[AutoPR- Security] Patch ntp for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381 [HIGH]

SPECS/ntp/CVE-2026-63381.patch

@@ -0,0 +1,40 @@
+From 034687b2b79e1bb2d7bc77fd42dce15b6dd8cbd1 Mon Sep 17 00:00:00 2001
+From: Alexis <alexis.challande@trailofbits.com>
+Date: Tue, 9 Jun 2026 15:09:05 +0200
+Subject: [PATCH] Fix a dangling pointer in evbuffer_add_buffer_reference.
+
+If `evbuffer_add_buffer_reference` was called to add a reference to
+an empty buffer, the resulting code would produce dangling pointers
+that could later lead to a use-after-free.
+
+Fixes GHSA-c2pj-cg4r-88c8.
+
+Tracking: X8.
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9.patch
+---
+ sntp/libevent/buffer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sntp/libevent/buffer.c b/sntp/libevent/buffer.c
+index 3524b35..f68f31c 100644
+--- a/sntp/libevent/buffer.c
++++ b/sntp/libevent/buffer.c
+@@ -1038,8 +1038,13 @@ evbuffer_add_buffer_reference(struct evbuffer *outbuf, struct evbuffer *inbuf)
+
+ 	if (out_total_len == 0) {
+ 		/* There might be an empty chain at the start of outbuf; free
+-		 * it. */
++		 * it.  Reset the chain pointers afterwards so the subsequent
++		 * APPEND_CHAIN_MULTICAST does not dereference the freed chain
++		 * through outbuf->first / last_with_datap. */
+ 		evbuffer_free_all_chains(outbuf->first);
++		outbuf->first = NULL;
++		outbuf->last = NULL;
++		outbuf->last_with_datap = &outbuf->first;
+ 	}
+ 	APPEND_CHAIN_MULTICAST(outbuf, inbuf);
+
+-- 
+2.45.4
+

SPECS/ntp/CVE-2026-63382.patch

@@ -0,0 +1,35 @@
+From 6e74a489c83d65b9a2526970717006e97acc1b96 Mon Sep 17 00:00:00 2001
+From: Nick Mathewson <nickm@torproject.org>
+Date: Fri, 26 Jun 2026 08:32:25 -0400
+Subject: [PATCH] http: Treat CRLF strictly in HTTP chunks.
+
+According to RFC 9112, we can't treat LF alone as a terminator in
+the chunked encoding.
+
+Reported by @xclow3n
+
+Part of GHSA-q39v-w2g7-gr8j
+
+Tracking: X11
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e.patch
+---
+ sntp/libevent/http.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c
+index 04f089b..a993bfd 100644
+--- a/sntp/libevent/http.c
++++ b/sntp/libevent/http.c
+@@ -925,7 +925,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf)
+ 		if (req->ntoread < 0) {
+ 			/* Read chunk size */
+ 			ev_int64_t ntoread;
+-			char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF);
++			char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT);
+ 			char *endp;
+ 			int error;
+ 			if (p == NULL)
+-- 
+2.45.4
+

SPECS/ntp/CVE-2026-63383.patch

@@ -0,0 +1,42 @@
+From 8ca99a0d3ddd7ba214c16f28be697901d560c9c5 Mon Sep 17 00:00:00 2001
+From: Nick Mathewson <nickm@torproject.org>
+Date: Wed, 24 Jun 2026 09:53:23 -0400
+Subject: [PATCH] evrpc: Fix out-of-bounds read in decode_tag_internal
+
+This bug could allow an attacker to cause an evrpc client or server
+to read out of bounds when decoding a tag.
+
+Fixes GHSA-fj29-64w6-73h6.
+
+Reported by @Brubbish.
+
+Tracking: X5.
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb.patch
+---
+ sntp/libevent/event_tagging.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sntp/libevent/event_tagging.c b/sntp/libevent/event_tagging.c
+index b021e8c..c8f7b74 100644
+--- a/sntp/libevent/event_tagging.c
++++ b/sntp/libevent/event_tagging.c
+@@ -210,12 +210,13 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain)
+ 	 * the encoding of a number is at most one byte more than its
+ 	 * storage size.  however, it may also be much smaller.
+ 	 */
++	size_t pullup_len = len < sizeof(number) + 1 ? len : sizeof(number) + 1;
+ 	data = evbuffer_pullup(
+-		evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1);
++		evbuf, pullup_len);
+ 	if (!data)
+ 		return (-1);
+
+-	while (count++ < len) {
++	while (count++ < pullup_len) {
+ 		ev_uint8_t lower = *data++;
+ 		if (shift >= 28) {
+ 			/* Make sure it fits into 32 bits */
+-- 
+2.45.4
+

SPECS/ntp/CVE-2026-63384.patch

@@ -0,0 +1,54 @@
+From 80fb12b908a2b3340ee2daf1dae8254ab5d51502 Mon Sep 17 00:00:00 2001
+From: Nick Mathewson <nickm@torproject.org>
+Date: Wed, 24 Jun 2026 10:08:22 -0400
+Subject: [PATCH] evrpc: Fix integer overflow in evtag_unmarshal_header.
+
+On platforms where int is 32 bits, if this function tried to decode
+a header declaring a payload longer than INT_MAX bytes long, this
+function would return a negative value, which could cause incorrect
+behaviors, incorrect allocations, or denial-of-service.
+
+We solve this (for now) by rejecting any payload length larger
+than INT_MAX.
+
+Fixes GHSA-45c6-qx49-89m8
+
+Reported by @Brubbish
+
+Tracking: X5
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416.patch
+---
+ sntp/libevent/event_tagging.c      | 2 +-
+ sntp/libevent/include/event2/tag.h | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sntp/libevent/event_tagging.c b/sntp/libevent/event_tagging.c
+index c8f7b74..9ee642b 100644
+--- a/sntp/libevent/event_tagging.c
++++ b/sntp/libevent/event_tagging.c
+@@ -446,7 +446,7 @@ evtag_unmarshal_header(struct evbuffer *evbuf, ev_uint32_t *ptag)
+
+ 	if (decode_tag_internal(ptag, evbuf, 1 /* dodrain */) == -1)
+ 		return (-1);
+-	if (evtag_decode_int(&len, evbuf) == -1)
++	if (evtag_decode_int(&len, evbuf) == -1 || len > INT_MAX)
+ 		return (-1);
+
+ 	if (evbuffer_get_length(evbuf) < len)
+diff --git a/sntp/libevent/include/event2/tag.h b/sntp/libevent/include/event2/tag.h
+index 2f73bfc..ac13049 100644
+--- a/sntp/libevent/include/event2/tag.h
++++ b/sntp/libevent/include/event2/tag.h
+@@ -64,6 +64,8 @@ void evtag_init(void);
+ /**
+    Unmarshals the header and returns the length of the payload
+
++   Returns an error if the payload length is above INT_MAX.
++
+    @param evbuf the buffer from which to unmarshal data
+    @param ptag a pointer in which the tag id is being stored
+    @returns -1 on failure or the number of bytes in the remaining payload.
+-- 
+2.45.4
+

SPECS/ntp/CVE-2026-63385.patch

@@ -0,0 +1,46 @@
+From 4dbb5c63c0eaf28fda8c042f114b6604f5ed1362 Mon Sep 17 00:00:00 2001
+From: Nick Mathewson <nickm@torproject.org>
+Date: Fri, 26 Jun 2026 09:08:47 -0400
+Subject: [PATCH] http: Reject headers containing CRLF.
+
+This causes us to reject obfs-fold, which is deprecated in RFC 9112.
+
+Otherwise, we would have a header injection opportunity for
+certain proxy chains.
+
+Reported by @AsafMeizner
+
+Part of GHSA-jcwh-pvf2-73p2
+
+Tracking: X10.
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0.patch
+---
+ sntp/libevent/http.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c
+index a993bfd..8b1fa75 100644
+--- a/sntp/libevent/http.c
++++ b/sntp/libevent/http.c
+@@ -1955,13 +1955,11 @@ evhttp_header_is_valid_value(const char *value)
+ {
+ 	const char *p = value;
+
+-	while ((p = strpbrk(p, "\r\n")) != NULL) {
+-		/* we really expect only one new line */
+-		p += strspn(p, "\r\n");
+-		/* we expect a space or tab for continuation */
+-		if (*p != ' ' && *p != '\t')
+-			return (0);
++	if (strpbrk(p, "\r\n") != NULL) {
++		/* Reject any header containing CR or LF. */
++		return (0);
+ 	}
++
+ 	return (1);
+ }
+
+-- 
+2.45.4
+

SPECS/ntp/CVE-2026-63387.patch

@@ -0,0 +1,43 @@
+From 2440f2465da3e44f66b5249e326dbf9088507955 Mon Sep 17 00:00:00 2001
+From: Nick Mathewson <nickm@torproject.org>
+Date: Wed, 24 Jun 2026 09:08:43 -0400
+Subject: [PATCH] evdns: Fix out-of-bounds write in dnsname_to_labels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This bug would cause the program to write a single 0 byte off the
+end of a stack buffer, if the code ever tried to make a DNS response
+exactly 2^16 + 1 bytes long, ending with a DNS name.
+
+Resolves issue GHSA-58rx-7448-jw47.
+
+This issue was identified by Michał Majchrowicz and
+Marcin Wyczechowski, members of the AFINE Team.
+
+Tracking: X1
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/libevent/libevent/commit/377b9022c3ac61aa4540b5dc4b70c60bf74c663d.patch
+---
+ sntp/libevent/evdns.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sntp/libevent/evdns.c b/sntp/libevent/evdns.c
+index a5b31a3..8ddff8b 100644
+--- a/sntp/libevent/evdns.c
++++ b/sntp/libevent/evdns.c
+@@ -1671,7 +1671,10 @@ dnsname_to_labels(u8 *const buf, size_t buf_len, off_t j,
+ 	/* the labels must be terminated by a 0. */
+ 	/* It's possible that the name ended in a . */
+ 	/* in which case the zero is already there */
+-	if (!j || buf[j-1]) buf[j++] = 0;
++	if ((size_t)j >= buf_len)
++		return -2;
++	if (!j || buf[j-1])
++		buf[j++] = 0;
+ 	return j;
+  overflow:
+ 	return (-2);
+-- 
+2.45.4
+