staging/svanheule/package/utils, branch main

fritz-tools: fix out-of-bounds memset in TFFS segment expansion

2026-06-15T22:51:53Z

When growing the segment array in find_entry(), the memset() that zeroes the newly allocated slots computed the destination with redundant sizeof scaling: memset(segments + (num_segments * sizeof(struct tffs_entry_segment)), ...) segments is a typed pointer, so pointer arithmetic already scales by the element size. Multiplying the offset by sizeof again advances the destination by num_segments * sizeof^2 bytes, landing far outside the realloc()'d buffer and zeroing unrelated heap memory whenever a TFFS entry spans multiple segments that require array expansion. Drop the redundant multiplication so the memset targets segments[num_segments]. This is a robustness fix for malformed/corrupt TFFS content; the parser only reads the on-device nand-tffs MTD partition as root, so it is not considered security relevant. Reported-by: @Vasco0x4 Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/openwrt/pull/23763 Signed-off-by: Hauke Mehrtens

busybox: fix signal handling in non-interactive envirement

2026-06-14T09:51:50Z

fixes https://github.com/openwrt/openwrt/issues/23745 upstream had bug bb_got_signal to be never cleared in noninteractive session, this fixes this while waiting for upstream merge. the patch iself is written by Ian Cooper Signed-off-by: Seo Suchan Link: https://github.com/openwrt/openwrt/pull/23787 Signed-off-by: Jonas Jelonek

nvram: use strdup

2026-06-11T08:33:00Z

No need for malloc + strcpy. Signed-off-by: Rosen Penev Link: https://github.com/openwrt/openwrt/pull/22370 Signed-off-by: Jonas Jelonek

nvram: move variable assignment out of if

2026-06-11T08:33:00Z

More readable. Signed-off-by: Rosen Penev Link: https://github.com/openwrt/openwrt/pull/22370 Signed-off-by: Jonas Jelonek

nvram: use flex array

2026-06-11T08:32:59Z

Clarifies that the struct needs to be over allocated. Signed-off-by: Rosen Penev Link: https://github.com/openwrt/openwrt/pull/22370 Signed-off-by: Jonas Jelonek

nilfs-utils: update to 2.3.0

2026-06-03T11:46:09Z

Changelog: https://nilfs.sourceforge.io/download/ChangeLog-utils-v2 Signed-off-by: Pavlo Samko Link: https://github.com/openwrt/openwrt/pull/21932 Signed-off-by: Jonas Jelonek

ucode: update to Git HEAD (2026-06-03)

2026-06-03T11:13:17Z

1ac496a91a30 math: min and max 4c917958038d math: clamp c6404b6af75c math: sign functions 597b17d0edea math: copysign 9747c8bbfa27 math: floor 933b11802060 math: ceil 46581cf13149 math: round 4aee92d5aa89 math: trunc c8f71433a3d6 math: log functions 840aa6e61196 math: Infinity handling note 990558c2a027 math: isinf c3e76e45fdad math: tan 08c6ef98fa2f math: acos, asin, atan 21a0f37d4c7c math: cosh, sinh, tanh 28ec6e4466b5 math: cbrt, hypot fb2fc094875c math: expm1, log1p 1a911dbc72b0 math: jsdoc fixes 7b3b15dc7d25 math: add double/int output toggle flag to floor/ceil/round/trunc 7424c3bd14e0 make: improve make (install) on macOS 965d76557dee types: release previous prototype reference in ucv_prototype_set b702323ec137 uloop: unregister task output fd from uloop before closing it 106b1179765a uloop: clear resource values when releasing callback resources acc70db934fc ubus: clear resource values when releasing connection/object resources 9d7ade9e4c68 ubus: prevent UAF when channel disconnect_cb triggers re-entrant disconnect Signed-off-by: Felix Fietkau

busybox: update to 1.38.0

2026-06-02T18:43:53Z

changelog: https://busybox.net/news.html remove upstreamed patches: 001-fix-non-x86-build.patch 002-upstream-fix.hexdump.patch 003-hexdump-fix-regression-for-unit16-on-big-endian-systems.patch see https://github.com/openwrt/openwrt/pull/17107 for updating config Config refresh: Refresh commands, run after busybox is first built once, slash or lack of slash at end of path matters!: cd package/utils/busybox/config/ ../convert_menuconfig.pl ../../../../build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/busybox-default/busybox-1.38.0 cd .. ./convert_defaults.pl ../../../build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/busybox-default/busybox-1.38.0/.config > Config-defaults.in Manual edits needed after config refresh: * Config-defaults.in: OpenWrt config symbol IPV6 logic applied to BUSYBOX_DEFAULT_FEATURE_IPV6 * Config-defaults.in: OpenWrt config TARGET_bcm53xx logic applied to BUSYBOX_DEFAULT_TRUNCATE (commit 547f1ec) * Config-defaults.in: OpenWrt logic applied to BUSYBOX_DEFAULT_LOGIN_SESSION_AS_CHILD (commit dc92917) * Config-defaults.in: correct the default ports that get reset BUSYBOX_DEFAULT_FEATURE_HTTPD_PORT_DEFAULT 80 BUSYBOX_DEFAULT_FEATURE_TELNETD_PORT_DEFAULT 23 * config/editors/Config.in: Add USE_GLIBC dependency to BUSYBOX_CONFIG_FEATURE_VI_REGEX_SEARCH (commit f141090) * config/shell/Config.in: change at "Options common to all shells" the conditional symbol SHELL_ASH --> BUSYBOX_CONFIG_SHELL_ASH (discussion in http://lists.openwrt.org/pipermail/openwrt-devel/2021-January/033140.html Apparently our script does not see the hidden option while prepending config options with "BUSYBOX_CONFIG_" which leads to a missed dependency when the options are later evaluated.) * Edit a few Config.in files by adding quotes to sourced items in config/Config.in, config/networking/Config.in and config/util-linux/Config.in (commit 1da014f) Signed-off-by: Seo Suchan Link: https://github.com/openwrt/openwrt/pull/23609 Signed-off-by: Jonas Jelonek

omnia-mcutool: Bump version to 0.3-rc4

2026-06-02T11:37:37Z

Bump version to 0.3-rc4, which fixes building with C23. Signed-off-by: Marek Behún Link: https://github.com/openwrt/openwrt/pull/23620 Signed-off-by: Robert Marko

util-linux: update to 2.42.1

2026-05-19T21:39:29Z

Release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.42/v2.42.1-ReleaseNotes Upstreamed: 0001-meson-test-for-statx-stx_mnt_id-in-sys-stat.h.patch 0001-nsenter-Fix-AT_HANDLE_FID-on-musl.patch Signed-off-by: Thomas Weißschuh Link: https://github.com/openwrt/openwrt/pull/23432 Signed-off-by: Hauke Mehrtens