<pre style='margin:0'>
Daniel J. Luke (danielluke) pushed a commit to branch master
in repository macports-ports.
</pre>
<p><a href="https://github.com/macports/macports-ports/commit/3359ecd5c414420ff70b700409aee912d4bf980e">https://github.com/macports/macports-ports/commit/3359ecd5c414420ff70b700409aee912d4bf980e</a></p>
<pre style="white-space: pre; background: #F8F8F8">The following commit(s) were added to refs/heads/master by this push:
<span style='display:block; white-space:pre;color:#404040;'> new 3359ecd5c41 apr: add patch for CVE-2021-35940
</span>3359ecd5c41 is described below
<span style='display:block; white-space:pre;color:#808000;'>commit 3359ecd5c414420ff70b700409aee912d4bf980e
</span>Author: Daniel J. Luke <dluke@macports.org>
AuthorDate: Tue Aug 31 10:55:39 2021 -0400
<span style='display:block; white-space:pre;color:#404040;'> apr: add patch for CVE-2021-35940
</span>---
devel/apr/Portfile | 5 ++-
devel/apr/files/apr-1.7.0-CVE-2021-35940.patch | 53 ++++++++++++++++++++++++++
2 files changed, 56 insertions(+), 2 deletions(-)
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/devel/apr/Portfile b/devel/apr/Portfile
</span><span style='display:block; white-space:pre;color:#808080;'>index 222db3cde11..4fdd5b61d59 100644
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/devel/apr/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ b/devel/apr/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -3,7 +3,7 @@ PortSystem 1.0
</span>
name apr
version 1.7.0
<span style='display:block; white-space:pre;background:#ffe0e0;'>-revision 2
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+revision 3
</span> categories devel
maintainers {geeklair.net:dluke @danielluke}
platforms darwin
<span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -42,7 +42,8 @@ configure.args --with-installbuilddir=${prefix}/share/apr-1/build \
</span> patchfiles apr_h_patch.diff \
patch-configure_ipv6.diff \
dynamic_lookup-11.patch \
<span style='display:block; white-space:pre;background:#ffe0e0;'>- patch-configure.diff
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ patch-configure.diff \
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ apr-1.7.0-CVE-2021-35940.patch
</span>
test.run yes
test.target check
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/devel/apr/files/apr-1.7.0-CVE-2021-35940.patch b/devel/apr/files/apr-1.7.0-CVE-2021-35940.patch
</span>new file mode 100644
<span style='display:block; white-space:pre;color:#808080;'>index 00000000000..4d4a45be931
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>--- /dev/null
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ b/devel/apr/files/apr-1.7.0-CVE-2021-35940.patch
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -0,0 +1,53 @@
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+SECURITY: CVE-2021-35940 (cve.mitre.org)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+Restore fix for CVE-2017-12613 which was missing in 1.7.x branch, though
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+was addressed in 1.6.x in 1.6.3 and later via r1807976.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+The fix was merged back to 1.7.x in r1891198.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+Since this was a regression in 1.7.0, a new CVE name has been assigned
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+to track this, CVE-2021-35940.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+Thanks to Iveta Cesalova <icesalov redhat.com> for reporting this issue.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+https://svn.apache.org/viewvc?view=revision&revision=1891198
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+Index: time/unix/time.c
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+===================================================================
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--- time/unix/time.c (revision 1891197)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++++ time/unix/time.c (revision 1891198)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -142,6 +142,9 @@
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ static const int dayoffset[12] =
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275};
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ if (xt->tm_mon < 0 || xt->tm_mon >= 12)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ return APR_EBADDATE;
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ /* shift new year to 1st March in order to make leap year calc easy */
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if (xt->tm_mon < 2)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+Index: time/win32/time.c
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+===================================================================
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--- time/win32/time.c (revision 1891197)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++++ time/win32/time.c (revision 1891198)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -54,6 +54,9 @@
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ static const int dayoffset[12] =
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334};
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ if (tm->wMonth < 1 || tm->wMonth > 12)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ return APR_EBADDATE;
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ /* Note; the caller is responsible for filling in detailed tm_usec,
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ * tm_gmtoff and tm_isdst data when applicable.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ */
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -228,6 +231,9 @@
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ static const int dayoffset[12] =
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275};
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ if (xt->tm_mon < 0 || xt->tm_mon >= 12)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ return APR_EBADDATE;
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ /* shift new year to 1st March in order to make leap year calc easy */
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if (xt->tm_mon < 2)
</span></pre><pre style='margin:0'>
</pre>