MFV r362565:

Update 4.2.8p14 --> 4.2.8p15

Summary: Systems that use a CMAC algorithm in ntp.keys will not release
a bit of memory on each packet that uses a CMAC keyid, eventually causing
ntpd to run out of memory and fail. The CMAC cleanup from
https://bugs.ntp.org/3447, part of ntp-4.2.8p11, introduced a bug whereby
the CMAC data structure was no longer completely removed.

MFC after:	3 days
Security:	NTP Bug 3661

1 files changed, 29 insertions, 0 deletions

diff --git a/contrib/ntp/ChangeLog b/contrib/ntp/ChangeLog
index 35d5d36c2faf..c0db6042c9fe 100644
--- a/contrib/ntp/ChangeLog
+++ b/contrib/ntp/ChangeLog
@@ -1,4 +1,33 @@
 ---
+(4.2.8p15) 2020/06/23 Released by Harlan Stenn <stenn@ntp.org>
+(4.2.8p15) 2020/06/23 Released by Harlan Stenn <stenn@ntp.or>
+
+* [Sec 3661] memory leak with AES128CMAC keys <perlinger@ntp.org>
+* [Bug 3670] Regression from bad merge of 3592 and 3596 <perlinger@ntp.org>
+  - fixed a bad merge that happened before 4.2.8-p14. Thanks to
+    Sylar Tao for noticing this!
+* [Bug 3667] decodenetnum fails with numeric port <perlinger@ntp.org>
+  - rewrite 'decodenetnum()' in terms of inet_pton
+* [Bug 3666] avoid unlimited receive buffer allocation <perlinger@ntp.org>
+  - limit number of receive buffers, with an iron reserve for refclocks
+* [Bug 3664] Enable openSSL CMAC support on Windows <burnicki@ntp.org>
+* [Bug 3662] Fix build errors on Windows with VS2008 <burnicki@ntp.org>
+* [Bug 3660] Manycast orphan mode startup discovery problem. <stenn@ntp.org>
+  - integrated patch from Charles Claggett
+* [Bug 3659] Move definition of psl[] from ntp_config.h to
+  ntp_config.h <perlinger@ntp.org>
+* [Bug 3657] Wrong "Autokey group mismatch" debug message <perlinger@ntp.org>
+* [Bug 3655] ntpdc memstats hash counts <perlinger@ntp.org>
+  - fix by Gerry garvey
+* [Bug 3653] Refclock jitter RMS calculation <perlinger@ntp.org>
+  - thanks to Gerry Garvey
+* [Bug 3646] Avoid sync with unsync orphan <perlinger@ntp.org>
+  - patch by Gerry Garvey
+* [Bug 3644] Unsynchronized server [...] selected as candidate <perlinger@ntp.org>
+* [Bug 3639] refclock_jjy: TS-JJY0x can skip time sync depending on the STUS reply. <abe@ntp.org>
+  - applied patch by Takao Abe
+
+---
 (4.2.8p14) 2020/03/03 Released by Harlan Stenn <stenn@ntp.org>
 
 * [Sec 3610] process_control() should bail earlier on short packets. stenn@