[vlc-commits] [Git][videolan/vlc][3.0.x] 4 commits: contrib: update upnp to 1.14.31

Steve Lhomme (@robUx4) gitlab at videolan.org
Thu Jul 9 15:10:58 UTC 2026



Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC


Commits:
20a646d9 by Jean-Baptiste Kempf at 2026-07-09T13:56:17+00:00
contrib: update upnp to 1.14.31

Fixes CVE-2026-41682.

(cherry picked from commit 5a6e69747ceef9ca709e890af85402493b1c704a)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -
a51303f0 by Steve Lhomme at 2026-07-09T13:56:17+00:00
contrib: upnp: fix XP compilation

gIF_IPV4_NETMASK won't be correct but we don't use it.

- - - - -
068d2c7a by Steve Lhomme at 2026-07-09T13:56:17+00:00
upnp: only include upnptools.h when necessary

If UPNP_HAVE_TOOLS is not set we miss UpnpGetErrorMessage / UpnpResolveURL2 / UpnpAddToAction.

- - - - -
d50bc617 by Steve Lhomme at 2026-07-09T13:56:17+00:00
upnp: only include vlc_url.h in the file that needs it

- - - - -


8 changed files:

- + contrib/src/upnp/0001-Do-not-use-missing-OnLinkPrefixLength-when-compiling.patch
- − contrib/src/upnp/0006-uri.c-Dominik-Blain-s-fix-for-vulnerability.patch
- − contrib/src/upnp/0007-cmake-add-missing-file-in-Windows-compilation.patch
- contrib/src/upnp/SHA512SUMS
- contrib/src/upnp/libtool-nostdlib-workaround.patch
- contrib/src/upnp/rules.mak
- modules/services_discovery/upnp.cpp
- modules/services_discovery/upnp.hpp


Changes:

=====================================
contrib/src/upnp/0001-Do-not-use-missing-OnLinkPrefixLength-when-compiling.patch
=====================================
@@ -0,0 +1,31 @@
+From fe55edb953c63047fbe02439a4b32315c949d236 Mon Sep 17 00:00:00 2001
+From: Steve Lhomme <robux4 at ycbcr.xyz>
+Date: Wed, 8 Jul 2026 08:55:58 +0200
+Subject: [PATCH] Do not use missing OnLinkPrefixLength when compiling for XP
+
+(doesn't) work as before e86c7ff18a67eea89649d8981993d3060ea37263.
+gIF_IPV4_NETMASK will not be usable in that case.
+---
+ upnp/src/api/upnpapi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/upnp/src/api/upnpapi.c b/upnp/src/api/upnpapi.c
+index d13340cf..066b1ead 100644
+--- a/upnp/src/api/upnpapi.c
++++ b/upnp/src/api/upnpapi.c
+@@ -3810,10 +3810,12 @@ int UpnpGetIfInfo(const char *IfName)
+ 					&((struct sockaddr_in *)ip_addr)
+ 						->sin_addr,
+ 					sizeof(v4_addr));
++#if (_WIN32_WINNT >= 0x0600)
+ 				mask = htonl(
+ 					ULONG_MAX
+ 					<< (32 - uni_addr->OnLinkPrefixLength));
+ 				memcpy(&v4_netmask, &mask, sizeof(v4_netmask));
++#endif
+ 				valid_addr_found = 1;
+ 				break;
+ 			case AF_INET6:
+-- 
+2.52.0.windows.1
+


=====================================
contrib/src/upnp/0006-uri.c-Dominik-Blain-s-fix-for-vulnerability.patch deleted
=====================================
@@ -1,31 +0,0 @@
-From ee2c4488a5318c68fafe9f5a07529f8cac746bc3 Mon Sep 17 00:00:00 2001
-From: Marcelo Roberto Jimenez <marcelo.jimenez at gmail.com>
-Date: Sat, 18 Apr 2026 13:01:35 -0300
-Subject: [PATCH 6/7] uri.c: Dominik Blain's fix for vulnerability
-
-See:
-https://github.com/pupnp/pupnp/security/advisories/GHSA-q522-6w45-4j58
-
-Signed-off-by: Marcelo Roberto Jimenez <marcelo.jimenez at gmail.com>
----
- upnp/src/genlib/net/uri/uri.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/upnp/src/genlib/net/uri/uri.c b/upnp/src/genlib/net/uri/uri.c
-index 772d671e..5064d3f1 100644
---- a/upnp/src/genlib/net/uri/uri.c
-+++ b/upnp/src/genlib/net/uri/uri.c
-@@ -403,6 +403,10 @@ static int parse_hostport(
- 		srvport = c;
- 		while (*c != '\0' && isdigit(*c))
- 			c++;
-+		long port_l = strtol(srvport, NULL, 10);
-+		if (port_l <= 0 || port_l > 65535) {
-+			return UPNP_E_INVALID_URL;
-+		}
- 		port = (unsigned short int)atoi(srvport);
- 		if (port == 0)
- 			/* Bad port number. */
--- 
-2.52.0.windows.1
-


=====================================
contrib/src/upnp/0007-cmake-add-missing-file-in-Windows-compilation.patch deleted
=====================================
@@ -1,31 +0,0 @@
-From 9e54cdc85fff007de22c4f9de45d01a38ed13f84 Mon Sep 17 00:00:00 2001
-From: Steve Lhomme <robux4 at ycbcr.xyz>
-Date: Fri, 16 Jan 2026 10:24:58 +0100
-Subject: [PATCH 7/7] cmake: add missing file in Windows compilation
-
-It's compiled with the autotools build but not CMake.
-This is only useful when compiling for older targets than Windows Vista.
----
- upnp/CMakeLists.txt | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/upnp/CMakeLists.txt b/upnp/CMakeLists.txt
-index 594aaffa..6fae57b7 100644
---- a/upnp/CMakeLists.txt
-+++ b/upnp/CMakeLists.txt
-@@ -43,6 +43,12 @@ set (UPNP_SOURCES
- 	src/urlconfig/urlconfig.c
- )
- 
-+if(WIN32)
-+	list (APPEND UPNP_SOURCES
-+		src/inet_pton.c
-+	)
-+endif()
-+
- if (UPNP_ENABLE_GENA)
- 	list (APPEND UPNP_SOURCES
- 		src/gena/gena_device.c
--- 
-2.52.0.windows.1
-


=====================================
contrib/src/upnp/SHA512SUMS
=====================================
@@ -1 +1 @@
-8aabd054d3c311abab762d15c739e5e10801e9a6caf09540560be9497cb632fdfc2c86a61522ab0b24e9baf20020ab0dab2a6e8e253c9cc1a1047efc701ba563  pupnp-release-1.14.20.tar.gz
+be0f876adb7a0799187531cc83a29afd5bfe8f7772e909f88faf406e344f992ccb07ef410f7511766576bde8128478926e33cebfcfa8ed1ba15fe136e0bfc8c7  pupnp-release-1.14.31.tar.gz


=====================================
contrib/src/upnp/libtool-nostdlib-workaround.patch
=====================================
@@ -13,11 +13,11 @@ same reasons.
  2 files changed, 10 insertions(+), 1 deletion(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index de7f4525..6fd04bf4 100644
+index 60fd0f62..8e12bb3c 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -301,6 +301,15 @@ if (UPNP_ENABLE_OPEN_SSL)
- 	set (OPENSSL_LIBS "-lssl")
+@@ -302,6 +302,15 @@ if(UPNP_ENABLE_OPEN_SSL)
+	set(OPENSSL_LIBS "-lssl")
  endif()
  
 +if (WIN32 OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
@@ -29,9 +29,9 @@ index de7f4525..6fd04bf4 100644
 +    endif()
 +endif()
 +
- configure_file (${CMAKE_CURRENT_SOURCE_DIR}/libupnp.pc.in ${CMAKE_CURRENT_BINARY_DIR}/libupnp.pc @ONLY)
+ configure_file(${CMAKE_CURRENT_SOURCE_DIR}/libupnp.pc.in ${CMAKE_CURRENT_BINARY_DIR}/libupnp.pc @ONLY)
  
- install (FILES ${CMAKE_CURRENT_BINARY_DIR}/libupnp.pc
+ install(FILES ${CMAKE_CURRENT_BINARY_DIR}/libupnp.pc
 diff --git a/libupnp.pc.in b/libupnp.pc.in
 index 8c6fc22f..4c8b9f79 100644
 --- a/libupnp.pc.in
@@ -47,4 +47,3 @@ index 8c6fc22f..4c8b9f79 100644
  
 -- 
 2.38.1
-


=====================================
contrib/src/upnp/rules.mak
=====================================
@@ -1,5 +1,5 @@
 # UPNP
-UPNP_VERSION := 1.14.20
+UPNP_VERSION := 1.14.31
 UPNP_URL := $(GITHUB)/pupnp/pupnp/archive/refs/tags/release-$(UPNP_VERSION).tar.gz
 
 ifdef BUILD_NETWORK
@@ -43,8 +43,7 @@ ifdef HAVE_IOS
 	$(APPLY) $(SRC)/upnp/fix-reuseaddr-option.patch
 endif
 	$(APPLY) $(SRC)/upnp/0001-Don-t-assume-strndup-to-be-missing-on-Windows.patch
-	$(APPLY) $(SRC)/upnp/0006-uri.c-Dominik-Blain-s-fix-for-vulnerability.patch
-	$(APPLY) $(SRC)/upnp/0007-cmake-add-missing-file-in-Windows-compilation.patch
+	$(APPLY) $(SRC)/upnp/0001-Do-not-use-missing-OnLinkPrefixLength-when-compiling.patch
 	$(MOVE)
 
 .upnp: upnp toolchain.cmake


=====================================
modules/services_discovery/upnp.cpp
=====================================
@@ -30,11 +30,16 @@
 
 #include "upnp.hpp"
 
+#ifdef UPNP_HAVE_TOOLS
+#include <upnp/upnptools.h>
+#endif
+
 #include <vlc_access.h>
 #include <vlc_plugin.h>
 #include <vlc_interrupt.h>
 #include <vlc_services_discovery.h>
 #include <vlc_charset.h>
+#include <vlc_url.h>
 
 #include <cassert>
 #include <limits.h>


=====================================
modules/services_discovery/upnp.hpp
=====================================
@@ -32,10 +32,8 @@
 #include <string>
 
 #include <upnp/upnp.h>
-#include <upnp/upnptools.h>
 
 #include <vlc_common.h>
-#include <vlc_url.h>
 
 #if UPNP_VERSION < 10800
 typedef void* UpnpEventPtr;



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/9c9db010b7ef7a58bd1dd1d6ab4ab7bf9c50047d...d50bc6176d4c865b4778b97c2d0443f69c2c5ecf

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/9c9db010b7ef7a58bd1dd1d6ab4ab7bf9c50047d...d50bc6176d4c865b4778b97c2d0443f69c2c5ecf
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help




More information about the vlc-commits mailing list