Security update: umurmur 4.1.0

Andrew Kloet <[email protected]> Tue, 18 Aug 2026 17:21:17 -0400
Newsgroups	gmane.os.openbsd.ports
Message-ID	<[email protected]>
Hi ports@

Attached is an update of umurmur 3.1.0 -> 4.1.0.
This supersedes my previous 4.0.0 patch. [1]

A CVE is being requested for a remote use-after-free crash in < 0.4.1
I believe this update should be backported to -stable.

In good news, all of our logic patches have been upstreamed.
The only patches remaining pertain to some strings.

Changelog:
https://github.com/umurmur/umurmur/releases/tag/v0.4.1

OK?

Andrew

[1] https://marc.info/?l=openbsd-ports&m=178705931262255&w=2

diff --git a/audio/umurmur/Makefile b/audio/umurmur/Makefile
index b6cb72999..32bcdff0e 100644
--- a/audio/umurmur/Makefile
+++ b/audio/umurmur/Makefile
@@ -2,15 +2,18 @@ COMMENT =		minimalistic Mumble server
 
 GH_ACCOUNT =		umurmur
 GH_PROJECT =		umurmur
-GH_TAGNAME =		v0.3.1
+GH_TAGNAME =		v0.4.1
 
 CATEGORIES =		audio
 
 HOMEPAGE =		https://umurmur.net/
 
+MAINTAINER =		Andrew Kloet <[email protected]>
+
 # BSD
 PERMIT_PACKAGE =	Yes
 
+# uses pledge() and unveil()
 WANTLIB =		c config crypto protobuf-c>=1.0 ssl
 
 MODULES =		devel/cmake
@@ -18,6 +21,8 @@ MODULES =		devel/cmake
 LIB_DEPENDS =		devel/libconfig \
 			devel/protobuf-c>=1.0.1
 
+SEPARATE_BUILD =	Yes
+
 pre-configure:
 	${SUBST_CMD} ${WRKSRC}/src/conf.c ${WRKSRC}/src/config.h.in \
 		${WRKSRC}/umurmur.conf.example
diff --git a/audio/umurmur/distinfo b/audio/umurmur/distinfo
index ead2483e3..c98f79f65 100644
--- a/audio/umurmur/distinfo
+++ b/audio/umurmur/distinfo
@@ -1,2 +1,2 @@
-SHA256 (umurmur-0.3.1.tar.gz) = gyfdCyxb0YejjQmCleiWprhdaYySaCBbyyf2JE92CnM=
-SIZE (umurmur-0.3.1.tar.gz) = 94742
+SHA256 (umurmur-0.4.1.tar.gz) = 5U4wKjHX/0GX6mx3dCt5HW6lCODGDJVXlfUZXwvsLtw=
+SIZE (umurmur-0.4.1.tar.gz) = 85810
diff --git a/audio/umurmur/patches/patch-CMakeLists_txt b/audio/umurmur/patches/patch-CMakeLists_txt
index df1a0b7b6..fe7f18291 100644
--- a/audio/umurmur/patches/patch-CMakeLists_txt
+++ b/audio/umurmur/patches/patch-CMakeLists_txt
@@ -1,16 +1,7 @@
 Index: CMakeLists.txt
 --- CMakeLists.txt.orig
 +++ CMakeLists.txt
-@@ -3,7 +3,7 @@ project(umurmurd C)
- 
- set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_SOURCE_DIR}/cmake/Modules/")
- set(CMAKE_INSTALL_RPATH_USE_LINK_PATH true)
--set(UMURMUR_BINARY_DIR "${CMAKE_BINARY_DIR}/bin")
-+set(UMURMUR_BINARY_DIR "${CMAKE_BINARY_DIR}/sbin")
- set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${UMURMUR_BINARY_DIR}")
- 
- if(NOT CMAKE_BUILD_TYPE)
-@@ -31,7 +31,7 @@ add_subdirectory(src)
+@@ -44,7 +44,7 @@ add_subdirectory(src)
  
  install(
    FILES "umurmur.conf.example"
diff --git a/audio/umurmur/patches/patch-src_CMakeLists_txt b/audio/umurmur/patches/patch-src_CMakeLists_txt
new file mode 100644
index 000000000..57567cc6f
--- /dev/null
+++ b/audio/umurmur/patches/patch-src_CMakeLists_txt
@@ -0,0 +1,10 @@
+Index: src/CMakeLists.txt
+--- src/CMakeLists.txt.orig
++++ src/CMakeLists.txt
+@@ -70,5 +70,5 @@ target_link_libraries(${PROJECT_NAME}
+                       ${CRYPTO_LIBRARIES})
+ 
+ install(TARGETS ${PROJECT_NAME}
+-	RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
++	RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR}
+ )
diff --git a/audio/umurmur/patches/patch-src_byteorder_h b/audio/umurmur/patches/patch-src_byteorder_h
deleted file mode 100644
index 60a122a4d..000000000
--- a/audio/umurmur/patches/patch-src_byteorder_h
+++ /dev/null
@@ -1,28 +0,0 @@
-Include correct userspace header for endian information
-Skip linuxism to fix build on LP64 archs that aren't amd64
-
-Index: src/byteorder.h
---- src/byteorder.h.orig
-+++ src/byteorder.h
-@@ -36,7 +36,7 @@
- #include <stdint.h>
- 
- #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__APPLE__)
--#include <machine/endian.h>
-+#include <endian.h>
- #if BYTE_ORDER == BIG_ENDIAN
- #define BYTE_ORDER_BIG_ENDIAN
- #endif // BYTE_ORDER == BIG_ENDIAN
-@@ -55,9 +55,11 @@ typedef uint64_t subblock;
- #define SWAPPED(x) (x)
- #elif defined( __x86_64__)
- #define SWAPPED(x) ({register uint64_t __out, __in = (x); __asm__("bswap %q0" : "=r"(__out) : "0"(__in)); __out;})
--#else
-+#elif defined(LINUX)
- #include <byteswap.h>
- #define SWAPPED(x) bswap_64(x)
-+#else
-+#define SWAPPED(x) htobe64(x)
- #endif // defined(BYTE_ORDER_BIG_ENDIAN)
- #else
- #define BLOCKSIZE 4
diff --git a/audio/umurmur/patches/patch-src_client_c b/audio/umurmur/patches/patch-src_client_c
deleted file mode 100644
index b8cdac979..000000000
--- a/audio/umurmur/patches/patch-src_client_c
+++ /dev/null
@@ -1,21 +0,0 @@
-Index: src/client.c
---- src/client.c.orig
-+++ src/client.c
-@@ -200,7 +200,7 @@ void Client_token_free(client_t *client)
- void recheckCodecVersions(client_t *connectingClient)
- {
- 	client_t *client_itr = NULL;
--	int max = 0, version, current_version;
-+	int max = 0, version = 0, current_version = 0;
- 	int users = 0, opus = 0;
- 	message_t *sendmsg;
- 	struct dlist codec_list, *itr, *save;
-@@ -679,7 +679,7 @@ void Client_textmessage(client_t *client, char *text)
- 	sendmsg->payload.textMessage->message = message;
- 	sendmsg->payload.textMessage->n_tree_id = 1;
- 	sendmsg->payload.textMessage->tree_id = tree_id;
--	strcpy(message, text);
-+	strlcpy(message, text, strlen(text) + 1);
- 	Client_send_message(client, sendmsg);
- }
- 
diff --git a/audio/umurmur/patches/patch-src_config_h_in b/audio/umurmur/patches/patch-src_config_h_in
index ee8a9acd8..305736d61 100644
--- a/audio/umurmur/patches/patch-src_config_h_in
+++ b/audio/umurmur/patches/patch-src_config_h_in
@@ -1,9 +1,9 @@
 Index: src/config.h.in
 --- src/config.h.in.orig
 +++ src/config.h.in
-@@ -8,6 +8,6 @@
- 
- #cmakedefine USE_SHAREDMEMORY_API
+@@ -12,6 +12,6 @@
+ #cmakedefine UMURMUR_CODENAME "@UMURMUR_CODENAME@"
+ #cmakedefine SSL_LIBRARY "@SSL_LIBRARY@"
  
 -#define DEFAULT_CONFIG "${CMAKE_INSTALL_FULL_SYSCONFDIR}/umurmur/umurmur.conf"
 +#define DEFAULT_CONFIG "${SYSCONFDIR}/umurmur/umurmur.conf"
diff --git a/audio/umurmur/patches/patch-src_messagehandler_c b/audio/umurmur/patches/patch-src_messagehandler_c
deleted file mode 100644
index 473464356..000000000
--- a/audio/umurmur/patches/patch-src_messagehandler_c
+++ /dev/null
@@ -1,15 +0,0 @@
-Index: src/messagehandler.c
---- src/messagehandler.c.orig
-+++ src/messagehandler.c
-@@ -521,9 +521,9 @@ void Mh_handle_message(client_t *client, message_t *ms
- 			sendmsg->payload.textMessage->n_tree_id = 1;
- 			sendmsg->payload.textMessage->tree_id = tree_id;
- 			if (client->recording)
--				sprintf(message, "User %s started recording", client->username);
-+				snprintf(message, strlen(client->username) + 32, "User %s started recording", client->username);
- 			else
--				sprintf(message, "User %s stopped recording", client->username);
-+				snprintf(message, strlen(client->username) + 32, "User %s stopped recording", client->username);
- 			Client_send_message_except_ver(NULL, sendmsg, ~0x010203);
- 			sendmsg = NULL;
- 		}
diff --git a/audio/umurmur/patches/patch-src_server_c b/audio/umurmur/patches/patch-src_server_c
deleted file mode 100644
index 6a21d5113..000000000
--- a/audio/umurmur/patches/patch-src_server_c
+++ /dev/null
@@ -1,14 +0,0 @@
-Index: src/server.c
---- src/server.c.orig
-+++ src/server.c
-@@ -102,8 +102,8 @@ struct sockaddr_storage** Server_setupAddressesAndPort
- 	v6address->ss_family = AF_INET6;
- 
- #if defined(__NetBSD__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__APPLE__)
--	v4address->ss_len = sizeof(struct sockaddr_storage);
--	v6address->ss_len = sizeof(struct sockaddr_storage);
-+	v4address->ss_len = sizeof(struct sockaddr_in);
-+	v6address->ss_len = sizeof(struct sockaddr_in6);
- #endif
- 
- 	int error = 0;
diff --git a/audio/umurmur/patches/patch-umurmur_conf_example b/audio/umurmur/patches/patch-umurmur_conf_example
index e54b959e6..6a0e2750d 100644
--- a/audio/umurmur/patches/patch-umurmur_conf_example
+++ b/audio/umurmur/patches/patch-umurmur_conf_example
@@ -4,8 +4,8 @@ Index: umurmur.conf.example
 @@ -1,7 +1,7 @@
  max_bandwidth = 48000;
  welcometext = "Welcome to uMurmur!";
--certificate = "/etc/umurmur/cert.crt";
--private_key = "/etc/umurmur/key.key";
+-certificate = "/etc/umurmur/certificate.crt";
+-private_key = "/etc/umurmur/private_key.key";
 +certificate = "${SYSCONFDIR}/umurmur/certificate.crt";
 +private_key = "${SYSCONFDIR}/umurmur/private_key.key";
  password = "";
diff --git a/audio/umurmur/pkg/umurmurd.rc b/audio/umurmur/pkg/umurmurd.rc
index 5e36e9b7d..f77bc746d 100644
--- a/audio/umurmur/pkg/umurmurd.rc
+++ b/audio/umurmur/pkg/umurmurd.rc
@@ -4,6 +4,10 @@ daemon="${TRUEPREFIX}/sbin/umurmurd"
 
 . /etc/rc.d/rc.subr
 
+rc_configtest() {
+	rc_exec "${daemon} -t ${daemon_flags}"
+}
+
 rc_reload=NO
 
 rc_cmd $1
signature.asc (application/pgp-signature, 228 B)