deps: update c-ares to 1.34.9 · nodejs/node@1e39cd5 · GitHub
Skip to content

Commit 1e39cd5

Browse files
nodejs-github-botaduh95
nodejs-github-bot
authored and
aduh95
committed
deps: update c-ares to 1.34.9
PR-URL: #66868 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com>
1 parent 9dc4bb5 commit 1e39cd5

57 files changed

Lines changed: 1939 additions & 227 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/cares/CMakeLists.txt‎

Lines changed: 14 additions & 2 deletions

‎deps/cares/RELEASE-NOTES.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,104 @@
1+
## c-ares version 1.34.9 - October 19 2026
2+
3+
This is a security release.
4+
5+
Security:
6+
* Memory corruption when an application cancels its lookups after a
7+
connection failure. Please see
8+
https://github.com/c-ares/c-ares/security/advisories/GHSA-wpr3-8q3r-4q8c
9+
* A DNS reply that arrived from a different server than the one queried could
10+
be accepted. Please see
11+
https://github.com/c-ares/c-ares/security/advisories/GHSA-fqh5-3x7m-wp44
12+
* Use-after-free of a lookup after shutting down a failed connection. Please
13+
see https://github.com/c-ares/c-ares/security/advisories/GHSA-97vq-4mxv-7vhm
14+
* Use-after-free when an application cancels lookups from a callback, or shuts
15+
a channel down. Please see
16+
https://github.com/c-ares/c-ares/security/advisories/GHSA-rf6g-ww74-97qh
17+
* Use-after-free of a connection after the socket-state callback returns.
18+
Please see
19+
https://github.com/c-ares/c-ares/security/advisories/GHSA-mw23-pfg6-2x9r
20+
* Use-after-free when an application cancels lookups from a server-state
21+
callback. Please see
22+
https://github.com/c-ares/c-ares/security/advisories/GHSA-v33j-65h4-4ch8
23+
* Use-after-free of a server record when an application changes its DNS
24+
servers from a callback. Please see
25+
https://github.com/c-ares/c-ares/security/advisories/GHSA-pj7p-v3cw-hq66
26+
* Use-after-free of a cached DNS answer while the application is still reading
27+
it. Please see
28+
https://github.com/c-ares/c-ares/security/advisories/GHSA-grv7-fq5q-9vfc
29+
* Buffer overflow when `ares_dup()` or `ares_save_options()` runs while
30+
another thread changes the servers. Please see
31+
https://github.com/c-ares/c-ares/security/advisories/GHSA-ph6c-3cvx-mq6v
32+
* Uninitialized memory returned for a numeric IPv6 name with a prefix length.
33+
Please see
34+
https://github.com/c-ares/c-ares/security/advisories/GHSA-cfcv-8v2j-qj6r
35+
* The query cache could return an answer obtained using different EDNS
36+
options. Please see
37+
https://github.com/c-ares/c-ares/security/advisories/GHSA-wrgc-prmw-27xh
38+
39+
Changes:
40+
* Answers served from the query cache now report their remaining TTL rather
41+
than the TTL originally received.
42+
* `ares_inet_pton()` rejects a "/bits" prefix length and returns 0, rather
43+
than -1, for any input it cannot parse.
44+
* UDP replies must now come from the server's port as well as its address.
45+
Custom `arecvfrom` socket functions (`ares_set_socket_functions_ex()` or
46+
`ares_set_socket_functions()`) must fill in the full source address,
47+
including the port. For compatibility, a reported port of 0 checks only the
48+
address, but such implementations are insecure and should be fixed.
49+
[PR #1370](https://github.com/c-ares/c-ares/pull/1370)
50+
* Document that socket functions and socket, configure and pending-write
51+
callbacks must not call c-ares functions on the same channel.
52+
[PR #1360](https://github.com/c-ares/c-ares/pull/1360)
53+
54+
Bugfixes:
55+
* `ares_dup()`: don't leave the new channel bound to the source channel.
56+
[PR #1333](https://github.com/c-ares/c-ares/pull/1333)
57+
* `ares_init_options()`: don't report the default query cache as a caller-set
58+
option. [PR #1354](https://github.com/c-ares/c-ares/pull/1354)
59+
* Clamp DNS record TTLs to the signed int range used by public APIs.
60+
[PR #1313](https://github.com/c-ares/c-ares/pull/1313)
61+
* `ares_dns_write()`: reject messages larger than 64KB.
62+
[PR #1314](https://github.com/c-ares/c-ares/pull/1314)
63+
* `ares_dns_parse()`: accept legacy compressed RDATA names.
64+
[PR #1326](https://github.com/c-ares/c-ares/pull/1326)
65+
* `ares_parse_a_reply()`/`ares_parse_aaaa_reply()`: ignore a negative
66+
`*naddrttls`. [PR #1302](https://github.com/c-ares/c-ares/pull/1302)
67+
* select event backend: refuse descriptors >= `FD_SETSIZE` instead of
68+
overflowing `fd_set`. [PR #1312](https://github.com/c-ares/c-ares/pull/1312)
69+
* Strip inline comments from resolv.conf values.
70+
[PR #1276](https://github.com/c-ares/c-ares/pull/1276)
71+
* Ignore absurd resolv.conf retry/attempts values.
72+
[PR #1315](https://github.com/c-ares/c-ares/pull/1315)
73+
* Zero-initialize the server config when parsing nameserver URIs.
74+
[PR #1325](https://github.com/c-ares/c-ares/pull/1325)
75+
* URI parsing: roll back the ':' probe when it lands past the '@'.
76+
[PR #1265](https://github.com/c-ares/c-ares/pull/1265)
77+
* Do not assume `gethostname()` NUL-terminates its buffer.
78+
[PR #1269](https://github.com/c-ares/c-ares/pull/1269)
79+
* Combine the hash table seed with XOR instead of OR.
80+
[PR #1330](https://github.com/c-ares/c-ares/pull/1330)
81+
* Turn off stdio buffering when loading a file.
82+
[PR #939](https://github.com/c-ares/c-ares/pull/939)
83+
* Guard `pipe2()` on Apple platforms to prevent unguarded availability
84+
warnings. [PR #1328](https://github.com/c-ares/c-ares/pull/1328)
85+
86+
Thanks go to these friendly people for their efforts and contributions for this
87+
release:
88+
89+
* (@ahillspace)
90+
* (@anon5376)
91+
* Brad House (@bradh352)
92+
* Nikolaos Chatzikonstantinou (@createyourpersonalaccount)
93+
* Dev (@devdgna)
94+
* (@evilgensec)
95+
* Ilias (@iliasabk)
96+
* (@jdymitarai)
97+
* (@jmestwa-coder)
98+
* Manohar Paturi (@ManoharPaturi)
99+
* (@mardgez13)
100+
101+
1102
## c-ares version 1.34.8 - July 7 2026
2103

3104
This is a bugfix release.

‎deps/cares/aminclude_static.am‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11

22
# aminclude_static.am generated automatically by Autoconf
3-
# from AX_AM_MACROS_STATIC on Tue Jul 7 16:14:13 UTC 2026
3+
# from AX_AM_MACROS_STATIC on Tue Oct 20 02:31:56 UTC 2026
44

55

66
# Code coverage

‎deps/cares/configure‎

Lines changed: 106 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#! /bin/sh
22
# Guess values for system-dependent variables and create Makefiles.
3-
# Generated by GNU Autoconf 2.71 for c-ares 1.34.8.
3+
# Generated by GNU Autoconf 2.71 for c-ares 1.34.9.
44
#
55
# Report bugs to <c-ares mailing list: http://lists.haxx.se/listinfo/c-ares>.
66
#
@@ -621,8 +621,8 @@ MAKEFLAGS=
621621
# Identity of this package.
622622
PACKAGE_NAME='c-ares'
623623
PACKAGE_TARNAME='c-ares'
624-
PACKAGE_VERSION='1.34.8'
625-
PACKAGE_STRING='c-ares 1.34.8'
624+
PACKAGE_VERSION='1.34.9'
625+
PACKAGE_STRING='c-ares 1.34.9'
626626
PACKAGE_BUGREPORT='c-ares mailing list: http://lists.haxx.se/listinfo/c-ares'
627627
PACKAGE_URL=''
628628

@@ -1430,7 +1430,7 @@ if test "$ac_init_help" = "long"; then
14301430
# Omit some internal or obsolete options to make the list less imposing.
14311431
# This message is too long to be a string in the A/UX 3.1 sh.
14321432
cat <<_ACEOF
1433-
\`configure' configures c-ares 1.34.8 to adapt to many kinds of systems.
1433+
\`configure' configures c-ares 1.34.9 to adapt to many kinds of systems.
14341434

14351435
Usage: $0 [OPTION]... [VAR=VALUE]...
14361436

@@ -1501,7 +1501,7 @@ fi
15011501

15021502
if test -n "$ac_init_help"; then
15031503
case $ac_init_help in
1504-
short | recursive ) echo "Configuration of c-ares 1.34.8:";;
1504+
short | recursive ) echo "Configuration of c-ares 1.34.9:";;
15051505
esac
15061506
cat <<\_ACEOF
15071507

@@ -1647,7 +1647,7 @@ fi
16471647
test -n "$ac_init_help" && exit $ac_status
16481648
if $ac_init_version; then
16491649
cat <<\_ACEOF
1650-
c-ares configure 1.34.8
1650+
c-ares configure 1.34.9
16511651
generated by GNU Autoconf 2.71
16521652

16531653
Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2271,7 +2271,7 @@ cat >config.log <<_ACEOF
22712271
This file contains any messages produced by compilers while
22722272
running configure, to aid debugging if configure makes a mistake.
22732273

2274-
It was created by c-ares $as_me 1.34.8, which was
2274+
It was created by c-ares $as_me 1.34.9, which was
22752275
generated by GNU Autoconf 2.71. Invocation command line was
22762276

22772277
$ $0$ac_configure_args_raw
@@ -3245,7 +3245,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
32453245

32463246

32473247

3248-
CARES_VERSION_INFO="21:7:19"
3248+
CARES_VERSION_INFO="21:8:19"
32493249

32503250

32513251

@@ -6818,7 +6818,7 @@ fi
68186818

68196819
# Define the identity of the package.
68206820
PACKAGE='c-ares'
6821-
VERSION='1.34.8'
6821+
VERSION='1.34.9'
68226822

68236823

68246824
printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -23381,6 +23381,95 @@ fi
2338123381

2338223382

2338323383

23384+
if test "x$host_vendor" = "xapple"
23385+
then :
23386+
23387+
cares_save_cflags="$CFLAGS"
23388+
23389+
23390+
23391+
23392+
for flag in -Werror=partial-availability; do
23393+
as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
23394+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler accepts $flag" >&5
23395+
printf %s "checking whether the C compiler accepts $flag... " >&6; }
23396+
if eval test \${$as_CACHEVAR+y}
23397+
then :
23398+
printf %s "(cached) " >&6
23399+
else $as_nop
23400+
23401+
ax_check_save_flags=$CFLAGS
23402+
if test x"$GCC" = xyes ; then
23403+
add_gnu_werror="-Werror"
23404+
fi
23405+
CFLAGS="$CFLAGS $flag $add_gnu_werror"
23406+
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
23407+
/* end confdefs.h. */
23408+
23409+
int
23410+
main (void)
23411+
{
23412+
23413+
;
23414+
return 0;
23415+
}
23416+
_ACEOF
23417+
if ac_fn_c_try_compile "$LINENO"
23418+
then :
23419+
eval "$as_CACHEVAR=yes"
23420+
else $as_nop
23421+
eval "$as_CACHEVAR=no"
23422+
fi
23423+
rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
23424+
CFLAGS=$ax_check_save_flags
23425+
fi
23426+
eval ac_res=\$$as_CACHEVAR
23427+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
23428+
printf "%s\n" "$ac_res" >&6; }
23429+
if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
23430+
then :
23431+
23432+
if test ${CFLAGS+y}
23433+
then :
23434+
23435+
case " $CFLAGS " in #(
23436+
*" $flag "*) :
23437+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
23438+
(: CFLAGS already contains $flag) 2>&5
23439+
ac_status=$?
23440+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
23441+
test $ac_status = 0; } ;; #(
23442+
*) :
23443+
23444+
as_fn_append CFLAGS " $flag"
23445+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
23446+
(: CFLAGS="$CFLAGS") 2>&5
23447+
ac_status=$?
23448+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
23449+
test $ac_status = 0; }
23450+
;;
23451+
esac
23452+
23453+
else $as_nop
23454+
23455+
CFLAGS=$flag
23456+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
23457+
(: CFLAGS="$CFLAGS") 2>&5
23458+
ac_status=$?
23459+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
23460+
test $ac_status = 0; }
23461+
23462+
fi
23463+
23464+
else $as_nop
23465+
:
23466+
fi
23467+
23468+
done
23469+
23470+
23471+
fi
23472+
2338423473
ac_fn_check_decl "$LINENO" "strnlen" "ac_cv_have_decl_strnlen" "$cares_all_includes
2338523474
" "$ac_c_undeclared_builtin_options" "CFLAGS"
2338623475
if test "x$ac_cv_have_decl_strnlen" = xyes
@@ -23781,6 +23870,12 @@ then :
2378123870
printf "%s\n" "#define HAVE___SYSTEM_PROPERTY_GET 1" >>confdefs.h
2378223871

2378323872
fi
23873+
if test "x$host_vendor" = "xapple"
23874+
then :
23875+
23876+
CFLAGS="$cares_save_cflags"
23877+
23878+
fi
2378423879

2378523880

2378623881

@@ -28238,7 +28333,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
2823828333
# report actual input values of CONFIG_FILES etc. instead of their
2823928334
# values after options handling.
2824028335
ac_log="
28241-
This file was extended by c-ares $as_me 1.34.8, which was
28336+
This file was extended by c-ares $as_me 1.34.9, which was
2824228337
generated by GNU Autoconf 2.71. Invocation command line was
2824328338

2824428339
CONFIG_FILES = $CONFIG_FILES
@@ -28306,7 +28401,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
2830628401
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
2830728402
ac_cs_config='$ac_cs_config_escaped'
2830828403
ac_cs_version="\\
28309-
c-ares config.status 1.34.8
28404+
c-ares config.status 1.34.9
2831028405
configured by $0, generated by GNU Autoconf 2.71,
2831128406
with options \\"\$ac_cs_config\\"
2831228407

‎deps/cares/configure.ac‎

Lines changed: 13 additions & 2 deletions

0 commit comments

Comments
 (0)