Pullup ticket #5145 - requested by wiz
net/tor: security fix

Revisions pulled up:
- net/tor/Makefile                                              1.112-1.113
- net/tor/distinfo                                              1.73-1.74

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Fri Sep 30 10:53:01 UTC 2016

   Modified Files:
   	pkgsrc/net/tor: Makefile distinfo

   Log Message:
   Updated tor to 0.2.8.8.

   Changes in version 0.2.8.8 - 2016-09-23
     Tor 0.2.8.8 fixes two crash bugs present in previous versions of the
     0.2.8.x series. Relays running 0.2.8.x should upgrade, as should users
     who select public relays as their bridges.

     o Major bugfixes (crash):
       - Fix a complicated crash bug that could affect Tor clients
         configured to use bridges when replacing a networkstatus consensus
         in which one of their bridges was mentioned. OpenBSD users saw
         more crashes here, but all platforms were potentially affected.
         Fixes bug 20103; bugfix on 0.2.8.2-alpha.

     o Major bugfixes (relay, OOM handler):
       - Fix a timing-dependent assertion failure that could occur when we
         tried to flush from a circuit after having freed its cells because
         of an out-of-memory condition. Fixes bug 20203; bugfix on
         0.2.8.1-alpha. Thanks to "cypherpunks" for help diagnosing
         this one.

     o Minor feature (fallback directories):
       - Remove broken fallbacks from the hard-coded fallback directory
         list. Closes ticket 20190; patch by teor.

     o Minor features (geoip):
       - Update geoip and geoip6 to the September 6 2016 Maxmind GeoLite2
         Country database.

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Wed Oct 19 10:58:14 UTC 2016

   Modified Files:
   	pkgsrc/net/tor: Makefile distinfo

   Log Message:
   Updated tor to 0.2.8.9.

   Changes in version 0.2.8.9 - 2016-10-17
     Tor 0.2.8.9 backports a fix for a security hole in previous versions
     of Tor that would allow a remote attacker to crash a Tor client,
     hidden service, relay, or authority. All Tor users should upgrade to
     this version, or to 0.2.9.4-alpha. Patches will be released for older
     versions of Tor.

     o Major features (security fixes, also in 0.2.9.4-alpha):
       - Prevent a class of security bugs caused by treating the contents
         of a buffer chunk as if they were a NUL-terminated string. At
         least one such bug seems to be present in all currently used
         versions of Tor, and would allow an attacker to remotely crash
         most Tor instances, especially those compiled with extra compiler
         hardening. With this defense in place, such bugs can't crash Tor,
         though we should still fix them as they occur. Closes ticket
         20384 (TROVE-2016-10-001).

     o Minor features (geoip):
       - Update geoip and geoip6 to the October 4 2016 Maxmind GeoLite2
         Country database.


(bsiegert)