gmid 1.8.3 "Lightbulb Sun" bugfix release ========================================= Released March 27, 2022. signify(1) pubkeys for this release: RWTy3UJQzpxBUAymBwb2EGLLm0b3H/1n8hzhaC9HYFYzNuTavGt9QSwC Bug Fixes ~~~~~~~~~ * fix a possible out-of-bound access in the CGI handling. It was introduced last October during a refactoring, but due to how many malloc(3) implementations works this hasn't been found until now. Otto' malloc is more strict fortunately.

Long time ago, client->req was a static buffer so the memcpy was safe. However, it's been since moved to a dynamically allocated string, so it's very often smaller than sizeof(req.buf) (1024), hence the out of bound access which results in a SIGSEGV very often on OpenBSD thanks to Otto' malloc. The situation with the iri parser, client->req and how the request is forwarded to the other process needs to be improved: this is just a fix to address the issue quickly, a better one would be to restructure the iri parser APIs and rethink how the info is forwarded to the ex process.

gmid 1.8.2 "Lightbulb Sun" bugfix release ========================================= Released March 26, 2022. signify(1) pubkeys for this release: RWTy3UJQzpxBUAymBwb2EGLLm0b3H/1n8hzhaC9HYFYzNuTavGt9QSwC Bug Fixes ~~~~~~~~~ * fix a CGI timing issue: if a connection handled by a CGI scripts is interrupted with the right timing it causes the server process to exit with "fatal in client_by_id: invalid id X". New Features ~~~~~~~~~~~~ * add a new block `type { ... }' to define mime types mapping. Improvements ~~~~~~~~~~~~ * use shell built-in `command' instead of which(1), prodded by cage and Allen Sobot. * configure script: allow to set MANDIR from cmdline (Allen Sobot) * add systemd-sysusers sample file in contrib/ (Nakaya) * [linux/seccomp] allow fstatat64(2), llseek(2) and sigreturn(2), needed by glibc on armv7. (Tobias Berger) * [linux/seccomp] tightens rules by allowing openat(2) only with the O_RDONLY flag.