Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump deps, determine the new MSRV #13

Closed
wants to merge 2 commits into from
Closed

Conversation

yvt
Copy link

@yvt yvt commented Oct 22, 2022

net2 0.2.33 contains a serious memory bug RUSTSEC-2020-0078. This bug started manifesting itself in Rust 1.64.0 because of the SocketAddr layout optimization in rust-lang/rust#78802.

cfdyndns is no longer able to connect to a server when built by nixpkgs-unstable buildRustPackage, which has recently been updated to use Rust 1.64.0. Since strace shows connection attempts with malformed socket addresses, I think cfdyndns is affected by this bug.

[pid 3541684] connect(6, {sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\273\1&\6G\0000\n\0\0\0\0\0\0h\23\300\35\0\0"}, 28) = 0                                                                                                                                                 
[pid 3541684] sendto(6, "[...]"..., 517, MSG_NOSIGNAL, NULL, 0) = -1 EPIPE (Broken pipe)
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: reqwest::Error { kind: Request, url: "https://api.cloudflare.com/client/v4/zones", source: hyper::Error(Connect, Ssl(Error { code: ErrorCode(5), cause: Some(Io(Os { code: 32, kind: BrokenPipe, message: "Broken pipe" })) }, X509VerifyResult { code: 0, error: "ok" })) }', src/main.rs:47:10                                                                                        
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace      

yvt added 2 commits October 23, 2022 00:18
      Adding addr2line v0.17.0
      Adding adler v1.0.2
    Updating aho-corasick v0.7.10 -> v0.7.19
      Adding android_system_properties v0.1.5
    Updating async-trait v0.1.24 -> v0.1.58
    Updating autocfg v1.0.0 -> v1.1.0
    Updating backtrace v0.3.45 -> v0.3.66
    Removing backtrace-sys v0.1.34
    Updating base64 v0.11.0 -> v0.13.1
    Updating bitflags v1.2.1 -> v1.3.2
    Updating bumpalo v3.2.0 -> v3.11.1
    Removing bytes v0.5.4
      Adding bytes v0.5.6
      Adding bytes v1.2.1
    Updating cc v1.0.50 -> v1.0.73
      Adding cfg-if v1.0.0
    Updating chrono v0.4.11 -> v0.4.22
      Adding codespan-reporting v0.11.1
    Updating core-foundation v0.7.0 -> v0.9.3
    Updating core-foundation-sys v0.7.0 -> v0.8.3
      Adding cxx v1.0.80
      Adding cxx-build v1.0.80
      Adding cxxbridge-flags v1.0.80
      Adding cxxbridge-macro v1.0.80
    Updating data-encoding v2.2.0 -> v2.3.2
    Removing dtoa v0.4.5
    Updating encoding_rs v0.8.22 -> v0.8.31
    Updating enum-as-inner v0.3.2 -> v0.3.4
      Adding fastrand v1.8.0
    Updating fnv v1.0.6 -> v1.0.7
      Adding form_urlencoded v1.1.0
    Updating futures v0.3.4 -> v0.3.25
    Updating futures-channel v0.3.4 -> v0.3.25
    Updating futures-core v0.3.4 -> v0.3.25
    Updating futures-io v0.3.4 -> v0.3.25
    Updating futures-sink v0.3.4 -> v0.3.25
    Updating futures-task v0.3.4 -> v0.3.25
    Updating futures-util v0.3.4 -> v0.3.25
    Updating getrandom v0.1.14 -> v0.1.16
      Adding gimli v0.26.2
    Updating h2 v0.2.2 -> v0.2.7
      Adding hashbrown v0.12.3
    Updating heck v0.3.1 -> v0.4.0
    Updating hermit-abi v0.1.8 -> v0.1.19
    Updating http v0.2.0 -> v0.2.8
    Updating httparse v1.3.4 -> v1.8.0
      Adding httpdate v0.3.2
    Updating hyper v0.13.3 -> v0.13.10
    Updating hyper-tls v0.4.1 -> v0.4.3
      Adding iana-time-zone v0.1.51
      Adding iana-time-zone-haiku v0.1.1
    Removing idna v0.2.0
      Adding idna v0.2.3
      Adding idna v0.3.0
    Updating indexmap v1.3.2 -> v1.9.1
      Adding instant v0.1.12
      Adding ipnet v2.5.0
    Removing itoa v0.4.5
      Adding itoa v0.4.8
      Adding itoa v1.0.4
    Updating js-sys v0.3.36 -> v0.3.60
    Updating libc v0.2.67 -> v0.2.135
      Adding link-cplusplus v1.0.7
    Updating log v0.4.8 -> v0.4.17
    Updating matches v0.1.8 -> v0.1.9
    Updating memchr v2.3.3 -> v2.5.0
    Updating mime_guess v2.0.3 -> v2.0.4
      Adding miniz_oxide v0.5.4
    Updating mio v0.6.21 -> v0.6.23
    Updating miow v0.2.1 -> v0.2.2
    Updating native-tls v0.2.4 -> v0.2.10
    Updating net2 v0.2.33 -> v0.2.38
    Updating num-integer v0.1.42 -> v0.1.45
    Updating num-traits v0.2.11 -> v0.2.15
    Updating num_cpus v1.12.0 -> v1.13.1
      Adding object v0.29.0
      Adding once_cell v1.15.0
    Updating openssl v0.10.28 -> v0.10.42
      Adding openssl-macros v0.1.0
    Updating openssl-probe v0.1.2 -> v0.1.5
    Updating openssl-sys v0.9.54 -> v0.9.77
    Updating percent-encoding v2.1.0 -> v2.2.0
    Updating pin-project v0.4.8 -> v1.0.12
    Updating pin-project-internal v0.4.8 -> v1.0.12
    Removing pin-project-lite v0.1.4
      Adding pin-project-lite v0.1.12
      Adding pin-project-lite v0.2.9
    Updating pin-utils v0.1.0-alpha.4 -> v0.1.0
    Updating pkg-config v0.3.17 -> v0.3.25
    Updating ppv-lite86 v0.2.6 -> v0.2.16
    Updating proc-macro2 v1.0.9 -> v1.0.47
    Updating quote v1.0.3 -> v1.0.21
    Updating redox_syscall v0.1.56 -> v0.2.16
    Updating regex v1.3.4 -> v1.6.0
    Updating regex-syntax v0.6.16 -> v0.6.27
    Updating remove_dir_all v0.5.2 -> v0.5.3
    Updating reqwest v0.10.4 -> v0.10.10
    Updating rustc-demangle v0.1.16 -> v0.1.21
    Updating ryu v1.0.2 -> v1.0.11
    Updating schannel v0.1.17 -> v0.1.20
      Adding scratch v1.0.2
    Updating security-framework v0.4.1 -> v2.7.0
    Updating security-framework-sys v0.4.1 -> v2.6.1
    Updating serde v1.0.104 -> v1.0.147
    Updating serde_json v1.0.48 -> v1.0.87
    Updating serde_urlencoded v0.6.1 -> v0.7.1
    Updating slab v0.4.2 -> v0.4.7
    Updating smallvec v1.2.0 -> v1.10.0
      Adding socket2 v0.3.19
    Updating syn v1.0.16 -> v1.0.103
    Updating tempfile v3.1.0 -> v3.3.0
    Updating termcolor v1.1.0 -> v1.1.3
    Updating thiserror v1.0.11 -> v1.0.37
    Updating thiserror-impl v1.0.11 -> v1.0.37
    Removing thread_local v1.0.1
    Updating time v0.1.42 -> v0.1.44
      Adding tinyvec v1.6.0
      Adding tinyvec_macros v0.1.0
    Updating tokio v0.2.13 -> v0.2.25
    Updating tokio-tls v0.3.0 -> v0.3.1
    Updating tokio-util v0.2.0 -> v0.3.1
    Updating tower-service v0.3.0 -> v0.3.2
      Adding tracing v0.1.37
      Adding tracing-core v0.1.30
      Adding tracing-futures v0.2.5
    Updating trust-dns-client v0.19.3 -> v0.19.7
    Updating trust-dns-proto v0.19.3 -> v0.19.7
    Updating try-lock v0.2.2 -> v0.2.3
    Updating unicode-bidi v0.3.4 -> v0.3.8
      Adding unicode-ident v1.0.5
    Updating unicode-normalization v0.1.12 -> v0.1.22
    Removing unicode-segmentation v1.6.0
      Adding unicode-width v0.1.10
    Removing unicode-xid v0.2.0
    Updating url v2.1.1 -> v2.3.1
    Updating vcpkg v0.2.8 -> v0.2.15
    Updating version_check v0.9.1 -> v0.9.4
      Adding wasi v0.10.0+wasi-snapshot-preview1
    Updating wasm-bindgen v0.2.59 -> v0.2.83
    Updating wasm-bindgen-backend v0.2.59 -> v0.2.83
    Updating wasm-bindgen-futures v0.4.9 -> v0.4.33
    Updating wasm-bindgen-macro v0.2.59 -> v0.2.83
    Updating wasm-bindgen-macro-support v0.2.59 -> v0.2.83
    Updating wasm-bindgen-shared v0.2.59 -> v0.2.83
    Updating web-sys v0.3.36 -> v0.3.60
    Updating winapi v0.3.8 -> v0.3.9
    Updating winapi-util v0.1.3 -> v0.1.5
      Adding windows-sys v0.36.1
      Adding windows_aarch64_msvc v0.36.1
      Adding windows_i686_gnu v0.36.1
      Adding windows_i686_msvc v0.36.1
      Adding windows_x86_64_gnu v0.36.1
      Adding windows_x86_64_msvc v0.36.1
    Updating winreg v0.6.2 -> v0.7.0
@yvt yvt changed the title Bump deps (mitigate RUSTSEC-2020-0078 and maybe others?), determine the new MSRV Bump deps, determine the new MSRV Oct 22, 2022
@sysr-q sysr-q mentioned this pull request Nov 9, 2022
@nrdxp
Copy link
Owner

nrdxp commented Sep 19, 2023

closing, as this has already been done since I took over the repo

@nrdxp nrdxp closed this Sep 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants