From 0df0e43b51c7de9ad7b3534f9bcbb526736ba355 Mon Sep 17 00:00:00 2001
From: Mikhail Teterin <mi@FreeBSD.org>
Date: Sat, 15 Aug 2026 23:21:31 -0400
Subject: [PATCH] mail/cyrus-imapd25: add patches address vulnerabilities

The CVE-2021-33582 and CVE-2024-34055 are fixed in the more recent
3.x upstream versions, but not in the 2.5.17.

Bump PORTREVISION and update vuxml to indicate the revision with
fixes.
---
 mail/cyrus-imapd25/Makefile                   |  2 +-
 mail/cyrus-imapd25/files/patch-CVE-2021-33582 | 34 +++++++++++++++++++
 mail/cyrus-imapd25/files/patch-CVE-2024-34055 | 31 +++++++++++++++++
 security/vuxml/vuln/2021.xml                  |  3 ++
 security/vuxml/vuln/2024.xml                  |  5 ++-
 5 files changed, 73 insertions(+), 2 deletions(-)
 create mode 100644 mail/cyrus-imapd25/files/patch-CVE-2021-33582
 create mode 100644 mail/cyrus-imapd25/files/patch-CVE-2024-34055

diff --git a/mail/cyrus-imapd25/Makefile b/mail/cyrus-imapd25/Makefile
index b9120228741..f8fdc6dc83c 100644
--- a/mail/cyrus-imapd25/Makefile
+++ b/mail/cyrus-imapd25/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	cyrus-imapd
 PORTVERSION=	2.5.17
-PORTREVISION=	7
+PORTREVISION=	8
 CATEGORIES=	mail
 MASTER_SITES=	https://github.com/cyrusimap/cyrus-imapd/releases/download/${PORTNAME}-${PORTVERSION}/
 PKGNAMESUFFIX=	25
diff --git a/mail/cyrus-imapd25/files/patch-CVE-2021-33582 b/mail/cyrus-imapd25/files/patch-CVE-2021-33582
new file mode 100644
index 00000000000..51369cceb4f
--- /dev/null
+++ b/mail/cyrus-imapd25/files/patch-CVE-2021-33582
@@ -0,0 +1,34 @@
+Use our native arc4random() to address the CVE-2021-33582.
+
+Suggested by: Gemini AI
+--- lib/strhash.c	2021-03-08 21:21:33.000000000 -0500
++++ lib/strhash.c	2026-08-15 22:12:06.922781000 -0400
+@@ -45,14 +45,19 @@
+ EXPORTED unsigned strhash(const char *string)
+ {
+-      unsigned ret_val = 0;
+-      int i;
++      static unsigned int hash_seed = 0;
++      unsigned int h;
+ 
+-      while (*string)
+-      {
+-            i = (int) *string;
+-            ret_val ^= i;
+-            ret_val <<= 1;
+-            string ++;
++      /* Initialize a session-random salt to block precomputed collision vectors */
++      if (!hash_seed) {
++            hash_seed = arc4random();
++            if (!hash_seed) hash_seed = 5381; /* Baseline fallback salt multiplier */
+       }
+-      return ret_val;
++
++      h = hash_seed;
++
++      /* Implement standard DJB2 algorithmic complexity remediation */
++      while (*string) {
++            h = ((h << 5) + h) ^ (unsigned char)*string++;
++      }
++      return h;
+ }
diff --git a/mail/cyrus-imapd25/files/patch-CVE-2024-34055 b/mail/cyrus-imapd25/files/patch-CVE-2024-34055
new file mode 100644
index 00000000000..913f892a03d
--- /dev/null
+++ b/mail/cyrus-imapd25/files/patch-CVE-2024-34055
@@ -0,0 +1,31 @@
+Address the CVE-2024-34055 with the backport of the new parameter -- maxliteral,
+defaulting to 128Kb -- from the newer upstream releases.
+
+Suggested by:	Gemini AI
+
+--- imap/imapd.c	2021-03-08 21:28:07.000000000 -0500
++++ imap/imapd.c	2026-08-15 22:28:08.512935000 -0400
+@@ -3261,4 +3261,13 @@
+     if (r) return r;
+ 
++    /*
++     * CVE-2024-34055: Enforce hard literal boundaries to
++     * block unbounded allocations
++     */
++    if (size > config_getint(IMAPOPT_MAXLITERAL)) {
++        *parseerr = "Literal size exceeds maximum allowed system limits";
++        return IMAP_MESSAGE_TOO_LARGE;
++    }
++
+     if (*totalsize > UINT_MAX - size) r = IMAP_MESSAGE_TOO_LARGE;
+ 
+--- lib/imapoptions	2021-03-08 21:28:07.000000000 -0500
++++ lib/imapoptions	2026-08-15 22:34:43.374336000 -0400
+@@ -1049,4 +1049,7 @@
+    messages causing giant cache records */
+ 
++{ "maxliteral", 131072, INT }
++/* Maximum allowable memory size for a single negotiated IMAP literal argument string */
++
+ { "maxlogins_per_host", 0, INT }
+ /* Maximum number of logged in sessions allowed per host,
diff --git a/security/vuxml/vuln/2021.xml b/security/vuxml/vuln/2021.xml
index 4b6c9e9f7b0..afabfb5e225 100644
--- a/security/vuxml/vuln/2021.xml
+++ b/security/vuxml/vuln/2021.xml
@@ -4163,6 +4163,9 @@
       </package>
       <package>
 	<name>cyrus-imapd25</name>
+	<range><lt>2.5.17_8</lt></range>
+      </package>
+      <package>
 	<name>cyrus-imapd24</name>
 	<name>cyrus-imapd23</name>
 	<range><gt>0</gt></range>
diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml
index fbc95865580..558c7eb446c 100644
--- a/security/vuxml/vuln/2024.xml
+++ b/security/vuxml/vuln/2024.xml
@@ -7816,10 +7816,13 @@ All of these are related to the CometVisu add-on for openHAB - if you are a user
 	<name>cyrus-imapd34</name>
 	<range><lt>3.4.7_1</lt></range>
       </package>
+      <package>
+	<name>cyrus-imapd25</name>
+	<range><lt>2.5.17_8</lt></range>
+      </package>
       <package>
 	<name>cyrus-imapd32</name>
 	<name>cyrus-imapd30</name>
-	<name>cyrus-imapd25</name>
 	<range><gt>0</gt></range>
       </package>
     </affects>
-- 
2.54.0