From patchwork Thu Mar 2 10:14:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 6647 Return-Path: Received: from mail01.ipfire.org (unknown [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4PS71W6Bq5z3wfc for ; Thu, 2 Mar 2023 10:41:03 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4PS6RN3gw9zBD; Thu, 2 Mar 2023 10:14:56 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4PS6RN0kQtz30Jg; Thu, 2 Mar 2023 10:14:56 +0000 (UTC) Received: from mail01.ipfire.org (unknown [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4PS6RK4hlnz2xK9 for ; Thu, 2 Mar 2023 10:14:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4PS6R61cLQz36; Thu, 2 Mar 2023 10:14:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1677752082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Bbx0b5XudHM+Dxn8a8jStZGI2+wugIU2vMft2ZAA8v0=; b=oRrdUZ6iZoPgsyxhPKHUPAZcrpKiEJ2FbGiHDV1scxQoVItImHBz024+RlqxWD0hMTN5t8 ZDJdp0MgRveu3MKAGmrEAJjUkMGtrKvpz1vxqNLNp+I0/PESPriCUbvfjIHnJu+XKuefcC bTSnfYsfrycvwqfcX20Dw6A/qSi/QXQjyAENQRbI1cThsXuLkgjjWod8wWPEvJmBMPcCNv knBCICjslM/AnHUmOEMeW6kYW8OPr+WP9ibg4yVc3nTgf3237+4O7vXF43V6VKt8MhEhpa kwqzQao9fQ9Ig3hmQpbMcfpR/WuugNU3jDT1aKtFT7z1BIELjTcElgy/qiUZKQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1677752082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Bbx0b5XudHM+Dxn8a8jStZGI2+wugIU2vMft2ZAA8v0=; b=c8ks7Q+FfTe+yqXi+1rhJt5F8dPLd8VHMs5817Wlrl3wBm8KV1KC/GZpC0eKR9kvillrnY nwQAohcdFNsO3WAw== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH] apr: Update to version 1.7.2 Date: Thu, 2 Mar 2023 11:14:06 +0100 Message-Id: <20230302101419.3443689-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - Update from version 1.7.0 to 1.7.2 - Update of rootfile - Changelog Changes for APR 1.7.2 *) Correct a packaging issue in 1.7.1. The contents of the release were correct, but the top level directory was misnamed. Changes for APR 1.7.1 *) SECURITY: CVE-2022-24963 (cve.mitre.org) Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. *) SECURITY: CVE-2022-28331 (cve.mitre.org) On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow. *) SECURITY: CVE-2021-35940 (cve.mitre.org) Restore fix for out-of-bounds array dereference in apr_time_exp*() functions. (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and later 1.6.x releases, but was missing in 1.7.0.) [Stefan Sperling] *) configure: Fix various build issues for compilers enforcing strict C99 compliance. PR 66396, 66408, 66426. [Florian Weimer , Sam James ] *) apr_atomic_read64(): Fix non-atomic read on 32-bit Windows [Ivan Zhakov] *) configure: Prefer posix name-based shared memory over SysV IPC. [Jim Jagielski] *) configure: Add --disable-sctp argument to forcibly disable SCTP support, or --enable-sctp which fails if SCTP support is not detected. [Lubos Uhliarik , Joe Orton] *) Fix handle leak in the Win32 apr_uid_current implementation. PR 61165. [Ivan Zhakov] *) Add error handling for lseek() failures in apr_file_write() and apr_file_writev(). [Joe Orton] *) Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp() created file to avoid a fd and inode leak when/if later passed to apr_file_setaside(). [Yann Ylavic] *) APR's configure script uses AC_TRY_RUN to detect whether the return type of strerror_r is int. When cross-compiling this defaults to no. This commit adds an AC_CACHE_CHECK so users who cross-compile APR may influence the outcome with a configure variable. [Sebastian Kemper ] *) Add a cache check with which users who cross-compile APR can influence the outcome of the /dev/zero test by setting the variable ac_cv_mmap__dev_zero=yes [Sebastian Kemper ] *) Trick autoconf into printing the correct default prefix in the help. [Stefan Fritsch] *) Don't try to use PROC_PTHREAD by default when cross compiling. [Yann Ylavic] *) Add the ability to cross compile APR. [Graham Leggett] *) While cross-compiling, the tools/gen_test_char could not be executed at build time, use AX_PROG_CC_FOR_BUILD to build native tools/gen_test_char Support explicit libtool by variable assigning before buildcheck.sh, it is helpful for cross-compiling (such as libtool=aarch64-linux-libtool) [Hongxu Jia ] *) Avoid an overflow on 32 bit platforms. [René Hjortskov Nielsen ] *) Use AC_CHECK_SIZEOF, so as to support cross compiling. PR 56053. [Mike Frysinger ] *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov] *) apr_pools: Fix pool debugging output so that creation events are always emitted before allocation events and subpool destruction events are emitted on pool clear/destroy for proper accounting. [Brane Čibej] *) apr_socket_listen: Allow larger listen backlog values on Windows 8+. [Evgeny Kotkov ] *) Fixed: apr_get_oslevel() was returning APR_WIN_XP on Windows 10 *) Fix attempt to free invalid memory on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix double free on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix a regression in apr_stat() for root path on Windows. [Ivan Zhakov] Signed-off-by: Adolf Belka --- config/rootfiles/common/apr | 4 +--- lfs/apr | 4 ++-- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/apr b/config/rootfiles/common/apr index 52e59aaae..50b811bdd 100644 --- a/config/rootfiles/common/apr +++ b/config/rootfiles/common/apr @@ -45,13 +45,11 @@ usr/bin/apr-1-config #usr/lib/libapr-1.la #usr/lib/libapr-1.so usr/lib/libapr-1.so.0 -usr/lib/libapr-1.so.0.7.0 +usr/lib/libapr-1.so.0.7.2 #usr/lib/pkgconfig/apr-1.pc #usr/share/apr-1 #usr/share/apr-1/build -#usr/share/apr-1/build/apr_common.m4 #usr/share/apr-1/build/apr_rules.mk -#usr/share/apr-1/build/find_apr.m4 #usr/share/apr-1/build/libtool #usr/share/apr-1/build/make_exports.awk #usr/share/apr-1/build/make_var_export.awk diff --git a/lfs/apr b/lfs/apr index 35acd6ab7..6ef88fd18 100644 --- a/lfs/apr +++ b/lfs/apr @@ -25,7 +25,7 @@ include Config -VER = 1.7.0 +VER = 1.7.2 THISAPP = apr-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a8750c45ca6495073a7120f3ae9b858905aecb24b6af5966c3900b06ac1f6d6b55346b17a39a9604cf1b595882335adedf8c8cf4db10e322501bfff4ad7adfe7 +$(DL_FILE)_BLAKE2 = a17ee4311a33acee0bdeb9e5225a198f9dec1b2e0267a742080c77d5342e5052392a5a2100a0ba85f5a192b8679838a7002d4c9a12aa5bdd7921eff025b75d15 install : $(TARGET)