From 3c1a6415105f6a2b814066b21c9c9bdbe958e1f8 Mon Sep 17 00:00:00 2001 From: yang_zhuang_zhuang <1162011203@qq.com> Date: Fri, 19 Mar 2021 14:40:53 +0800 Subject: [PATCH] Fix CVE-2017-12613 --- apr.spec | 6 ++- ...nds-check-human-readable-date-fields.patch | 50 +++++++++++++++++++ 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2017-12613-Bounds-check-human-readable-date-fields.patch diff --git a/apr.spec b/apr.spec index ecfa436..3d076d7 100644 --- a/apr.spec +++ b/apr.spec @@ -2,7 +2,7 @@ Name: apr Version: 1.7.0 -Release: 2 +Release: 3 Summary: Apache Portable Runtime. License: ASL 2.0 and BSD with advertising and ISC and BSD URL: http://apr.apache.org @@ -17,6 +17,7 @@ Patch4: Fix-pool-debugging-output-so-that-creation-events-ar.patch Patch5: memory-unix-apr_pools.c-apr_pool_cleanup_register.patch Patch6: Follow-up-to-r1675967-trunk-resp.-r1863202-1.7.x.patch Patch7: Register-the-pool-debug-log-cleanup-handler-after-em.patch +Patch8: backport-CVE-2017-12613-Bounds-check-human-readable-date-fields.patch BuildRequires: gcc autoconf libtool libuuid-devel python3 lksctp-tools-devel @@ -100,6 +101,9 @@ make check %doc docs/incomplete_types docs/non_apr_programs %changelog +* Fri Mar 19 2021 yangzhuangzhuang - 1.7.0-3 +- Fix CVE-2017-12613 + * Mon Jun 29 2020 linwei - 1.7.0-2 - sync some patches from community diff --git a/backport-CVE-2017-12613-Bounds-check-human-readable-date-fields.patch b/backport-CVE-2017-12613-Bounds-check-human-readable-date-fields.patch new file mode 100644 index 0000000..374c0a9 --- /dev/null +++ b/backport-CVE-2017-12613-Bounds-check-human-readable-date-fields.patch @@ -0,0 +1,50 @@ +From ad958385a4180d7a83d90589689fcd36e3bbc57a Mon Sep 17 00:00:00 2001 +From: Nick Kew +Date: Sun, 10 Sep 2017 22:30:14 +0000 +Subject: [PATCH] Bounds-check human-readable date fields (credit: Stefan + Sperling) + +git-svn-id: https://svn.apache.org/repos/asf/apr/apr/trunk@1807975 13f79535-47bb-0310-9956-ffa450edef68 +--- + time/unix/time.c | 3 +++ + time/win32/time.c | 6 ++++++ + 2 files changed, 9 insertions(+) + +diff --git a/time/unix/time.c b/time/unix/time.c +index dfa45e690c..7f09581927 100644 +--- a/time/unix/time.c ++++ b/time/unix/time.c +@@ -142,6 +142,9 @@ APR_DECLARE(apr_status_t) apr_time_exp_get(apr_time_t *t, apr_time_exp_t *xt) + static const int dayoffset[12] = + {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275}; + ++ if (xt->tm_mon < 0 || xt->tm_mon >= 12) ++ return APR_EBADDATE; ++ + /* shift new year to 1st March in order to make leap year calc easy */ + + if (xt->tm_mon < 2) +diff --git a/time/win32/time.c b/time/win32/time.c +index 2349799356..1a705443b2 100644 +--- a/time/win32/time.c ++++ b/time/win32/time.c +@@ -54,6 +54,9 @@ static void SystemTimeToAprExpTime(apr_time_exp_t *xt, SYSTEMTIME *tm) + static const int dayoffset[12] = + {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334}; + ++ if (tm->wMonth < 1 || tm->wMonth > 12) ++ return APR_EBADDATE; ++ + /* Note; the caller is responsible for filling in detailed tm_usec, + * tm_gmtoff and tm_isdst data when applicable. + */ +@@ -224,6 +227,9 @@ APR_DECLARE(apr_status_t) apr_time_exp_get(apr_time_t *t, + static const int dayoffset[12] = + {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275}; + ++ if (xt->tm_mon < 0 || xt->tm_mon >= 12) ++ return APR_EBADDATE; ++ + /* shift new year to 1st March in order to make leap year calc easy */ + + if (xt->tm_mon < 2) -- Gitee