[WIP]update to version 4.5.2-libwebsockets-AtomGit

A.gitattributes+1-0

	@@ -0,0 +1 @@
		1	+*.gz filter=lfs diff=lfs merge=lfs -text

A.lfsconfig+2-0

@@ -0,0 +1,2 @@
	1	+[lfs]
	2	+ url = https://artlfs.openeuler.openatom.cn/src-openEuler/libwebsockets

D0003-client-hs-fix-segmentation-fault.patch+0-28

	@@ -1,28 +0,0 @@
1	-From fdde9119f72f315a453d30c3f7448cbccc69fa8a Mon Sep 17 00:00:00 2001
2	-From: zzblydia <13098426+zzblydia@users.noreply.github.com>
3	-Date: Mon, 24 Jun 2024 15:11:17 +0800
4	-Subject: [PATCH] client hs: fix segmentation fault
5	-
6	-reason:sync with upstream
7	-Conflict:NA
8	-Reference:https://github.com/warmcat/libwebsockets/pull/3171
9	----
10	- lib/roles/http/client/client-http.c \| 2 ++
11	- 1 file changed, 2 insertions(+)
12	-
13	-diff --git a/lib/roles/http/client/client-http.c b/lib/roles/http/client/client-http.c
14	-index 57dda701..05532f29 100644
15	---- a/lib/roles/http/client/client-http.c
16	-+++ b/lib/roles/http/client/client-http.c
17	-@@ -1641,6 +1641,8 @@ lws_generate_client_handshake(struct lws wsi, char pkt)
18	- // if (!wsi->client_pipeline)
19	- // conn1 = "close, ";
20	- p = lws_generate_client_ws_handshake(wsi, p, conn1);
21	-+ if (!p)
22	-+ return NULL;
23	- } else
24	- #endif
25	- {
26	---
27	-2.43.0
28	-

R0004-fix-the-politically-sensitive-words.patch→0003-fix-the-politically-sensitive-words.patch+0-0

File renamed without changes.

D0005-backport-CVE-2025-11677.patch+0-156

	@@ -1,156 +0,0 @@
1	-From 2f082ec31261f556969160143ba94875d783971a Mon Sep 17 00:00:00 2001
2	-From: Nozomi Network Labs <labs-advisory@nozominetworks.com>
3	-Date: Wed, 24 Sep 2025 12:46:24 +0100
4	-Subject: [PATCH] NN-2025-0102: UAF depending on upgrade allowed
5	-
6	-This document contains sensitive information collected during our
7	-security research activities related with the Libwebsockets library
8	-maintained by Andy Green (warmcat).
9	-
10	-+-------------------------------------------------------------------------------------------------------+
11	-\| Report information \|
12	-+:===================================:+:===============================================================:+
13	-\| Vendor \| warmcat \|
14	-+-------------------------------------+-----------------------------------------------------------------+
15	-\| Vendor URL \| https://libwebsockets.org/git/libwebsockets \|
16	-+-------------------------------------+-----------------------------------------------------------------+
17	-\| Affected component \| libwebsockets \|
18	-+-------------------------------------+-----------------------------------------------------------------+
19	-\| Affected version \| 4.4 \|
20	-+-------------------------------------+-----------------------------------------------------------------+
21	-\| Vulnerability \| CWE-416: Use After Free \|
22	-+-------------------------------------+-----------------------------------------------------------------+
23	-\| Proposed CVSS v3.1 Base Score \| 6.0 \|
24	-+-------------------------------------+-----------------------------------------------------------------+
25	-\| Proposed CVSS v3.1 Vector \| CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N \|
26	-+-------------------------------------+-----------------------------------------------------------------+
27	-
28	-+-----------------------------------------------------------------------------+
29	-\| Security Researcher(s) \|
30	-+:===================================:+:=====================================:+
31	-\| Name \| Email address \|
32	-+-------------------------------------+---------------------------------------+
33	-\| Raffaele Bova \| labs-advisory@nozominetworks.com \|
34	-+-------------------------------------+---------------------------------------+
35	-
36	-Libwebsockes is a C library that provides client and server
37	-implementation for various protocols (e.g., HTTP, websockets, MQTT) and
38	-more.
39	-
40	-Nozomi Networks Lab discovered a "CWE-416: Use After Free" in the latest
41	-software version of libwebsockets, specifically in the WebSocket server
42	-implementation.
43	-
44	-Depending on the use of the API, the vulnerability may allow an attacker
45	-to read or write data, that could cause a loss of integrity or
46	-availability.
47	-
48	-The issue is caused by the `lws_handshake_protocol` function, specifically
49	-when the upgrade header is not valid, the function calls
50	-`lws_http_transaction_completed`, which frees some of the data in the wsi
51	-structure, then it calls `user_callback_handle_rxflow` passing the up
52	-pointer and uses it on following strcasecmp calls.
53	-
54	-From our understanding, for this vulnerability to have a meaningful
55	-impact, a user that implements the Websocket server, must provide a user
56	-callback function which is going to handle
57	-`LWS_CALLBACK_HTTP_CONFIRM_UPGRADE`, while ignoring the length and doing
58	-operations on the up pointer.
59	-
60	-It is possible to compile the minimal websocket server using address
61	-sanitizer, to quickly verify the use after free.
62	-
63	-From our understanding of the code, if the upgrade header does not match
64	-the intended contents, then the code after the if statement when
65	-`lws_http_transaction_completed` is called, should not be executed, thus
66	-simply enclosing all that code in the else branch solves the issue.
67	----
68	- lib/roles/http/server/server.c \| 58 +++++++++++++++++-----------------
69	- 1 file changed, 29 insertions(+), 29 deletions(-)
70	-
71	-diff --git a/lib/roles/http/server/server.c b/lib/roles/http/server/server.c
72	-index 6b132a4..e6d714e 100644
73	---- a/lib/roles/http/server/server.c
74	-+++ b/lib/roles/http/server/server.c
75	-@@ -2375,49 +2375,49 @@ raw_transition:
76	- HTTP_STATUS_FORBIDDEN, NULL) \|\|
77	- lws_http_transaction_completed(wsi))
78	- goto bail_nuke_ah;
79	-- }
80	--
81	-- n = user_callback_handle_rxflow(wsi->a.protocol->callback,
82	-- wsi, LWS_CALLBACK_HTTP_CONFIRM_UPGRADE,
83	-- wsi->user_space, (char *)up, 0);
84	-+ } else {
85	-+ n = user_callback_handle_rxflow(wsi->a.protocol->callback,
86	-+ wsi, LWS_CALLBACK_HTTP_CONFIRM_UPGRADE,
87	-+ wsi->user_space, (char *)up, 0);
88	-
89	-- /* just hang up? */
90	-+ /* just hang up? */
91	-
92	-- if (n < 0)
93	-- goto bail_nuke_ah;
94	-+ if (n < 0)
95	-+ goto bail_nuke_ah;
96	-
97	-- /* callback returned headers already, do t_c? */
98	-+ /* callback returned headers already, do t_c? */
99	-
100	-- if (n > 0) {
101	-- if (lws_http_transaction_completed(wsi))
102	-+ if (n > 0) {
103	-+ if (lws_http_transaction_completed(wsi))
104	- goto bail_nuke_ah;
105	-
106	-- /* continue on */
107	-+ /* continue on */
108	-
109	-- return 0;
110	-- }
111	-+ return 0;
112	-+ }
113	-
114	-- /* callback said 0, it was allowed */
115	-+ /* callback said 0, it was allowed */
116	-
117	-- if (wsi->a.vhost->options &
118	-- LWS_SERVER_OPTION_VHOST_UPG_STRICT_HOST_CHECK &&
119	-- lws_confirm_host_header(wsi))
120	-- goto bail_nuke_ah;
121	-+ if (wsi->a.vhost->options &
122	-+ LWS_SERVER_OPTION_VHOST_UPG_STRICT_HOST_CHECK &&
123	-+ lws_confirm_host_header(wsi))
124	-+ goto bail_nuke_ah;
125	-
126	-- if (!strcasecmp(up, "websocket")) {
127	-+ if (!strcasecmp(up, "websocket")) {
128	- #if defined(LWS_ROLE_WS)
129	-- lws_metrics_tag_wsi_add(wsi, "upg", "ws");
130	-- lwsl_info("Upgrade to ws\n");
131	-- goto upgrade_ws;
132	-+ lws_metrics_tag_wsi_add(wsi, "upg", "ws");
133	-+ lwsl_info("Upgrade to ws\n");
134	-+ goto upgrade_ws;
135	- #endif
136	-- }
137	-+ }
138	- #if defined(LWS_WITH_HTTP2)
139	-- if (!strcasecmp(up, "h2c")) {
140	-- lws_metrics_tag_wsi_add(wsi, "upg", "h2c");
141	-- lwsl_info("Upgrade to h2c\n");
142	-- goto upgrade_h2c;
143	-- }
144	-+ if (!strcasecmp(up, "h2c")) {
145	-+ lws_metrics_tag_wsi_add(wsi, "upg", "h2c");
146	-+ lwsl_info("Upgrade to h2c\n");
147	-+ goto upgrade_h2c;
148	-+ }
149	- #endif
150	-+ }
151	- }
152	-
153	- /* no upgrade ack... he remained as HTTP */
154	---
155	-2.43.0
156	-

D0006-backport-CVE-2025-11678.patch+0-123

	@@ -1,123 +0,0 @@
1	-From 2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a Mon Sep 17 00:00:00 2001
2	-From: Nozomi Network Labs <labs-advisory@nozominetworks.com>
3	-Date: Wed, 24 Sep 2025 13:30:38 +0100
4	-Subject: [PATCH] NN-2025-0103: ADNS crafted response overflow
5	-
6	-This document contains sensitive information collected during our
7	-security research activities related with the Libwebsockets library made
8	-by Andy Green (warmcat).
9	-
10	-+-------------------------------------------------------------------------------------------------------+
11	-\| Report information \|
12	-+:===================================:+:===============================================================:+
13	-\| Vendor \| warmcat \|
14	-+-------------------------------------+-----------------------------------------------------------------+
15	-\| Vendor URL \| https://libwebsockets.org/git/libwebsockets \|
16	-+-------------------------------------+-----------------------------------------------------------------+
17	-\| Affected component \| Ecostruxure Automation Expert \|
18	-+-------------------------------------+-----------------------------------------------------------------+
19	-\| Affected version \| 4.4 \|
20	-+-------------------------------------+-----------------------------------------------------------------+
21	-\| Vulnerability \| CWE-121: Stack-based Buffer Overflow \|
22	-+-------------------------------------+-----------------------------------------------------------------+
23	-\| Proposed CVSS v3.1 Base Score \| 7.5 \|
24	-+-------------------------------------+-----------------------------------------------------------------+
25	-\| Proposed CVSS v3.1 Vector \| CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N \|
26	-+-------------------------------------+-----------------------------------------------------------------+
27	-
28	-+-----------------------------------------------------------------------------+
29	-\| Security Researcher(s) \|
30	-+:===================================:+:=====================================:+
31	-\| Name \| Email address \|
32	-+-------------------------------------+---------------------------------------+
33	-\| Raffaele Bova \| labs-advisory@nozominetworks.com \|
34	-+-------------------------------------+---------------------------------------+
35	-
36	-\
37	-
38	-Libwebsockes is a C library that provides client and server
39	-implementation for various protocols (e.g., HTTP, websockets, MQTT) and
40	-more.
41	-
42	-Nozomi Networks Lab discovered a "CWE-121: Stack-based Buffer Overflow"
43	-in the latest software version of libwebsockets, specifically in the
44	-async-dns component.
45	-
46	-The vulnerability allows an attacker that can inspect DNS requests made
47	-by the victim (e.g. being in the same wireless network) to forge a DNS
48	-response packet that overflows the stack and may lead to arbitrary code
49	-execution (depending on the platform and compiler options).
50	-
51	-The issue resides in `lws_adns_parse_label` function in
52	-`lib/system/async-dns/async-dns-parse.c`; this function iteratively parses
53	-a label however it does not correctly check the number of bytes written
54	-in the destination buffer.
55	-
56	-Specifically, the size of the dest output buffer is specified in the `dl`
57	-argument, however during the read of each substring of the label only
58	-the length of the current substring of the label is accounted for not
59	-overflowing the destination buffer, but previous reads are not accounted
60	-for.
61	-
62	-This means that a label of arbitrary size and content can be supplied
63	-and is copied onto the stack, however it must be split into substrings
64	-of size less than `dl`.
65	-
66	-To trigger the vulnerability an attacker must be able to sniff the DNS
67	-request packet to send a response with a matching identifier, otherwise
68	-the implantation correctly ignores the response.
69	-
70	-We have provided a harness for testing, for ease of use copy the harness
71	-in a subdirectory, for example in minimal-examples-lowlevel/api-tests/,
72	-and build it
73	-
74	-```
75	-cmake -B build -DLWS_WITH_SYS_ASYNC_DNS=1 -DLWS_WITH_SSL=0
76	--DCMAKE_C_FLAGS="-fsanitize=address" . && make -C build lws-test-async-dns
77	-```
78	-
79	-Then it can be run `./build/bin/lws-test-async-dns < poc_stackbof`
80	-
81	-![Address sanitizer report of stack buffer overflow](./NN-2025-0103_image.png)
82	-
83	-We suggest keeping track of the number of bytes currently written on the
84	-dest buffer, this could be done by saving the original dest pointer,
85	-decrementing dl on each substring memcpy, or using an auxiliary
86	-variable.
87	----
88	- lib/system/async-dns/async-dns-parse.c \| 5 +++--
89	- 1 file changed, 3 insertions(+), 2 deletions(-)
90	-
91	-diff --git a/lib/system/async-dns/async-dns-parse.c b/lib/system/async-dns/async-dns-parse.c
92	-index bdfe205..81743b3 100644
93	---- a/lib/system/async-dns/async-dns-parse.c
94	-+++ b/lib/system/async-dns/async-dns-parse.c
95	-@@ -35,7 +35,7 @@ lws_adns_parse_label(const uint8_t pkt, int len, const uint8_t ls, int budget,
96	- const uint8_t e = pkt + len, ols = ls;
97	- char pointer = 0, first = 1;
98	- uint8_t ll;
99	-- int n;
100	-+ int n, readsize = 0;
101	-
102	- if (budget < 1)
103	- return 0;
104	-@@ -88,7 +88,7 @@ again1:
105	- return -1;
106	- }
107	-
108	-- if ((unsigned int)ll + 2 > dl) {
109	-+ if ((unsigned int)(ll + 2 + readsize) > dl) {
110	- lwsl_notice("%s: qname too large\n", __func__);
111	-
112	- return -1;
113	-@@ -101,6 +101,7 @@ again1:
114	- (*dest)[ll + 1] = '\0';
115	- *dest += ll + 1;
116	- ls += ll;
117	-+ readsize += ll + 1;
118	-
119	- if (pointer) {
120	- if (*ls)
121	---
122	-2.43.0
123	-

Mlibwebsockets.spec+30-28

	@@ -1,6 +1,6 @@
1	Name: libwebsockets	1	Name: libwebsockets
2	-Version: 4.3.3	2	+Version: 4.5.2
3	-Release: 5	3	+Release: 1
4	Summary: A lightweight C library for Websockets	4	Summary: A lightweight C library for Websockets
5	License: LGPLv2 and Public Domain and BSD and MIT and zlib	5	License: LGPLv2 and Public Domain and BSD and MIT and zlib
6	URL: https://libwebsockets.org	6	URL: https://libwebsockets.org
	@@ -8,12 +8,13 @@ Source0: https://github.com/warmcat/libwebsockets/archive/v%{version}.tar
8		8
9	Patch9001: 0001-add-secure-compile-option-in-Makefile.patch	9	Patch9001: 0001-add-secure-compile-option-in-Makefile.patch
10	Patch9002: 0002-solve-the-BEP-problem.patch	10	Patch9002: 0002-solve-the-BEP-problem.patch
11	-Patch9003: 0003-client-hs-fix-segmentation-fault.patch	11	+Patch9003: 0003-fix-the-politically-sensitive-words.patch
12	-Patch9004: 0004-fix-the-politically-sensitive-words.patch
13	-Patch9005: 0005-backport-CVE-2025-11677.patch
14	-Patch9006: 0006-backport-CVE-2025-11678.patch
15		12
16	-BuildRequires: cmake openssl-devel zlib-devel libev-devel gcc gcc-c++	13	+BuildRequires: cmake
		14	+BuildRequires: gcc gcc-c++
		15	+BuildRequires: openssl-devel
		16	+BuildRequires: libev-devel
		17	+BuildRequires: glib2-devel
17		18
18	Provides: bundled(sha1-hollerbach) bundled(base64-decode) bundled(ssl-http2)	19	Provides: bundled(sha1-hollerbach) bundled(base64-decode) bundled(ssl-http2)
19		20
	@@ -45,34 +46,34 @@ This package contains the header files needed for developing
45	-D LWS_WITH_SOCKS5=ON \	46	-D LWS_WITH_SOCKS5=ON \
46	-D LWS_WITH_RANGES=ON \	47	-D LWS_WITH_RANGES=ON \
47	-D LWS_WITH_ACME=ON \	48	-D LWS_WITH_ACME=ON \
48	- -D LWS_WITH_LIBUV=OFF \	49	+ -D LWS_WITH_GLIB=ON \
49	- -D LWS_WITH_LIBEV=OFF \	50	+ -D LWS_BUILD_HASH=no_hash \
50	- -D LWS_WITH_LIBEVENT=OFF \
51	- -D LWS_WITH_FTS=ON \
52	- -D LWS_WITH_THREADPOOL=ON \
53	- -D LWS_UNIX_SOCK=ON \
54	- -D LWS_WITH_HTTP_PROXY=ON \
55	- -D LWS_WITH_DISKCACHE=ON \
56	- -D LWS_WITH_LWSAC=ON \
57	-D LWS_LINK_TESTAPPS_DYNAMIC=ON \	51	-D LWS_LINK_TESTAPPS_DYNAMIC=ON \
58	- -D LWS_WITHOUT_BUILTIN_GETIFADDRS=ON \	52	+ -D LWS_UNIX_SOCK=ON \
59	-D LWS_USE_BUNDLED_ZLIB=OFF \	53	-D LWS_USE_BUNDLED_ZLIB=OFF \
60	- -D LWS_WITHOUT_BUILTIN_SHA1=ON \	54	+ -D LWS_WITH_DISKCACHE=ON \
		55	+ -D LWS_WITH_EXTERNAL_POLL=ON \
		56	+ -D LWS_WITH_FTS=ON \
		57	+ -D LWS_WITH_HTTP_PROXY=ON \
		58	+ -D LWS_WITH_LIBEV=ON \
		59	+ -D LWS_WITH_LIBEVENT=OFF \
		60	+ -D LWS_WITH_LWSAC=ON \
61	-D LWS_WITH_STATIC=OFF \	61	-D LWS_WITH_STATIC=OFF \
		62	+ -D LWS_WITH_THREADPOOL=ON \
		63	+ -D LWS_WITHOUT_BUILTIN_GETIFADDRS=ON \
		64	+ -D LWS_WITHOUT_BUILTIN_SHA1=ON \
62	-D LWS_WITHOUT_CLIENT=OFF \	65	-D LWS_WITHOUT_CLIENT=OFF \
63	-D LWS_WITHOUT_SERVER=OFF \	66	-D LWS_WITHOUT_SERVER=OFF \
64	- -D LWS_WITHOUT_TESTAPPS=OFF \
65	- -D LWS_WITHOUT_TEST_SERVER=ON \
66	- -D LWS_WITHOUT_TEST_SERVER_EXTPOLL=ON \
67	- -D LWS_WITHOUT_TEST_PING=ON \
68	-D LWS_WITHOUT_TEST_CLIENT=ON \	67	-D LWS_WITHOUT_TEST_CLIENT=ON \
69	- -D LWS_WITHOUT_EXTENSIONS=OFF	68	+ -D LWS_WITHOUT_TEST_PING=ON \
70	-	69	+ -D LWS_WITHOUT_TEST_SERVER_EXTPOLL=ON \
		70	+ -D LWS_WITHOUT_TEST_SERVER=OFF \
		71	+ -D LWS_WITHOUT_TESTAPPS=ON \
		72	+%{nil}
71	%cmake_build	73	%cmake_build
72		74
73	%install	75	%install
74	%cmake_install	76	%cmake_install
75	-find %{buildroot} -name '*.cmake' -exec rm -f {} ';'
76	find %{buildroot} -name '*_static.pc' -exec rm -f {} ';'	77	find %{buildroot} -name '*_static.pc' -exec rm -f {} ';'
77		78
78	%files	79	%files
	@@ -83,15 +84,16 @@ find %{buildroot} -name '*_static.pc' -exec rm -f {} ';'
83	%{_includedir}/*.h	84	%{_includedir}/*.h
84	%{_includedir}/%{name}	85	%{_includedir}/%{name}
85	%{_libdir}/*.so	86	%{_libdir}/*.so
		87	+%{_libdir}/cmake/libwebsockets
86	%{_libdir}/pkgconfig/*.pc	88	%{_libdir}/pkgconfig/*.pc
87	-%{_bindir}/%{name}-test-*
88	-%{_datadir}/%{name}-test-server/
89	-
90		89
91	%files help	90	%files help
92	%doc changelog README.md READMEs/	91	%doc changelog README.md READMEs/
93		92
94	%changelog	93	%changelog
		94	+* Wed Mar 04 2026 Funda Wang <fundawang@yeah.net> - 4.5.2-1
		95	+- update to 4.5.2
		96	+
95	* Wed Oct 22 2025 dongyuzhen <dongyuzhen@h-partners.com> - 4.3.3-5	97	* Wed Oct 22 2025 dongyuzhen <dongyuzhen@h-partners.com> - 4.3.3-5
96	- Type:bugfix	98	- Type:bugfix
97	- ID:NA	99	- ID:NA

Mlibwebsockets.yaml+1-1

	@@ -1,4 +1,4 @@
1	version_control: git	1	version_control: git
2	src_repo: https://libwebsockets.org/repo/libwebsockets	2	src_repo: https://libwebsockets.org/repo/libwebsockets
3	tag_prefix: ^v	3	tag_prefix: ^v
4	-seperator: .	4	+separator: .

Dv4.3.3.tar.gz+0-0

Binary files do not support preview

Av4.5.2.tar.gz+3-0

@@ -0,0 +1,3 @@
	1	+version https://git-lfs.github.com/spec/v1
	2	+oid sha256:04244efb7a6438c8c6bfc79b21214db5950f72c9cf57e980af57ca321aae87b2
	3	+size 20158648