security/libressl: Fix memory leak and buffer overflow DoS vulnerability

[brnrd]

Summary

Proposed commit log

security/libressl: Fix memory leak and buffer overflow DoS vulnerability

  * Update to 2.2.4 (fixing vulnerabilities)
  * Create vuxml entry

DiffRevision: https://reviews.freebsd.org/D
Submitted by:	Bernard Spil <[e-mail]>
Reviewed_by:	vsevolod (maintainer, mentor), koobs (mentor)
Approved by:	
MFC after:	2015Q4
Security:	CVE-2015-5333, CVE-2015-5334, vuxml

Test Plan

• portlint -AC (no change)
• poudriere testport

[delphij]

The vuxml portion of change looks fine and please go ahead and commit it. Please see my comments in the port part of change.

security/libressl/Makefile

17

Maybe use DOCS instead? (DOCS_DESC can be omitted as the ports infrastructure already provided it).

40

I'd suggest using DOCS here too.

[brnrd]

security/libressl/Makefile

17

This is implemented just as in security/openssl, in D3585 this seems to be OK.

40

This is implemented just as in security/openssl, in D3585 this seems to be OK.

[koobs]

Minor nits with proposed commit log

• The title is longer than the full desc. Do instead:

security/libressl: Update to 2.2.4 (Security Update)

* Update to 2.2.4 

This fixes memory leak and buffer overflow DoS vulnerabilities

Note: the (Security Update) in the first line of commit log is optional. The key point is, first line summarises only what the change does, where the rest of the commit log (after a blank line) can explain the detail, why, how, etc. TLDR: This change just Updates the port to version 2.2.4

• MAN changes/additions, and Update distinfo are not mentioned in your itemized changes

@delphij Do you (we/ports-secteam)) prefer both port/vuxml in a single commit, or vuxml before port update?

security/libressl/Makefile

17

Should all manual pages (1,3,x) be conditionally installed under a MAN option?

Yes man pages are docs, are are these (the files were talking about) more 'just docs' or more 'man pages'.

37

You can use the new test framework bits for this block

42

Whats the purpose/rationale for this?

Does libre have man and man3's backwards? Are man pages duplicate in man/man3?

Not mentioned in your itemized changes so we cant know

[koobs]

Oh, this was already committed in rP399426 but wasn't references (closed) correctly because Differential Revision wasn't on the last line

[koobs]

This was also missing a make validate on vuxml format validation

[brnrd]

In D3916#81246, @koobs wrote:

@delphij Do you (we/ports-secteam)) prefer both port/vuxml in a single commit, or vuxml before port update?

svn commit forces splitting the vuxml commit from the other commit.

[koobs]

Accept because its been committed. The outstanding changes can go into the next libressl update