[ptxdist] [PATCH] libmicrohttpd: version bump 1.0.5 -> 1.0.10

[ptxdist] [PATCH] libmicrohttpd: version bump 1.0.5 -> 1.0.10

[Alexander Dahl via ptxdist]

Mostly bug fixes for minor issues, and rare cases, from the changelog:

Fri Aug  7 10:15:01 PM CEST 2026
    Fix race in thread-per-connection mode on wake-up signal
    between daemon and thread that could result in lost wake-ups
    and thus connections that did not finish processing.
    Fix rare assertion failure in relation to suspend-and-resume
    processing (harmless if assertions were turned off).
    Releasing GNU libmicrohttpd 1.0.10. -CG

Thu Jul 30 05:32:00 PM CEST 2026
    Enfocing a minimal size on the PSK.
    Fix support for red zones in memorypool.
    Fix rare over-writing of HTTP version string with network data
    after parsing header.
    Fix rare crash from adding connection manually followed by
    immediate daemon shutdown.
    Releasing GNU libmicrohttpd 1.0.9. -CG

Tue Jul 28 06:12:03 PM CEST 2026
    Fixing additional vulnerabilities inspired by reviewing the
    code for similar issues like the ones reported by A. Ramos;
    expand the test suite to cover these and other issues.
    Releasing GNU libmicrohttpd 1.0.8. -CG

Mon Jul 27 06:12:03 PM CEST 2026
    Fixing various vulnerabilities reported by A. Ramos resulting
    in possible crashes or out-of-bounds stack writes for certain
    requests in specific configurations.
    Releasing GNU libmicrohttpd 1.0.7. -CG

Wed Jul  8 12:32:30 PM CEST 2026
    Fix various minor issues, like theoretical
    integer overflows for extreme inputs or NULL
    dereferences if the application passes NULL
    where it should not.
    Releasing GNU libmicrohttpd 1.0.6. -CG

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libmicrohttpd.make | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/libmicrohttpd.make b/rules/libmicrohttpd.make
index dfdd24744..2b02ba0c9 100644
--- a/rules/libmicrohttpd.make
+++ b/rules/libmicrohttpd.make
@@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIBMICROHTTPD) += libmicrohttpd
 #
 # Paths and names
 #
-LIBMICROHTTPD_VERSION	:= 1.0.5
-LIBMICROHTTPD_SHA256	:= b46d00f58efa6f497b97d2e782c4ee66301d412ddd855dd3068518b3a2cd3ea2
+LIBMICROHTTPD_VERSION	:= 1.0.10
+LIBMICROHTTPD_SHA256	:= 04bfe8ef75db7d629a33de767599765cecadc56274a39822d5d081030d577685
 LIBMICROHTTPD		:= libmicrohttpd-$(LIBMICROHTTPD_VERSION)
 LIBMICROHTTPD_SUFFIX	:= tar.gz
 LIBMICROHTTPD_URL	:= $(call ptx/mirror, GNU, libmicrohttpd/$(LIBMICROHTTPD).$(LIBMICROHTTPD_SUFFIX))

base-commit: cfe40b077f62b2dc38ea40209f825603d645ca1b
-- 
2.47.3

[ptxdist] [PATCH] fixup! libmicrohttpd: version bump 1.0.5 -> 1.0.10

[Alexander Dahl via ptxdist]

Fuzzing came with 1.0.8 …

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
 rules/libmicrohttpd.make | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/libmicrohttpd.make b/rules/libmicrohttpd.make
index 2b02ba0c9..37af4c259 100644
--- a/rules/libmicrohttpd.make
+++ b/rules/libmicrohttpd.make
@@ -74,6 +74,7 @@ LIBMICROHTTPD_CONF_OPT	:= \
 	--disable-coverage \
 	--enable-asserts \
 	--disable-sanitizers \
+	--disable-fuzzing \
 	--disable-experimental \
 	--$(call ptx/endis, PTXDIST_Y2038)-year2038 \
 	--with-threads=posix
-- 
2.47.3

Re: [ptxdist] [APPLIED] libmicrohttpd: version bump 1.0.5 -> 1.0.10

[Michael Olbrich]

Thanks, applied as ead4af80126d0ca1c65525712f71f51d1a94f634.

Michael

[sent from post-receive hook]

On Fri, 14 Aug 2026 17:38:42 +0200, Alexander Dahl <ada@thorsis.com> wrote:
> Mostly bug fixes for minor issues, and rare cases, from the changelog:
> 
> Fri Aug  7 10:15:01 PM CEST 2026
>     Fix race in thread-per-connection mode on wake-up signal
>     between daemon and thread that could result in lost wake-ups
>     and thus connections that did not finish processing.
>     Fix rare assertion failure in relation to suspend-and-resume
>     processing (harmless if assertions were turned off).
>     Releasing GNU libmicrohttpd 1.0.10. -CG
> 
> Thu Jul 30 05:32:00 PM CEST 2026
>     Enfocing a minimal size on the PSK.
>     Fix support for red zones in memorypool.
>     Fix rare over-writing of HTTP version string with network data
>     after parsing header.
>     Fix rare crash from adding connection manually followed by
>     immediate daemon shutdown.
>     Releasing GNU libmicrohttpd 1.0.9. -CG
> 
> Tue Jul 28 06:12:03 PM CEST 2026
>     Fixing additional vulnerabilities inspired by reviewing the
>     code for similar issues like the ones reported by A. Ramos;
>     expand the test suite to cover these and other issues.
>     Releasing GNU libmicrohttpd 1.0.8. -CG
> 
> Mon Jul 27 06:12:03 PM CEST 2026
>     Fixing various vulnerabilities reported by A. Ramos resulting
>     in possible crashes or out-of-bounds stack writes for certain
>     requests in specific configurations.
>     Releasing GNU libmicrohttpd 1.0.7. -CG
> 
> Wed Jul  8 12:32:30 PM CEST 2026
>     Fix various minor issues, like theoretical
>     integer overflows for extreme inputs or NULL
>     dereferences if the application passes NULL
>     where it should not.
>     Releasing GNU libmicrohttpd 1.0.6. -CG
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20260812141319.1058695-1-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/rules/libmicrohttpd.make b/rules/libmicrohttpd.make
> index dfdd247446c8..37af4c259969 100644
> --- a/rules/libmicrohttpd.make
> +++ b/rules/libmicrohttpd.make
> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIBMICROHTTPD) += libmicrohttpd
>  #
>  # Paths and names
>  #
> -LIBMICROHTTPD_VERSION	:= 1.0.5
> -LIBMICROHTTPD_SHA256	:= b46d00f58efa6f497b97d2e782c4ee66301d412ddd855dd3068518b3a2cd3ea2
> +LIBMICROHTTPD_VERSION	:= 1.0.10
> +LIBMICROHTTPD_SHA256	:= 04bfe8ef75db7d629a33de767599765cecadc56274a39822d5d081030d577685
>  LIBMICROHTTPD		:= libmicrohttpd-$(LIBMICROHTTPD_VERSION)
>  LIBMICROHTTPD_SUFFIX	:= tar.gz
>  LIBMICROHTTPD_URL	:= $(call ptx/mirror, GNU, libmicrohttpd/$(LIBMICROHTTPD).$(LIBMICROHTTPD_SUFFIX))
> @@ -74,6 +74,7 @@ LIBMICROHTTPD_CONF_OPT	:= \
>  	--disable-coverage \
>  	--enable-asserts \
>  	--disable-sanitizers \
> +	--disable-fuzzing \
>  	--disable-experimental \
>  	--$(call ptx/endis, PTXDIST_Y2038)-year2038 \
>  	--with-threads=posix