apr/apr-CVE-2021-35940.patch


--- 1.7.x/time/unix/time.c	2021/07/02 11:07:15	1891197
+++ 1.7.x/time/unix/time.c	2021/07/02 11:10:33	1891198
@@ -142,6 +142,9 @@
     static const int dayoffset[12] =
     {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275};
 
+    if (xt->tm_mon < 0 || xt->tm_mon >= 12)
+        return APR_EBADDATE;
+
     /* shift new year to 1st March in order to make leap year calc easy */
 
     if (xt->tm_mon < 2)
OBS-URL: https://build.opensuse.org/package/show/Apache/apr?expand=0&rev=36 2021-09-02 07:21:40 +00:00
- security update - added patches fix CVE-2021-3594 [bsc#1187367], invalid pointer initialization may lead to information disclosure (udp) + apr-CVE-2021-3594.patch OBS-URL: https://build.opensuse.org/package/show/Apache/apr?expand=0&rev=35 2021-09-02 07:16:12 +00:00			`--- 1.7.x/time/unix/time.c 2021/07/02 11:07:15 1891197`
			`+++ 1.7.x/time/unix/time.c 2021/07/02 11:10:33 1891198`
			`@@ -142,6 +142,9 @@`
			`static const int dayoffset[12] =`
			`{306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275};`

			`+ if (xt->tm_mon < 0 \|\| xt->tm_mon >= 12)`
			`+ return APR_EBADDATE;`
			`+`
			`/* shift new year to 1st March in order to make leap year calc easy */`

			`if (xt->tm_mon < 2)`