NewsCache 1.3.18

Bug fixes

• Authentication: a missing optional field was read past the end of the
  field list, and the client session crashed after a successful login.
  This happened with "Authentication unix" or "pam" without the
  ":list:read:postto:flags" fields (documented in newscache.conf(5)), and
  with auth-file lines shorter than user:password:list:read:postto:flags.
  Missing fields are now empty.
• MD5 password hashes in auth files (base64, 24 characters ending in "==")
  crashed the session on 64-bit systems. md5lib used unsigned long for its
  32-bit words, which is 64 bits there, so computing the hash overran a
  stack buffer (and gave a wrong hash). It now uses uint32_t. Affects every
  release since at least 1.2rc6 on 64-bit systems; crypt() hashes such as
  $6$ were not affected. Found by CodeQL.
• DATE and NEWGROUPS use gmtime_r/localtime_r, and NEWGROUPS checks their
  result instead of dereferencing a NULL pointer on failure.

Other changes

• CodeQL code scanning (.github/workflows/codeql.yml) runs on pushes and
  pull requests to main and weekly.

Tests

• End-to-end tests for file authentication: a short auth-file line, an MD5
  hash, and a wrong password.
• End-to-end tests for DATE and NEWGROUPS.

Upgrading from 1.3.17 needs no config changes.

Build

tar xzf NewsCache-1.3.18.tar.gz && cd NewsCache-1.3.18
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make && make check && sudo make install

Tested on Ubuntu 24.04 (g++ 13.3, also with AddressSanitizer) and Fedora 44 (g++ 16.2, Fedora's rpm flags). See README.md and FEDORA.md.

SHA-256: 3bef38454c2f63dbecef41f6284d6d0b94840e8f68905055def00a70cb15ebb9