114,18 @@
  ftp_get_proxy(struct url * url, const char *flags)
  {
  	struct url *purl;
 -	char *p, *fp, *FP, *hp, *HP;
 +	char *p;

  	if (flags != NULL && strchr(flags, 'd') != NULL)
 -		return NULL;
 +		return (NULL);
  	if (fetch_no_proxy_match(url->host))
 -		return NULL;
 -
 -	FP = getenv("FTP_PROXY");
 -	fp = getenv("ftp_proxy");
 -	HP = getenv("HTTP_PROXY");
 -	hp = getenv("http_proxy");
 +		return (NULL);

 -	if ((((p = FP) || (p = fp) || (p = HP) || (p = hp))) &&
 +	if (((p = getenv("FTP_PROXY")) || (p = getenv("ftp_proxy")) ||
 +		(p = getenv("HTTP_PROXY")) || (p = getenv("http_proxy"))) &&
  	    *p && (purl = fetchParseURL(p)) != NULL) {
  		if (!*purl->scheme) {
 -			if (fp || FP)
 +			if (getenv("FTP_PROXY") || getenv("ftp_proxy"))
  				strcpy(purl->scheme, SCHEME_FTP);
  			else
  				strcpy(purl->scheme, SCHEME_HTTP);
 @@ -1134,10 +1134,10 @@
  			purl->port = fetch_default_proxy_port(purl->scheme);
  		if (strcasecmp(purl->scheme, SCHEME_FTP) == 0 ||
  		    strcasecmp(purl->scheme, SCHEME_HTTP) == 0)
 -			return purl;
 +			return (purl);
  		fetchFreeURL(purl);
  	}
 -	return NULL;
 +	return (NULL);
  }

  /*
 Index: http.c
 ===================================================================
 RCS file: /cvsroot/src/external/bsd/fetch/dist/libfetch/http.c,v
 retrieving revision 1.7
 diff -u -r1.7 http.c
 --- http.c	11 Apr 2026 10:42:32 -0000	1.7
 +++ http.c	11 Apr 2026 14:19:07 -0000
 @@ -72,10 +72,8 @@
  #define _GNU_SOURCE
  #endif

 -#ifndef _REENTRANT
  /* Needed for gmtime_r on Interix */
  #define _REENTRANT
 -#endif

  #if HAVE_CONFIG_H
  #include "config.h"
 @@ -99,6 +97,9 @@
  #include <stdlib.h>
  #include <string.h>
  #include <time.h>
 +#if defined(__APPLE__)
 +#include <xlocale.h>	/* for strptime_l */
 +#endif
  #include <unistd.h>

  #include <netinet/in.h>
 @@ -139,6 +140,7 @@

  #define HTTP_ERROR(xyz) ((xyz) > 400 && (xyz) < 599)

 +static int http_cmd(conn_t *, const char *, ...) LIBFETCH_PRINTFLIKE(2, 3);

  /*****************************************************************************
   * I/O functions for decoding chunked streams
 @@ -494,6 +496,16 @@
  	return (hdr);
  }

 +/* Remove whitespace at the end of the buffer */
 +static void
 +http_conn_trimright(conn_t *conn)
 +{
 +	while (conn->buflen &&
 +	    isspace((unsigned char)conn->buf[conn->buflen - 1]))
 +		conn->buflen--;
 +	conn->buf[conn->buflen] = '\0';
 +}
 +
  /*
   * Get the next header and return the appropriate symbolic code.
   */
 @@ -502,13 +514,20 @@
  {
  	int i;

 -	if (fetch_getln(conn) == -1)
 -		return (hdr_syserror);
 -	while (conn->buflen && isspace((unsigned char)conn->buf[conn->buflen - 1]))
 -		conn->buflen--;
 -	conn->buf[conn->buflen] = '\0';
 +	/*
 +	 * Have to do the stripping here because of the first line. So
 +	 * it's done twice for the subsequent lines. No big deal
 +	 */
 +	http_conn_trimright(conn);
 +
  	if (conn->buflen == 0)
  		return (hdr_end);
 +
 +	if (fetch_getln(conn) == -1)
 +		return (hdr_syserror);
 +
 +	http_conn_trimright(conn);
 +
  	/*
  	 * We could check for malformed headers but we don't really care.
  	 * A valid header starts with a token immediately followed by a
 @@ -538,7 +557,6 @@
  	locale = strdup(setlocale(LC_TIME, NULL));
  	if (locale == NULL)
  		return (-1);
 -
  	setlocale(LC_TIME, "C");
  	r = strptime(p, "%a, %d %b %Y %H:%M:%S GMT", &tm);
  	/* XXX should add support for date-2 and date-3 */
 @@ -621,13 +639,12 @@
  	    "0123456789+/";
  	char *str, *dst;
  	size_t l;
 -	unsigned int t, r;
 +	int t;

  	l = strlen(src);
  	if ((str = malloc(((l + 2) / 3) * 4 + 1)) == NULL)
  		return (NULL);
  	dst = str;
 -	r = 0;

  	while (l >= 3) {
  		t = (src[0] << 16) | (src[1] << 8) | src[2];
 @@ -636,7 +653,7 @@
  		dst[2] = base64[(t >> 6) & 0x3f];
  		dst[3] = base64[(t >> 0) & 0x3f];
  		src += 3; l -= 3;
 -		dst += 4; r += 4;
 +		dst += 4;
  	}

  	switch (l) {
 @@ -647,7 +664,6 @@
  		dst[2] = base64[(t >> 6) & 0x3f];
  		dst[3] = '=';
  		dst += 4;
 -		r += 4;
  		break;
  	case 1:
  		t = src[0] << 16;
 @@ -655,7 +671,6 @@
  		dst[1] = base64[(t >> 12) & 0x3f];
  		dst[2] = dst[3] = '=';
  		dst += 4;
 -		r += 4;
  		break;
  	case 0:
  		break;
 @@ -804,6 +819,7 @@
  #else
  		errno = EPERM;
  #endif
 +		fetch_syserr();
  		goto ouch;
  	}

 @@ -851,7 +867,7 @@
  	gmtime_r(&last_modified, &tm);
  	snprintf(buf, sizeof(buf), "%.3s, %02d %.3s %4ld %02d:%02d:%02d GMT",
  	    weekdays + tm.tm_wday * 3, tm.tm_mday, months + tm.tm_mon * 3,
 -	    (long)tm.tm_year + 1900, tm.tm_hour, tm.tm_min, tm.tm_sec);
 +	    (long)(tm.tm_year + 1900), tm.tm_hour, tm.tm_min, tm.tm_sec);
  	http_cmd(conn, "If-Modified-Since: %s\r\n", buf);
  }


 --5a4ne2b4mjjpywwl
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: attachment; filename="pkgsrc.libfetch.diff"

 Index: files/common.c
 ===================================================================
 RCS file: /cvsroot/pkgsrc/net/libfetch/files/common.c,v
 retrieving revision 1.33
 diff -u -r1.33 common.c
 --- files/common.c	11 Apr 2026 10:41:52 -0000	1.33
 +++ files/common.c	11 Apr 2026 14:16:52 -0000
 @@ -374,7 +374,9 @@
  {
  	conn_t *conn, *last_conn = NULL;

 -	for (conn = connection_cache; conn; conn = conn->next_cached) {
 +	for (conn = connection_cache; conn; last_conn = conn,
 +	    conn = conn->next_cached)
 +	{
  		if (conn->cache_url->port == url->port &&
  		    strcmp(conn->cache_url->scheme, url->scheme) == 0 &&
  		    strcmp(conn->cache_url->host, url->host) == 0 &&
 @@ -401,8 +403,8 @@
  void
  fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *))
  {
 -	conn_t *iter, *last;
 -	int global_count, host_count;
 +	conn_t *iter, *last, *oiter;
 +	int global_count, host_count, added;

  	if (conn->cache_url == NULL || cache_global_limit == 0) {
  		(*closecb)(conn);
 @@ -411,20 +413,28 @@

  	global_count = host_count = 0;
  	last = NULL;
 -	for (iter = connection_cache; iter;
 -	    last = iter, iter = iter->next_cached) {
 +	for (iter = connection_cache; iter; ) {
  		++global_count;
 -		if (strcmp(conn->cache_url->host, iter->cache_url->host) == 0)
 +		added = !strcmp(conn->cache_url->host, iter->cache_url->host);
 +		if (added)
  			++host_count;
  		if (global_count < cache_global_limit &&
 -		    host_count < cache_per_host_limit)
 -			continue;
 -		--global_count;
 -		if (last != NULL)
 -			last->next_cached = iter->next_cached;
 -		else
 -			connection_cache = iter->next_cached;
 -		(*iter->cache_close)(iter);
 +		    host_count < cache_per_host_limit) {
 +			oiter = NULL;
 +			last = iter;
 +		} else {
 +			--global_count;
 +			if (added)
 +				--host_count;
 +			if (last != NULL)
 +				last->next_cached = iter->next_cached;
 +			else
 +				connection_cache = iter->next_cached;
 +			oiter = iter;
 +		}
 +		iter = iter->next_cached;
 +		if (oiter)
 +			(*oiter->cache_close)(oiter);
  	}

  	conn->cache_close = closecb;
 @@ -631,7 +641,7 @@
  			return (-1);
  		if (len == 0)
  			break;
 -		next = memchr(conn->buf + conn->buflen, '\n', len);
 +		next = memchr(conn->buf + conn->buflen, '\n', (size_t)len);
  		conn->buflen += len;
  		if (conn->buflen == conn->bufsize && next == NULL) {
  			tmp = conn->buf;
 @@ -717,7 +727,7 @@
  		errno = 0;
  #ifdef WITH_SSL
  		if (conn->ssl != NULL)
 -			wlen = SSL_write(conn->ssl, buf, len);
 +			wlen = SSL_write(conn->ssl, buf, (int)len);
  		else
  #endif
  #ifndef MSG_NOSIGNAL
 @@ -752,6 +762,22 @@
  {
  	int ret;

 +#ifdef WITH_SSL
 +	if (conn->ssl) {
 +		SSL_shutdown(conn->ssl);
 +		SSL_set_connect_state(conn->ssl);
 +		SSL_free(conn->ssl);
 +		conn->ssl = NULL;
 +	}
 +	if (conn->ssl_ctx) {
 +		SSL_CTX_free(conn->ssl_ctx);
 +		conn->ssl_ctx = NULL;
 +	}
 +	if (conn->ssl_cert) {
 +		X509_free(conn->ssl_cert);
 +		conn->ssl_cert = NULL;
 +	}
 +#endif
  	ret = close(conn->sd);
  	if (conn->cache_url)
  		fetchFreeURL(conn->cache_url);
 Index: files/common.h
 ===================================================================
 RCS file: /cvsroot/pkgsrc/net/libfetch/files/common.h,v
 retrieving revision 1.26
 diff -u -r1.26 common.h
 --- files/common.h	11 Apr 2026 10:41:52 -0000	1.26
 +++ files/common.h	11 Apr 2026 14:16:52 -0000
 @@ -99,7 +99,7 @@

  void		 fetch_seterr(struct fetcherr *, int);
  void		 fetch_syserr(void);
 -void		 fetch_info(const char *, ...)  LIBFETCH_PRINTFLIKE(1, 2);
 +void		 fetch_info(const char *, ...) LIBFETCH_PRINTFLIKE(1, 2);
  int		 fetch_default_port(const char *);
  int		 fetch_default_proxy_port(const char *);
  int		 fetch_bind(int, int, const char *);
 Index: files/ftp.c
 ===================================================================
 RCS file: /cvsroot/pkgsrc/net/libfetch/files/ftp.c,v
 retrieving revision 1.50
 diff -u -r1.50 ftp.c
 --- files/ftp.c	11 Apr 2026 10:41:52 -0000	1.50
 +++ files/ftp.c	11 Apr 2026 14:16:52 -0000
 @@ -145,7 +145,7 @@
  	if (sin6->sin6_family != AF_INET6 ||
  	    !IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
  		return;
 -	sin4 = (struct sockaddr_in *)sin6;
 +	sin4 = (struct sockaddr_in *)(void *)sin6;
  #ifdef s6_addr32
  	addr = sin6->sin6_addr.s6_addr32[3];
  #else
 @@ -208,7 +208,7 @@
  	va_list ap;
  	size_t len;
  	char *msg;
 -	int r;
 +	ssize_t r;

  	va_start(ap, fmt);
  	len = vasprintf(&msg, fmt, ap);
 @@ -235,7 +235,7 @@
   * Return a pointer to the filename part of a path
   */
  static const char *
 -ftp_filename(const char *file, int *len, int *type, int subdir)
 +ftp_filename(const char *file, size_t *len, int *type, int subdir)
  {
  	const char *s;

 @@ -262,6 +262,7 @@
  {
  	char *src, *dst, *end;
  	int q;
 +	size_t len;

  	if (conn->err != FTP_WORKING_DIRECTORY &&
  	    conn->err != FTP_FILE_ACTION_OK)
 @@ -270,7 +271,8 @@
  	src = conn->buf + 4;
  	if (src >= end || *src++ != '"')
  		return (FTP_PROTOCOL_ERROR);
 -	*pwd = malloc(end - src + 1);
 +	len = end - src + 1;
 +	*pwd = malloc(len);
  	if (*pwd == NULL)
  		return (FTP_PROTOCOL_ERROR);
  	for (q = 0, dst = *pwd; src < end; ++src) {
 @@ -301,7 +303,8 @@
  {
  	const char *beg, *end;
  	char *pwd, *dst;
 -	int e, i, len;
 +	int e;
 +	size_t i, len;

  	if (*path != '/') {
  		ftp_seterr(501);
 @@ -349,7 +352,7 @@
  		len = strlen(pwd);

  		/* Look for a common prefix between PWD and dir to fetch. */
 -		for (i = 0; i <= len && i <= end - dst; ++i)
 +		for (i = 0; i <= len && i <= (size_t)(end - dst); ++i)
  			if (pwd[i] != dst[i])
  				break;
  		/* Keep going up a dir until we have a matching prefix. */
 @@ -416,6 +419,7 @@
  	case 0:
  	case 's':
  		mode = 'S';
 +		/*FALLTHROUGH*/
  	case 'S':
  		break;
  	default:
 @@ -444,15 +448,17 @@
  	case 0:
  	case 'i':
  		type = 'I';
 +		/*FALLTHROUGH*/
  	case 'I':
  		break;
  	case 'a':
  		type = 'A';
 +		/*FALLTHROUGH*/
  	case 'A':
  		break;
  	case 'd':
  		type = 'D';
 -		/* FALLTHROUGH */
 +		/*FALLTHROUGH*/
  	case 'D':
  		/* can't handle yet */
  	default:
 @@ -472,7 +478,8 @@
  {
  	char *ln;
  	const char *filename;
 -	int filenamelen, type, year;
 +	size_t filenamelen;
 +	int type;
  	struct tm tm;
  	time_t t;
  	int e;
 @@ -524,13 +531,13 @@
  		return (-1);
  	}
  	if (sscanf(ln, "%04d%02d%02d%02d%02d%02d",
 -	    &year, &tm.tm_mon, &tm.tm_mday,
 +	    &tm.tm_year, &tm.tm_mon, &tm.tm_mday,
  	    &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
  		ftp_seterr(FTP_PROTOCOL_ERROR);
  		return (-1);
  	}
  	tm.tm_mon--;
 -	tm.tm_year = year - 1900;
 +	tm.tm_year -= 1900;
  	tm.tm_isdst = -1;
  	t = timegm(&tm);
  	if (t == (time_t)-1)
 @@ -560,7 +567,7 @@
  ftp_readfn(void *v, void *buf, size_t len)
  {
  	struct ftpio *io;
 -	int r;
 +	ssize_t r;

  	io = (struct ftpio *)v;
  	if (io == NULL) {
 @@ -593,7 +600,7 @@
  ftp_writefn(void *v, const void *buf, size_t len)
  {
  	struct ftpio *io;
 -	int w;
 +	ssize_t w;

  	io = (struct ftpio *)v;
  	if (io == NULL) {
 @@ -642,7 +649,7 @@
  	fetch_close(io->dconn);
  	io->dconn = NULL;
  	io->dir = -1;
 -	ftp_chkerr(io->cconn);
 +	(void)ftp_chkerr(io->cconn);
  	fetch_cache_put(io->cconn, ftp_disconnect);
  	free(io);
  	return;
 @@ -683,7 +690,8 @@
  	} u;
  	const char *bindaddr;
  	const char *filename;
 -	int filenamelen, type;
 +	size_t filenamelen;
 +	int type;
  	int pasv, verbose;
  	int e, sd = -1;
  	socklen_t l;
 @@ -765,7 +773,7 @@
  			}
  			l = (e == FTP_PASSIVE_MODE ? 6 : 21);
  			for (i = 0; *p && i < l; i++, p++)
 -				addr[i] = strtol(p, &p, 10);
 +				addr[i] = (unsigned char)strtol(p, &p, 10);
  			if (i < l) {
  				e = FTP_PROTOCOL_ERROR;
  				goto ouch;
 @@ -859,9 +867,7 @@
  		int low = CHECK_FLAG('l');
  #endif
  		int d;
 -#ifdef INET6
  		char hname[INET6_ADDRSTRLEN];
 -#endif

  		switch (u.ss.ss_family) {
  		case AF_INET6:
 @@ -869,7 +875,7 @@
  #ifdef IPV6_PORTRANGE
  			arg = low ? IPV6_PORTRANGE_DEFAULT : IPV6_PORTRANGE_HIGH;
  			if (setsockopt(sd, IPPROTO_IPV6, IPV6_PORTRANGE,
 -				(char *)&arg, sizeof(arg)) == -1)
 +				&arg, (socklen_t)sizeof(arg)) == -1)
  				goto sysouch;
  #endif
  			break;
 @@ -878,7 +884,7 @@
  #ifdef IP_PORTRANGE
  			arg = low ? IP_PORTRANGE_DEFAULT : IP_PORTRANGE_HIGH;
  			if (setsockopt(sd, IPPROTO_IP, IP_PORTRANGE,
 -				(char *)&arg, sizeof(arg)) == -1)
 +				&arg, (socklen_t)sizeof(arg)) == -1)
  				goto sysouch;
  #endif
  			break;
 @@ -900,14 +906,13 @@
  			e = ftp_cmd(conn, "PORT %d,%d,%d,%d,%d,%d\r\n",
  			    (a >> 24) & 0xff, (a >> 16) & 0xff,
  			    (a >> 8) & 0xff, a & 0xff,
 -			    (p >> 8) & 0xff, p & 0xff);
 +			    ((unsigned int)p >> 8) & 0xff, p & 0xff);
  			break;
 -#ifdef INET6
  		case AF_INET6:
  			e = -1;
  			u.sin6.sin6_scope_id = 0;
  			if (getnameinfo(&u.sa, l,
 -				hname, sizeof(hname),
 +				hname, (socklen_t)sizeof(hname),
  				NULL, 0, NI_NUMERICHOST) == 0) {
  				e = ftp_cmd(conn, "EPRT |%d|%s|%d|\r\n", 2, hname,
  				    htons(u.sin6.sin6_port));
 @@ -932,7 +937,6 @@
  				    2, port >> 8, port & 0xff);
  			}
  			break;
 -#endif
  		default:
  			e = FTP_PROTOCOL_ERROR; /* XXX: error code should be prepared */
  			goto ouch;
 @@ -1116,6 +1120,7 @@
  		return (NULL);
  	if (fetch_no_proxy_match(url->host))
  		return (NULL);
 +
  	if (((p = getenv("FTP_PROXY")) || (p = getenv("ftp_proxy")) ||
  		(p = getenv("HTTP_PROXY")) || (p = getenv("http_proxy"))) &&
  	    *p && (purl = fetchParseURL(p)) != NULL) {
 Index: files/http.c
 ===================================================================
 RCS file: /cvsroot/pkgsrc/net/libfetch/files/http.c,v
 retrieving revision 1.45
 diff -u -r1.45 http.c
 --- files/http.c	11 Apr 2026 10:41:52 -0000	1.45
 +++ files/http.c	11 Apr 2026 14:16:52 -0000
 @@ -154,7 +154,7 @@
  	char		*buf;		/* chunk buffer */
  	size_t		 bufsize;	/* size of chunk buffer */
  	ssize_t		 buflen;	/* amount of data currently in buffer */
 -	int		 bufpos;	/* current read offset in buffer */
 +	size_t		 bufpos;	/* current read offset in buffer */
  	int		 eof;		/* end-of-file flag */
  	int		 error;		/* error flag */
  	size_t		 chunksize;	/* remaining size of current chunk */
 @@ -164,7 +164,7 @@
  /*
   * Get next chunk header
   */
 -static int
 +static ssize_t
  http_new_chunk(struct httpio *io)
  {
  	char *p;
 @@ -213,7 +213,7 @@
  /*
   * Fill the input buffer, do chunk decoding on the fly
   */
 -static int
 +static ssize_t
  http_fillbuf(struct httpio *io, size_t len)
  {
  	if (io->error)
 @@ -294,7 +294,7 @@

  	for (pos = 0; len > 0; pos += l, len -= l) {
  		/* empty buffer */
 -		if (!io->buf || io->bufpos == io->buflen)
 +		if (!io->buf || (ssize_t)io->bufpos == io->buflen)
  			if (http_fillbuf(io, len) < 1)
  				break;
  		l = io->buflen - io->bufpos;
 @@ -333,7 +333,7 @@

  		val = 0;
  		setsockopt(io->conn->sd, IPPROTO_TCP, TCP_NODELAY, &val,
 -			   sizeof(val));
 +			   (socklen_t)sizeof(val));
  			  fetch_cache_put(io->conn, fetch_close);
  #if defined(TCP_NOPUSH) && !defined(__APPLE__)
  		val = 1;
 @@ -419,7 +419,7 @@
  	va_list ap;
  	size_t len;
  	char *msg;
 -	int r;
 +	ssize_t r;

  	va_start(ap, fmt);
  	len = vasprintf(&msg, fmt, ap);
 @@ -765,8 +765,15 @@
  #endif

  	curl = (purl != NULL) ? purl : URL;
 +	if (purl && strcasecmp(URL->scheme, SCHEME_HTTPS) != 0) {
 +		URL = purl;
 +	} else if (strcasecmp(URL->scheme, SCHEME_FTP) == 0) {
 +
 +		/* XXX should set an error code */
 +		return (NULL);
 +	}

 -	if ((conn = fetch_cache_get(URL, af)) != NULL) {
 +	if ((conn = fetch_cache_get(curl, af)) != NULL) {
  		*cached = 1;
  		return (conn);
  	}
 @@ -779,16 +786,18 @@
  				URL->host, URL->port);
  		http_cmd(conn, "Host: %s:%d\r\n",
  				URL->host, URL->port);
 +		/* proxy authorization */
 +		if (*purl->user || *purl->pwd)
 +			http_basic_auth(conn, "Proxy-Authorization",
 +			    purl->user, purl->pwd);
 +		else if ((p = getenv("HTTP_PROXY_AUTH")) != NULL && *p != '\0')
 +			http_authorize(conn, "Proxy-Authorization", p);
  		http_cmd(conn, "\r\n");
  		if (http_get_reply(conn) != HTTP_OK) {
  			http_seterr(conn->err);
  			goto ouch;
  		}
  		/* Read and discard the rest of the proxy response */
 -		if (fetch_getln(conn) < 0) {
 -			fetch_syserr();
 -			goto ouch;
 -		}
  		do {
  			switch ((h = http_next_header(conn, &p))) {
  			case hdr_syserror:
 @@ -1021,7 +1030,7 @@
  #endif
  		val = 1;
  		setsockopt(conn->sd, IPPROTO_TCP, TCP_NODELAY, &val,
 -			   sizeof(val));
 +		    (socklen_t)sizeof(val));

  		/* get reply */
  		switch (http_get_reply(conn)) {

 --5a4ne2b4mjjpywwl--

From: "Thomas Klausner" <wiz@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/57179 CVS commit: pkgsrc/net/libfetch/files
Date: Thu, 16 Apr 2026 08:28:21 +0000

 Module Name:	pkgsrc
 Committed By:	wiz
 Date:		Thu Apr 16 08:28:21 UTC 2026

 Modified Files:
 	pkgsrc/net/libfetch/files: common.c

 Log Message:
 libfetch: reduce diffs to src

 revision 1.5
 date: 2023-12-29 01:55:46 +0100;  author: christos;  state: Exp;  lines: +19 -12;  commitid: OCNaAvNzW7KWqiSE;
 PR/57179: Christof Meerwald: Fix bugs in fetch_cache_{get,put}.

 revision 1.7
 date: 2024-02-02 23:19:05 +0100;  author: christos;  state: Exp;  lines: +95 -17;  commitid: WGGFqVnnZpItpUWE;
 Sync with pkgsrc and try to fix more memory corruption from PR/57179.


 To generate a diff of this commit:
 cvs rdiff -u -r1.34 -r1.35 pkgsrc/net/libfetch/files/common.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Thomas Klausner" <wiz@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/57179 CVS commit: pkgsrc/net/libfetch/files
Date: Thu, 16 Apr 2026 08:32:13 +0000

 Module Name:	pkgsrc
 Committed By:	wiz
 Date:		Thu Apr 16 08:32:12 UTC 2026

 Modified Files:
 	pkgsrc/net/libfetch/files: http.c

 Log Message:
 libfetch: reduce diffs to src/

 revision 1.6
 date: 2024-09-01 17:07:31 +0200;  author: christos;  state: Exp;  lines: +9 -7;  commitid: g7m30PlS4W7Jb7oF;
 PR/58656: RVP: Fix proxy authentication for https and when proxy does not
 add any extra headers.

 revision 1.5
 date: 2024-02-02 23:19:05 +0100;  author: christos;  state: Exp;  lines: +68 -21;  commitid: WGGFqVnnZpItpUWE;
 branches:  1.5.2;
 Sync with pkgsrc and try to fix more memory corruption from PR/57179.


 To generate a diff of this commit:
 cvs rdiff -u -r1.46 -r1.47 pkgsrc/net/libfetch/files/http.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Responsible-Changed-From-To: pkg-manager->riastradh
Responsible-Changed-By: wiz@NetBSD.org
Responsible-Changed-When: Thu, 16 Apr 2026 10:52:12 +0000
Responsible-Changed-Why:
I've synced src and pkgsrc, please give it a try.


>Unformatted:

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.49 2026/05/14 01:52:41 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.