mirror of
https://github.com/pi-hole/FTL.git
synced 2026-08-20 22:47:33 +01:00
DL6ER
7064780cfb
The sources are now copied from https://github.com/DL6ER/civetweb (branch `pi-hole`), which is CivetWeb master plus the fixes we have pending upstream. That branch stays deliberately close to master - only necessary and security fixes go on it, everything Pi-hole specific stays in `patch/civetweb/`. This picks up two memory-safety fixes we were missing: the integer underflow in the multipart form field length, where `next` can point before `hend` on a malformed part and the unchecked pointer subtraction underflows `size_t`, and the endless loop on a truncated URL-encoded body. Neither is upstream yet, so waiting for a CivetWeb release would not have given us either. It also brings the error status for custom error pages, which we need for the static web interface. `patch/civetweb.sh` now applies the stack with `git apply --3way` rather than `patch`. This is not cosmetic: `patch` matches hunks by surrounding context and silently applies them elsewhere when that context has drifted. Dropping our sources in and running the old script applied three patches into the wrong place while still reporting success, so `mg_request_info.csrf_token`, the `mg_server_port.addr` union and the thread `setpriority()` call all vanished and the tree no longer compiled. A three-way merge uses the blob a patch was generated against and either merges correctly or leaves a real conflict, and it copes with code moving around - which is the normal case after a bump. The script also fails now instead of printing that everything applied okay. The Kepler patch had lost the leading space on three of its context lines, which GNU `patch` tolerates and `git apply` rejects; those are restored. The PROXY protocol v2 patch is dropped: it is on the fork as a commit, so carrying it here as well conflicts. Signed-off-by: DL6ER <dl6er@dl6er.de>