Accepting request 1062940 from home:AndreasStieger:branches:Apache

apr-util 1.6.3 CVE-2022-25147 boo#1207866

OBS-URL: https://build.opensuse.org/request/show/1062940
OBS-URL: https://build.opensuse.org/package/show/Apache/apr-util?expand=0&rev=35

apr-util-1.6.1.tar.bz2

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:d3e12f7b6ad12687572a3a39475545a072608f4ba03a6ce8a3778f607dd0035b
-size 428595

apr-util-1.6.1.tar.bz2.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIcBAABAgAGBQJZ52qDAAoJEI77GWKQiPVlTHIP/0W7sfn51gioVdVnvHf7xLQx
-q4LvcGDLZC+Rx+zy91Kq0Fxot8u/H6dxgLHGwx9suu+jgMm5vQIDXW761DYKNAK8
-aIXpKG++puond8tlsL+qinvm272VgWj6bDo6RL1KpEMW64fbxfljkRB0NMWs2KvX
-lsdi3n182RHFKlL9mhzo9VIwvsNliGzw1a+utPdZnxyuKluDHZBNUS+4kPnVB6mq
-uplEG/Mduh3ln09Pq3MmwdjKs7CfqUjkLO/XyHAPDNbvGYsRgOke9u7rRT5rK3UQ
-PG2g1rPUEozBATAzn/QNLls8RMrO6+TCD/Y0sNKy3ApvKhMQ2J09b+cZYnCzbNNJ
-Oh4N4nzdp5Q4pk2dxRjxnGRw4vji3CagcCMAzbsKAJHaLyO436GGSyPnyvX66H5g
-yCCDr8Ochcr198eEBSdigSyI9IHe2pkmXNTpkmKK5BFGdyGwcl7xJUk2R3mOEY6K
-Qa/7I1kY1jNTSuNYlBQDpss1rUByDkYHlHbNeotS4XGrfM/dTZPnzhxQy8/XkgJk
-wYP2WHw/qq2idR+vzUCIzYh8x/K0qxApDUaHe2K2EuHNGAQ/BdC/EpXGaK8brPRT
-htagHucXjYXpt3fCPlvR1aetIZIx3GLSwDuxukwc86V9LsaXvQ6D7ITv2FxLZD+J
-9Wm9I5ERZWymLdv8il06
-=qjMn
------END PGP SIGNATURE-----

apr-util-1.6.3.tar.bz2.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEZbLUT+dL1ePeOsPwgngd5G1ZVPoFAmPZgNEACgkQgngd5G1Z
+VPoWlg/7BEhcx9ibgzASizXZ/nethFK/euqwfvayOHQyin5Ww5EntJHrKYLrru8C
+vLxzDhXXICf2WhdVDiwcf8OkKpqB8wiV1CFr7DrTNQEjaTA9DlteWGYEeko4hQAE
+Krdg0tjKlm0n3fbZacavZEzPT5O0XPA9zSrtjTTFDv08WXPiTlCRWgX18E/6iPKm
+8qeJI7BdLgCd+rILNcBflgRWJpBFLJhvL8xG+WcV9+Bko2tRwdGDl2ekQWm9FUd9
+M6cPoduEVWj/tValArTRWqLbo3XtnDv10ShUCDYoqgQ22JAnGBXnOrPHfKqMql55
+ZNzuZswd9BljRP5cAtHgpPJZLMHjh4hZm0FNm4VYBZ7rattwJYMqU7DcLMT5Q1Ha
+8/umVcbufyHwpiQlDvNRbw3uqFicGEjF3FHlzWgMphxXuuUpoUPLh3MxiiJSdT3K
+f49zVeFmpo4/798LTNSCEsfCgzj7UI8HngUbQbNcnNSIglk1inKceEQl9UELLicq
+Hfx/pOcknyUpAy6om4L5lcWLu9vHl9DfMS6SxFZ09K6jdA6XKLiA/D6dkSPCjxXg
+t4kdHnJO7CBsd5gI5HLUDeofHG3GR+uUuS4u4tjFChK0vxoTGAJuC4hPzfSkplZm
+bnwlIzWwuRosUH81njSsc+33l+mdD5iaKaZLvllc9ofCMoGeJxo=
+=tS1o
+-----END PGP SIGNATURE-----

apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch

@@ -1,103 +0,0 @@
---- 1.6.x/dbm/apr_dbm_gdbm.c	2018/02/25 16:36:31	1825311
-+++ 1.6.x/dbm/apr_dbm_gdbm.c	2018/02/25 16:41:11	1825312
-@@ -36,8 +36,20 @@
- static apr_status_t g2s(int gerr)
- {
-     if (gerr == -1) {
--        /* ### need to fix this */
--        return APR_EGENERAL;
-+        if (gdbm_errno == GDBM_NO_ERROR)
-+           return APR_SUCCESS;
-+        return APR_OS_START_USEERR + gdbm_errno;
-+    }
-+
-+    return APR_SUCCESS;
-+}
-+
-+static apr_status_t gdat2s(datum d)
-+{
-+    if (d.dptr == NULL) {
-+        if (gdbm_errno == GDBM_NO_ERROR || gdbm_errno == GDBM_ITEM_NOT_FOUND)
-+           return APR_SUCCESS;
-+        return APR_OS_START_USEERR + gdbm_errno;
-     }
- 
-     return APR_SUCCESS;
-@@ -53,22 +65,14 @@
- 
- static apr_status_t set_error(apr_dbm_t *dbm, apr_status_t dbm_said)
- {
--    apr_status_t rv = APR_SUCCESS;
--
--    /* ### ignore whatever the DBM said (dbm_said); ask it explicitly */
-+    dbm->errcode = dbm_said;
- 
--    if ((dbm->errcode = gdbm_errno) == GDBM_NO_ERROR) {
-+    if (dbm_said == APR_SUCCESS)
-         dbm->errmsg = NULL;
--    }
--    else {
--        dbm->errmsg = gdbm_strerror(gdbm_errno);
--        rv = APR_EGENERAL;        /* ### need something better */
--    }
--
--    /* captured it. clear it now. */
--    gdbm_errno = GDBM_NO_ERROR;
-+    else
-+        dbm->errmsg = gdbm_strerror(dbm_said - APR_OS_START_USEERR);
- 
--    return rv;
-+    return dbm_said;
- }
- 
- /* --------------------------------------------------------------------------
-@@ -107,7 +111,7 @@
-                      NULL);
- 
-     if (file == NULL)
--        return APR_EGENERAL;      /* ### need a better error */
-+        return APR_OS_START_USEERR + gdbm_errno;
- 
-     /* we have an open database... return it */
-     *pdb = apr_pcalloc(pool, sizeof(**pdb));
-@@ -141,10 +145,12 @@
-     if (pvalue->dptr)
-         apr_pool_cleanup_register(dbm->pool, pvalue->dptr, datum_cleanup,
-                                   apr_pool_cleanup_null);
-+    else
-+        pvalue->dsize = 0;
- 
-     /* store the error info into DBM, and return a status code. Also, note
-        that *pvalue should have been cleared on error. */
--    return set_error(dbm, APR_SUCCESS);
-+    return set_error(dbm, gdat2s(rd));
- }
- 
- static apr_status_t vt_gdbm_store(apr_dbm_t *dbm, apr_datum_t key,
-@@ -201,9 +207,11 @@
-     if (pkey->dptr)
-         apr_pool_cleanup_register(dbm->pool, pkey->dptr, datum_cleanup,
-                                   apr_pool_cleanup_null);
-+    else
-+        pkey->dsize = 0;
- 
-     /* store any error info into DBM, and return a status code. */
--    return set_error(dbm, APR_SUCCESS);
-+    return set_error(dbm, gdat2s(rd));
- }
- 
- static apr_status_t vt_gdbm_nextkey(apr_dbm_t *dbm, apr_datum_t *pkey)
-@@ -221,9 +229,11 @@
-     if (pkey->dptr)
-         apr_pool_cleanup_register(dbm->pool, pkey->dptr, datum_cleanup,
-                                   apr_pool_cleanup_null);
-+    else
-+        pkey->dsize = 0;
- 
-     /* store any error info into DBM, and return a status code. */
--    return set_error(dbm, APR_SUCCESS);
-+    return set_error(dbm, gdat2s(rd));
- }
- 
- static void vt_gdbm_freedatum(apr_dbm_t *dbm, apr_datum_t data)
-

apr-util-mariadb-10.2.patch

@@ -1,127 +0,0 @@
-https://bz.apache.org/bugzilla/show_bug.cgi?id=61517
-diff -ur a/build/dbd.m4 b/build/dbd.m4
---- a/build/dbd.m4	2017-05-03 19:18:52.000000000 -0400
-+++ b/build/dbd.m4	2017-09-13 16:58:07.369546391 -0400
-@@ -163,10 +163,15 @@
-   old_cppflags="$CPPFLAGS"
-   old_ldflags="$LDFLAGS"
- 
-+  my_library="mysqlclient"
-+
-   AC_ARG_WITH([mysql], APR_HELP_STRING([--with-mysql=DIR], [enable MySQL DBD driver]),
-   [
-     if test "$withval" = "yes"; then
-       AC_PATH_PROG([MYSQL_CONFIG],[mysql_config])
-+      if test "x$MYSQL_CONFIG" = "x"; then
-+        AC_PATH_PROG([MYSQL_CONFIG],[mariadb_config])
-+      fi
-       if test "x$MYSQL_CONFIG" != 'x'; then
-         mysql_CPPFLAGS="`$MYSQL_CONFIG --include`"
-         mysql_LDFLAGS="`$MYSQL_CONFIG --libs_r | sed -e 's/-l[[^ ]]\+//g'`"
-@@ -174,32 +179,40 @@
- 
-         APR_ADDTO(CPPFLAGS, [$mysql_CPPFLAGS])
-         APR_ADDTO(LIBS, [$mysql_LIBS])
-+
-+	if $MYSQL_CONFIG --libs_r | grep -q mariadb; then
-+	  my_library="mariadb"
-+	fi
-       fi
- 
--      AC_CHECK_HEADERS([mysql.h my_global.h my_sys.h],
--                       AC_CHECK_LIB(mysqlclient, mysql_init, [apu_have_mysql=1]),
--                       [apu_have_mysql=0; break],
--                       [#include <my_global.h>])
--      if test "$apu_have_mysql" = "0"; then
--        AC_CHECK_HEADERS([mysql/mysql.h mysql/my_global.h mysql/my_sys.h],
--                         AC_CHECK_LIB(mysqlclient, mysql_init, [apu_have_mysql=1]),
--                         [apu_have_mysql=0; break],
--                         [#include <mysql/my_global.h>])
-+      AC_CHECK_HEADERS([mysql.h errmsg.h], [apu_have_mysql=1], [apu_have_mysql=0; break])
-+      if test "$apr_have_mysql" = "0"; then
-+	AC_CHECK_HEADERS([mysql/mysql.h mysql/errmsg.h], [apu_have_mysql=1], [apu_have_mysql=0; break])
-       fi
--      if test "$apu_have_mysql" != "0" && test "x$MYSQL_CONFIG" != 'x'; then
--        APR_ADDTO(APRUTIL_PRIV_INCLUDES, [$mysql_CPPFLAGS])
-+      if test "$apr_have_mysql" = "1"; then
-+	AC_CHECK_HEADERS([my_global.h my_sys.h mysql/my_global.h mysql/my_sys.h])
-+	AC_CHECK_LIB($my_library, mysql_init,, [apu_have_mysql=0])
-+      fi
-+      if test "$apu_have_mysql" = "1" && test "x$MYSQL_CONFIG" != 'x'; then
-+	APR_ADDTO(APRUTIL_PRIV_INCLUDES, [$mysql_CPPFLAGS])
-       fi
-     elif test "$withval" = "no"; then
-       :
-     else
-       AC_PATH_PROG([MYSQL_CONFIG],[mysql_config],,[$withval/bin])
-+      if test "x$MYSQL_CONFIG" = "x"; then
-+	AC_PATH_PROG([MYSQL_CONFIG],[mariadb_config],,[$withval/bin])
-+      fi
-       if test "x$MYSQL_CONFIG" != 'x'; then
--        mysql_CPPFLAGS="`$MYSQL_CONFIG --include`"
--        mysql_LDFLAGS="`$MYSQL_CONFIG --libs_r | sed -e 's/-l[[^ ]]\+//g'`"
--        mysql_LIBS="`$MYSQL_CONFIG --libs_r`"
-+	mysql_CPPFLAGS="`$MYSQL_CONFIG --include`"
-+	mysql_LDFLAGS="`$MYSQL_CONFIG --libs_r | sed -e 's/-l[[^ ]]\+//g'`"
-+	mysql_LIBS="`$MYSQL_CONFIG --libs_r`"
-+	if $MYSQL_CONFIG --libs_r | grep -q mariadb; then
-+	  my_library="mariadb"
-+	fi
-       else
--        mysql_CPPFLAGS="-I$withval/include"
--        mysql_LDFLAGS="-L$withval/lib "
-+	mysql_CPPFLAGS="-I$withval/include"
-+	mysql_LDFLAGS="-L$withval/lib "
-       fi
- 
-       APR_ADDTO(CPPFLAGS, [$mysql_CPPFLAGS])
-@@ -207,18 +220,15 @@
-       APR_ADDTO(LIBS, [$mysql_LIBS])
- 
-       AC_MSG_NOTICE(checking for mysql in $withval)
--      AC_CHECK_HEADERS([mysql.h my_global.h my_sys.h],
--                       AC_CHECK_LIB(mysqlclient, mysql_init, [apu_have_mysql=1]),
--                       [apu_have_mysql=0; break],
--                       [#include <my_global.h>])
--
--      if test "$apu_have_mysql" != "1"; then
--        AC_CHECK_HEADERS([mysql/mysql.h mysql/my_global.h mysql/my_sys.h],
--                         AC_CHECK_LIB(mysqlclient, mysql_init, [apu_have_mysql=1]),
--                         [apu_have_mysql=0; break],
--                         [#include <mysql/my_global.h>])
-+      AC_CHECK_HEADERS([mysql.h errmsg.h], [apu_have_mysql=1], [apu_have_mysql=0; break])
-+      if test "$apr_have_mysql" = "0"; then
-+	AC_CHECK_HEADERS([mysql/mysql.h mysql/errmsg.h], [apu_have_mysql=1], [apu_have_mysql=0; break])
-+      fi
-+      if test "$apr_have_mysql" = "1"; then
-+	AC_CHECK_HEADERS([my_global.h my_sys.h mysql/my_global.h mysql/my_sys.h])
-+	AC_CHECK_LIB($my_library, mysql_init,, [apu_have_mysql=0])
-       fi
--      if test "$apu_have_mysql" != "0"; then
-+      if test "$apu_have_mysql" = "1"; then
-         APR_ADDTO(APRUTIL_PRIV_INCLUDES, [$mysql_CPPFLAGS])
-       fi
-     fi
-@@ -229,7 +239,7 @@
-   dnl Since we have already done the AC_CHECK_LIB tests, if we have it, 
-   dnl we know the library is there.
-   if test "$apu_have_mysql" = "1"; then
--    APR_ADDTO(LDADD_dbd_mysql, [$mysql_LDFLAGS -lmysqlclient $mysql_LIBS])
-+    APR_ADDTO(LDADD_dbd_mysql, [$mysql_LDFLAGS -l$my_library $mysql_LIBS])
-   fi
-   AC_SUBST(LDADD_dbd_mysql)
- 
-diff -ur a/dbd/apr_dbd_mysql.c b/dbd/apr_dbd_mysql.c
---- a/dbd/apr_dbd_mysql.c	2017-05-03 19:18:52.000000000 -0400
-+++ b/dbd/apr_dbd_mysql.c	2017-09-13 19:15:20.894368809 -0400
-@@ -1262,7 +1262,9 @@
- 
- static void dbd_mysql_init(apr_pool_t *pool)
- {
-+#if MYSQL_VERSION_ID < 100000
-     my_init();
-+#endif
-     mysql_thread_init();
- 
-     /* FIXME: this is a guess; find out what it really does */
-

apr-util.changes

@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Thu Feb  2 19:38:22 UTC 2023 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- update to 1.6.3
+  * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in
+    apr_base64 function allows an attacker to write beyond bounds
+    of a buffer (boo#1207866)
+  * build system updates   
+- drop patches now included upstream:
+  * apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
+  * apr-util-mariadb-10.2.patch
+
 -------------------------------------------------------------------
 Tue Dec 21 10:50:47 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de>
 

apr-util.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package apr-util
 #
-# Copyright (c) 2021 SUSE LLC
+# Copyright (c) 2023 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -21,7 +21,7 @@
 %define         dso_libdir %{_libdir}/apr-util-%{apuver}
 %define         includedir %{_includedir}/apr-%{apuver}
 Name:           apr-util
-Version:        1.6.1
+Version:        1.6.3
 Release:        0
 Summary:        Apache Portable Runtime (APR) Utility Library
 License:        Apache-2.0
@@ -29,15 +29,11 @@ Group:          Development/Libraries/C and C++
 URL:            https://apr.apache.org/
 Source:         http://www.apache.org/dist/apr/apr-util-%{version}.tar.bz2
 Source2:        http://www.apache.org/dist/apr/apr-util-%{version}.tar.bz2.asc
-Source3:        %{name}.keyring
+Source3:        https://downloads.apache.org/apr/KEYS#/%{name}.keyring
 Patch1:         apr-util-1.4.1-testmemcache-initialize-values-array.patch
 Patch2:         apr-util-visibility.patch
-# PATCH-FIX-OPENSUSE apr-util-mariadb-10.2.patch dimstar@opensuse.org -- Fix build with mariadb 10.2
-Patch3:         apr-util-mariadb-10.2.patch
 # PATCH-FIX-OPENSUSE apr-util-postgresql.patch max@suse.com -- Fix build with PostgreSQL 11
 Patch4:         apr-util-postgresql.patch
-# https://svn.apache.org/viewvc?view=revision&revision=1825312
-Patch5:         apr-util-apr_dbm_gdbm-fix-handling-of-error-codes.patch
 BuildRequires:  apr-devel
 BuildRequires:  autoconf
 BuildRequires:  doxygen
@@ -112,12 +108,7 @@ Requires:       %{libname} = %{version}
 DBD driver for SQLite 3 database.
 
 %prep
-%setup -q
+%autosetup -p1
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
 
 %build
 echo 'HTML_TIMESTAMP=NO' >> docs/doxygen.conf