Re: [ptxdist] [APPLIED] libmicrohttpd: version bump 1.0.5 -> 1.0.10

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as ead4af80126d0ca1c65525712f71f51d1a94f634.

Michael

[sent from post-receive hook]

On Fri, 14 Aug 2026 17:38:42 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Mostly bug fixes for minor issues, and rare cases, from the changelog:
> 
> Fri Aug  7 10:15:01 PM CEST 2026
>     Fix race in thread-per-connection mode on wake-up signal
>     between daemon and thread that could result in lost wake-ups
>     and thus connections that did not finish processing.
>     Fix rare assertion failure in relation to suspend-and-resume
>     processing (harmless if assertions were turned off).
>     Releasing GNU libmicrohttpd 1.0.10. -CG
> 
> Thu Jul 30 05:32:00 PM CEST 2026
>     Enfocing a minimal size on the PSK.
>     Fix support for red zones in memorypool.
>     Fix rare over-writing of HTTP version string with network data
>     after parsing header.
>     Fix rare crash from adding connection manually followed by
>     immediate daemon shutdown.
>     Releasing GNU libmicrohttpd 1.0.9. -CG
> 
> Tue Jul 28 06:12:03 PM CEST 2026
>     Fixing additional vulnerabilities inspired by reviewing the
>     code for similar issues like the ones reported by A. Ramos;
>     expand the test suite to cover these and other issues.
>     Releasing GNU libmicrohttpd 1.0.8. -CG
> 
> Mon Jul 27 06:12:03 PM CEST 2026
>     Fixing various vulnerabilities reported by A. Ramos resulting
>     in possible crashes or out-of-bounds stack writes for certain
>     requests in specific configurations.
>     Releasing GNU libmicrohttpd 1.0.7. -CG
> 
> Wed Jul  8 12:32:30 PM CEST 2026
>     Fix various minor issues, like theoretical
>     integer overflows for extreme inputs or NULL
>     dereferences if the application passes NULL
>     where it should not.
>     Releasing GNU libmicrohttpd 1.0.6. -CG
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260812141319.1058695-1-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/libmicrohttpd.make b/rules/libmicrohttpd.make
> index dfdd247446c8..37af4c259969 100644
> --- a/rules/libmicrohttpd.make
> +++ b/rules/libmicrohttpd.make
> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIBMICROHTTPD) += libmicrohttpd
>  #
>  # Paths and names
>  #
> -LIBMICROHTTPD_VERSION	:= 1.0.5
> -LIBMICROHTTPD_SHA256	:= b46d00f58efa6f497b97d2e782c4ee66301d412ddd855dd3068518b3a2cd3ea2
> +LIBMICROHTTPD_VERSION	:= 1.0.10
> +LIBMICROHTTPD_SHA256	:= 04bfe8ef75db7d629a33de767599765cecadc56274a39822d5d081030d577685
>  LIBMICROHTTPD		:= libmicrohttpd-$(LIBMICROHTTPD_VERSION)
>  LIBMICROHTTPD_SUFFIX	:= tar.gz
>  LIBMICROHTTPD_URL	:= $(call ptx/mirror, GNU, libmicrohttpd/$(LIBMICROHTTPD).$(LIBMICROHTTPD_SUFFIX))
> @@ -74,6 +74,7 @@ LIBMICROHTTPD_CONF_OPT	:= \
>  	--disable-coverage \
>  	--enable-asserts \
>  	--disable-sanitizers \
> +	--disable-fuzzing \
>  	--disable-experimental \
>  	--$(call ptx/endis, PTXDIST_Y2038)-year2038 \
>  	--with-threads=posix