Browse code
apr : Fix CVE-2017-12613
Change-Id: I94253566750c7f81a5700dca20fb7ccb979abd23
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4489
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
xiaolin-vmware authored on 2017/12/09 05:28:49Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,34 @@ |
| 0 |
+--- apr/apr/branches/1.6.x/time/unix/time.c 2017/09/10 22:30:14 1807975 |
|
| 1 |
+@@ -142,6 +142,9 @@ |
|
| 2 |
+ static const int dayoffset[12] = |
|
| 3 |
+ {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275};
|
|
| 4 |
+ |
|
| 5 |
++ if (xt->tm_mon < 0 || xt->tm_mon >= 12) |
|
| 6 |
++ return APR_EBADDATE; |
|
| 7 |
++ |
|
| 8 |
+ /* shift new year to 1st March in order to make leap year calc easy */ |
|
| 9 |
+ |
|
| 10 |
+ if (xt->tm_mon < 2) |
|
| 11 |
+--- apr/apr/branches/1.6.x/time/win32/time.c 2017/09/10 22:30:14 1807975 |
|
| 12 |
+@@ -54,6 +54,9 @@ |
|
| 13 |
+ static const int dayoffset[12] = |
|
| 14 |
+ {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334};
|
|
| 15 |
+ |
|
| 16 |
++ if (tm->wMonth < 1 || tm->wMonth > 12) |
|
| 17 |
++ return APR_EBADDATE; |
|
| 18 |
++ |
|
| 19 |
+ /* Note; the caller is responsible for filling in detailed tm_usec, |
|
| 20 |
+ * tm_gmtoff and tm_isdst data when applicable. |
|
| 21 |
+ */ |
|
| 22 |
+@@ -224,6 +227,9 @@ |
|
| 23 |
+ static const int dayoffset[12] = |
|
| 24 |
+ {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275};
|
|
| 25 |
+ |
|
| 26 |
++ if (xt->tm_mon < 0 || xt->tm_mon >= 12) |
|
| 27 |
++ return APR_EBADDATE; |
|
| 28 |
++ |
|
| 29 |
+ /* shift new year to 1st March in order to make leap year calc easy */ |
|
| 30 |
+ |
|
| 31 |
+ if (xt->tm_mon < 2) |
| ... | ... |
@@ -1,25 +1,27 @@ |
| 1 |
-Summary: The Apache Portable Runtime |
|
| 2 |
-Name: apr |
|
| 3 |
-Version: 1.5.2 |
|
| 4 |
-Release: 6%{?dist}
|
|
| 5 |
-License: Apache License 2.0 |
|
| 6 |
-URL: https://apr.apache.org/ |
|
| 7 |
-Group: System Environment/Libraries |
|
| 8 |
-Vendor: VMware, Inc. |
|
| 9 |
-Distribution: Photon |
|
| 10 |
-Source0: http://archive.apache.org/dist/apr/%{name}-%{version}.tar.gz
|
|
| 11 |
-%define sha1 apr=2ef2ac9a8de7f97f15ef32cddf1ed7325163d84c |
|
| 12 |
-%define aprver 1 |
|
| 1 |
+Summary: The Apache Portable Runtime |
|
| 2 |
+Name: apr |
|
| 3 |
+Version: 1.5.2 |
|
| 4 |
+Release: 7%{?dist}
|
|
| 5 |
+License: Apache License 2.0 |
|
| 6 |
+URL: https://apr.apache.org/ |
|
| 7 |
+Group: System Environment/Libraries |
|
| 8 |
+Vendor: VMware, Inc. |
|
| 9 |
+Distribution: Photon |
|
| 10 |
+Source0: http://archive.apache.org/dist/apr/%{name}-%{version}.tar.gz
|
|
| 11 |
+%define sha1 apr=2ef2ac9a8de7f97f15ef32cddf1ed7325163d84c |
|
| 12 |
+%define aprver 1 |
|
| 13 |
+Patch0: apr-CVE-2017-12613.patch |
|
| 13 | 14 |
%description |
| 14 | 15 |
The Apache Portable Runtime. |
| 15 |
-%package devel |
|
| 16 |
-Summary: Header and development files |
|
| 17 |
-Requires: %{name} = %{version}
|
|
| 18 |
-%description devel |
|
| 16 |
+%package devel |
|
| 17 |
+Summary: Header and development files |
|
| 18 |
+Requires: %{name} = %{version}
|
|
| 19 |
+%description devel |
|
| 19 | 20 |
It contains the libraries and header files to create applications |
| 20 | 21 |
|
| 21 | 22 |
%prep |
| 22 | 23 |
%setup -q |
| 24 |
+%patch0 -p4 |
|
| 23 | 25 |
%build |
| 24 | 26 |
./configure --prefix=/usr \ |
| 25 | 27 |
--includedir=%{_includedir}/apr-%{aprver} \
|
| ... | ... |
@@ -50,7 +52,7 @@ make %{?_smp_mflags}
|
| 50 | 50 |
%exclude %{_libdir}/pkgconfig
|
| 51 | 51 |
%{_bindir}/*
|
| 52 | 52 |
|
| 53 |
-%files devel |
|
| 53 |
+%files devel |
|
| 54 | 54 |
%defattr(-,root,root) |
| 55 | 55 |
%{_includedir}/*
|
| 56 | 56 |
%{_libdir}/*.la
|
| ... | ... |
@@ -59,10 +61,12 @@ make %{?_smp_mflags}
|
| 59 | 59 |
%{_libdir}/pkgconfig
|
| 60 | 60 |
|
| 61 | 61 |
%changelog |
| 62 |
-* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.5.2-6 |
|
| 63 |
-- GA - Bump release of all rpms |
|
| 64 |
-* Mon Sep 21 2015 Harish Udaiya Kumar<hudaiyakumar@vmware.com> 1.5.2-5 |
|
| 65 |
-- Repacked to move the include files in devel package. |
|
| 62 |
+* Fri Dec 08 2017 Xiaolin Li <xiaolinl@vmware.com> 1.5.2-7 |
|
| 63 |
+- Fix CVE-2017-12613 |
|
| 64 |
+* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.5.2-6 |
|
| 65 |
+- GA - Bump release of all rpms |
|
| 66 |
+* Mon Sep 21 2015 Harish Udaiya Kumar<hudaiyakumar@vmware.com> 1.5.2-5 |
|
| 67 |
+- Repacked to move the include files in devel package. |
|
| 66 | 68 |
* Wed Jul 15 2015 Sarah Choi <sarahc@vmware.com> 1.5.2-4 |
| 67 | 69 |
- Use aprver(=1) instead of version for mesos |
| 68 | 70 |
* Mon Jul 13 2015 Alexey Makhalov <amakhalov@vmware.com> 1.5.2-3 |