[vlc-commits] [Git][videolan/vlc][3.0.x] 4 commits: contrib: update upnp to 1.14.31
Steve Lhomme (@robUx4)
gitlab at videolan.org
Thu Jul 9 15:10:58 UTC 2026
Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC
Commits:
20a646d9 by Jean-Baptiste Kempf at 2026-07-09T13:56:17+00:00
contrib: update upnp to 1.14.31
Fixes CVE-2026-41682.
(cherry picked from commit 5a6e69747ceef9ca709e890af85402493b1c704a)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>
- - - - -
a51303f0 by Steve Lhomme at 2026-07-09T13:56:17+00:00
contrib: upnp: fix XP compilation
gIF_IPV4_NETMASK won't be correct but we don't use it.
- - - - -
068d2c7a by Steve Lhomme at 2026-07-09T13:56:17+00:00
upnp: only include upnptools.h when necessary
If UPNP_HAVE_TOOLS is not set we miss UpnpGetErrorMessage / UpnpResolveURL2 / UpnpAddToAction.
- - - - -
d50bc617 by Steve Lhomme at 2026-07-09T13:56:17+00:00
upnp: only include vlc_url.h in the file that needs it
- - - - -
8 changed files:
- + contrib/src/upnp/0001-Do-not-use-missing-OnLinkPrefixLength-when-compiling.patch
- − contrib/src/upnp/0006-uri.c-Dominik-Blain-s-fix-for-vulnerability.patch
- − contrib/src/upnp/0007-cmake-add-missing-file-in-Windows-compilation.patch
- contrib/src/upnp/SHA512SUMS
- contrib/src/upnp/libtool-nostdlib-workaround.patch
- contrib/src/upnp/rules.mak
- modules/services_discovery/upnp.cpp
- modules/services_discovery/upnp.hpp
Changes:
=====================================
contrib/src/upnp/0001-Do-not-use-missing-OnLinkPrefixLength-when-compiling.patch
=====================================
@@ -0,0 +1,31 @@
+From fe55edb953c63047fbe02439a4b32315c949d236 Mon Sep 17 00:00:00 2001
+From: Steve Lhomme <robux4 at ycbcr.xyz>
+Date: Wed, 8 Jul 2026 08:55:58 +0200
+Subject: [PATCH] Do not use missing OnLinkPrefixLength when compiling for XP
+
+(doesn't) work as before e86c7ff18a67eea89649d8981993d3060ea37263.
+gIF_IPV4_NETMASK will not be usable in that case.
+---
+ upnp/src/api/upnpapi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/upnp/src/api/upnpapi.c b/upnp/src/api/upnpapi.c
+index d13340cf..066b1ead 100644
+--- a/upnp/src/api/upnpapi.c
++++ b/upnp/src/api/upnpapi.c
+@@ -3810,10 +3810,12 @@ int UpnpGetIfInfo(const char *IfName)
+ &((struct sockaddr_in *)ip_addr)
+ ->sin_addr,
+ sizeof(v4_addr));
++#if (_WIN32_WINNT >= 0x0600)
+ mask = htonl(
+ ULONG_MAX
+ << (32 - uni_addr->OnLinkPrefixLength));
+ memcpy(&v4_netmask, &mask, sizeof(v4_netmask));
++#endif
+ valid_addr_found = 1;
+ break;
+ case AF_INET6:
+--
+2.52.0.windows.1
+
=====================================
contrib/src/upnp/0006-uri.c-Dominik-Blain-s-fix-for-vulnerability.patch deleted
=====================================
@@ -1,31 +0,0 @@
-From ee2c4488a5318c68fafe9f5a07529f8cac746bc3 Mon Sep 17 00:00:00 2001
-From: Marcelo Roberto Jimenez <marcelo.jimenez at gmail.com>
-Date: Sat, 18 Apr 2026 13:01:35 -0300
-Subject: [PATCH 6/7] uri.c: Dominik Blain's fix for vulnerability
-
-See:
-https://github.com/pupnp/pupnp/security/advisories/GHSA-q522-6w45-4j58
-
-Signed-off-by: Marcelo Roberto Jimenez <marcelo.jimenez at gmail.com>
----
- upnp/src/genlib/net/uri/uri.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/upnp/src/genlib/net/uri/uri.c b/upnp/src/genlib/net/uri/uri.c
-index 772d671e..5064d3f1 100644
---- a/upnp/src/genlib/net/uri/uri.c
-+++ b/upnp/src/genlib/net/uri/uri.c
-@@ -403,6 +403,10 @@ static int parse_hostport(
- srvport = c;
- while (*c != '\0' && isdigit(*c))
- c++;
-+ long port_l = strtol(srvport, NULL, 10);
-+ if (port_l <= 0 || port_l > 65535) {
-+ return UPNP_E_INVALID_URL;
-+ }
- port = (unsigned short int)atoi(srvport);
- if (port == 0)
- /* Bad port number. */
---
-2.52.0.windows.1
-
=====================================
contrib/src/upnp/0007-cmake-add-missing-file-in-Windows-compilation.patch deleted
=====================================
@@ -1,31 +0,0 @@
-From 9e54cdc85fff007de22c4f9de45d01a38ed13f84 Mon Sep 17 00:00:00 2001
-From: Steve Lhomme <robux4 at ycbcr.xyz>
-Date: Fri, 16 Jan 2026 10:24:58 +0100
-Subject: [PATCH 7/7] cmake: add missing file in Windows compilation
-
-It's compiled with the autotools build but not CMake.
-This is only useful when compiling for older targets than Windows Vista.
----
- upnp/CMakeLists.txt | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/upnp/CMakeLists.txt b/upnp/CMakeLists.txt
-index 594aaffa..6fae57b7 100644
---- a/upnp/CMakeLists.txt
-+++ b/upnp/CMakeLists.txt
-@@ -43,6 +43,12 @@ set (UPNP_SOURCES
- src/urlconfig/urlconfig.c
- )
-
-+if(WIN32)
-+ list (APPEND UPNP_SOURCES
-+ src/inet_pton.c
-+ )
-+endif()
-+
- if (UPNP_ENABLE_GENA)
- list (APPEND UPNP_SOURCES
- src/gena/gena_device.c
---
-2.52.0.windows.1
-
=====================================
contrib/src/upnp/SHA512SUMS
=====================================
@@ -1 +1 @@
-8aabd054d3c311abab762d15c739e5e10801e9a6caf09540560be9497cb632fdfc2c86a61522ab0b24e9baf20020ab0dab2a6e8e253c9cc1a1047efc701ba563 pupnp-release-1.14.20.tar.gz
+be0f876adb7a0799187531cc83a29afd5bfe8f7772e909f88faf406e344f992ccb07ef410f7511766576bde8128478926e33cebfcfa8ed1ba15fe136e0bfc8c7 pupnp-release-1.14.31.tar.gz
=====================================
contrib/src/upnp/libtool-nostdlib-workaround.patch
=====================================
@@ -13,11 +13,11 @@ same reasons.
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
-index de7f4525..6fd04bf4 100644
+index 60fd0f62..8e12bb3c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
-@@ -301,6 +301,15 @@ if (UPNP_ENABLE_OPEN_SSL)
- set (OPENSSL_LIBS "-lssl")
+@@ -302,6 +302,15 @@ if(UPNP_ENABLE_OPEN_SSL)
+ set(OPENSSL_LIBS "-lssl")
endif()
+if (WIN32 OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
@@ -29,9 +29,9 @@ index de7f4525..6fd04bf4 100644
+ endif()
+endif()
+
- configure_file (${CMAKE_CURRENT_SOURCE_DIR}/libupnp.pc.in ${CMAKE_CURRENT_BINARY_DIR}/libupnp.pc @ONLY)
+ configure_file(${CMAKE_CURRENT_SOURCE_DIR}/libupnp.pc.in ${CMAKE_CURRENT_BINARY_DIR}/libupnp.pc @ONLY)
- install (FILES ${CMAKE_CURRENT_BINARY_DIR}/libupnp.pc
+ install(FILES ${CMAKE_CURRENT_BINARY_DIR}/libupnp.pc
diff --git a/libupnp.pc.in b/libupnp.pc.in
index 8c6fc22f..4c8b9f79 100644
--- a/libupnp.pc.in
@@ -47,4 +47,3 @@ index 8c6fc22f..4c8b9f79 100644
--
2.38.1
-
=====================================
contrib/src/upnp/rules.mak
=====================================
@@ -1,5 +1,5 @@
# UPNP
-UPNP_VERSION := 1.14.20
+UPNP_VERSION := 1.14.31
UPNP_URL := $(GITHUB)/pupnp/pupnp/archive/refs/tags/release-$(UPNP_VERSION).tar.gz
ifdef BUILD_NETWORK
@@ -43,8 +43,7 @@ ifdef HAVE_IOS
$(APPLY) $(SRC)/upnp/fix-reuseaddr-option.patch
endif
$(APPLY) $(SRC)/upnp/0001-Don-t-assume-strndup-to-be-missing-on-Windows.patch
- $(APPLY) $(SRC)/upnp/0006-uri.c-Dominik-Blain-s-fix-for-vulnerability.patch
- $(APPLY) $(SRC)/upnp/0007-cmake-add-missing-file-in-Windows-compilation.patch
+ $(APPLY) $(SRC)/upnp/0001-Do-not-use-missing-OnLinkPrefixLength-when-compiling.patch
$(MOVE)
.upnp: upnp toolchain.cmake
=====================================
modules/services_discovery/upnp.cpp
=====================================
@@ -30,11 +30,16 @@
#include "upnp.hpp"
+#ifdef UPNP_HAVE_TOOLS
+#include <upnp/upnptools.h>
+#endif
+
#include <vlc_access.h>
#include <vlc_plugin.h>
#include <vlc_interrupt.h>
#include <vlc_services_discovery.h>
#include <vlc_charset.h>
+#include <vlc_url.h>
#include <cassert>
#include <limits.h>
=====================================
modules/services_discovery/upnp.hpp
=====================================
@@ -32,10 +32,8 @@
#include <string>
#include <upnp/upnp.h>
-#include <upnp/upnptools.h>
#include <vlc_common.h>
-#include <vlc_url.h>
#if UPNP_VERSION < 10800
typedef void* UpnpEventPtr;
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/9c9db010b7ef7a58bd1dd1d6ab4ab7bf9c50047d...d50bc6176d4c865b4778b97c2d0443f69c2c5ecf
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/9c9db010b7ef7a58bd1dd1d6ab4ab7bf9c50047d...d50bc6176d4c865b4778b97c2d0443f69c2c5ecf
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list