public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/civetweb] epel10.3: Unretirement request: https://forge.fedoraproject.org/releng/fedora-scm-requests/issues/347
@ 2026-08-25 3:02 releng-bot
0 siblings, 0 replies; only message in thread
From: releng-bot @ 2026-08-25 3:02 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/civetweb
Branch : epel10.3
Commit : 43a2526559704aa063c1473dfba82b239c34742e
Author : releng-bot <releng-bot@fedoraproject.org>
Date : 2026-08-24T20:40:47+00:00
Stats : +418/-1 in 8 file(s)
URL : https://src.fedoraproject.org/rpms/civetweb/c/43a2526559704aa063c1473dfba82b239c34742e?branch=epel10.3
Log:
Unretirement request: https://forge.fedoraproject.org/releng/fedora-scm-requests/issues/347
---
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..fa0c9fc
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/civetweb-1.*.tar.gz
diff --git a/0001-CMakeLists.txt.patch b/0001-CMakeLists.txt.patch
new file mode 100644
index 0000000..9c3950f
--- /dev/null
+++ b/0001-CMakeLists.txt.patch
@@ -0,0 +1,13 @@
+--- civetweb-1.16/CMakeLists.txt.orig 2026-02-19 13:25:55.181183928 -0500
++++ civetweb-1.16/CMakeLists.txt 2026-02-19 13:26:24.274831312 -0500
+@@ -1,8 +1,6 @@
+ # Use at least CMake 3.3
+-cmake_minimum_required (VERSION 3.3.0)
+-cmake_policy(VERSION 3.2.2)
+-cmake_policy(SET CMP0054 NEW)
+-cmake_policy(SET CMP0057 NEW)
++cmake_minimum_required (VERSION 3.10)
++cmake_policy(VERSION 3.10)
+
+ # Set up the project
+ project (civetweb)
diff --git a/0002-src-civetweb.c.patch b/0002-src-civetweb.c.patch
new file mode 100644
index 0000000..c66b622
--- /dev/null
+++ b/0002-src-civetweb.c.patch
@@ -0,0 +1,50 @@
+From 76e222bcb77ba8452e5da4e82ae6cecd499c25e0 Mon Sep 17 00:00:00 2001
+From: krispybyte <krispybyte@proton.me>
+Date: Sat, 21 Jun 2025 23:33:50 +0300
+Subject: [PATCH 1/2] Fix heap overflow in directory URI slash redirection
+
+---
+ src/civetweb.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- civetweb-1.16/src/civetweb.c.orig 2023-04-08 11:38:36.000000000 -0400
++++ civetweb-1.16/src/civetweb.c 2025-09-29 15:08:02.385060903 -0400
+@@ -15242,7 +15242,6 @@
+ /* 12. Directory uris should end with a slash */
+ if (file.stat.is_directory && ((uri_len = (int)strlen(ri->local_uri)) > 0)
+ && (ri->local_uri[uri_len - 1] != '/')) {
+-
+ /* Path + server root */
+ size_t buflen = UTF8_PATH_MAX * 2 + 2;
+ char *new_path;
+@@ -15255,12 +15254,26 @@
+ mg_send_http_error(conn, 500, "out or memory");
+ } else {
+ mg_get_request_link(conn, new_path, buflen - 1);
+- strcat(new_path, "/");
++
++ size_t len = strlen(new_path);
++ if (len + 1 < buflen) {
++ new_path[len] = '/';
++ new_path[len + 1] = '\0';
++ len++;
++ }
++
+ if (ri->query_string) {
+- /* Append ? and query string */
+- strcat(new_path, "?");
+- strcat(new_path, ri->query_string);
++ if (len + 1 < buflen) {
++ new_path[len] = '?';
++ new_path[len + 1] = '\0';
++ len++;
++ }
++
++ /* Append with size of space left for query string + null terminator */
++ size_t max_append = buflen - len - 1;
++ strncat(new_path, ri->query_string, max_append);
+ }
++
+ mg_send_http_redirect(conn, new_path, 301);
+ mg_free(new_path);
+ }
diff --git a/0003-src-civetweb.c.patch b/0003-src-civetweb.c.patch
new file mode 100644
index 0000000..36ebb53
--- /dev/null
+++ b/0003-src-civetweb.c.patch
@@ -0,0 +1,239 @@
+From 782e18903515f43bafbf2e668994e82bdfa51133 Mon Sep 17 00:00:00 2001
+From: bel2125 <bel2125@gmail.com>
+Date: Tue, 2 Sep 2025 14:08:41 +0200
+Subject: [PATCH] Make parsing of URL encoded forms more robust
+
+Reject requests that obviously violate the URL encoding.
+Fixes #1348
+---
+ src/civetweb.c | 7 ++++++-
+ src/handle_form.inl | 46 +++++++++++++++++++++++++++++++++++++--------
+ 2 files changed, 44 insertions(+), 9 deletions(-)
+
+--- civetweb-1.16/src/civetweb.c.orig 2025-09-29 15:08:02.385060903 -0400
++++ civetweb-1.16/src/civetweb.c 2025-09-29 15:09:30.128628855 -0400
+@@ -7052,6 +7052,7 @@
+ int is_form_url_encoded)
+ {
+ int i, j, a, b;
++
+ #define HEXTOI(x) (isdigit(x) ? (x - '0') : (x - 'W'))
+
+ for (i = j = 0; (i < src_len) && (j < (dst_len - 1)); i++, j++) {
+@@ -7064,11 +7065,15 @@
+ i += 2;
+ } else if (is_form_url_encoded && (src[i] == '+')) {
+ dst[j] = ' ';
++ } else if ((unsigned char)src[i] <= ' ') {
++ return -1; /* invalid character */
+ } else {
+ dst[j] = src[i];
+ }
+ }
+
++#undef HEXTOI
++
+ dst[j] = '\0'; /* Null-terminate the destination */
+
+ return (i >= src_len) ? j : -1;
+--- ./src/handle_form.inl.orig 2023-04-08 11:38:36.000000000 -0400
++++ ./src/handle_form.inl 2025-09-29 15:09:30.130628822 -0400
+@@ -1,4 +1,4 @@
+-/* Copyright (c) 2016-2021 the Civetweb developers
++/* Copyright (c) 2016-2025 the Civetweb developers
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+@@ -39,7 +39,7 @@
+ mg_url_decode(key, (int)key_len, key_dec, (int)sizeof(key_dec), 1);
+
+ if (((size_t)key_dec_len >= (size_t)sizeof(key_dec)) || (key_dec_len < 0)) {
+- return MG_FORM_FIELD_STORAGE_SKIP;
++ return MG_FORM_FIELD_STORAGE_ABORT;
+ }
+
+ if (filename) {
+@@ -53,7 +53,7 @@
+ || (filename_dec_len < 0)) {
+ /* Log error message and skip this field. */
+ mg_cry_internal(conn, "%s: Cannot decode filename", __func__);
+- return MG_FORM_FIELD_STORAGE_SKIP;
++ return MG_FORM_FIELD_STORAGE_ABORT;
+ }
+ remove_dot_segments(filename_dec);
+
+@@ -95,6 +95,7 @@
+ struct mg_form_data_handler *fdh)
+ {
+ char key_dec[1024];
++ int key_dec_len;
+
+ char *value_dec = (char *)mg_malloc_ctx(*value_len + 1, conn->phys_ctx);
+ int value_dec_len, ret;
+@@ -108,7 +109,8 @@
+ return MG_FORM_FIELD_STORAGE_ABORT;
+ }
+
+- mg_url_decode(key, (int)key_len, key_dec, (int)sizeof(key_dec), 1);
++ key_dec_len = mg_url_decode(
++ key, (int)key_len, key_dec, (int)sizeof(key_dec), 1);
+
+ if (*value_len >= 2 && value[*value_len - 2] == '%')
+ *value_len -= 2;
+@@ -117,6 +119,11 @@
+ value_dec_len = mg_url_decode(
+ value, (int)*value_len, value_dec, ((int)*value_len) + 1, 1);
+
++ if ((key_dec_len < 0) || (value_dec_len < 0)) {
++ mg_free(value_dec);
++ return MG_FORM_FIELD_STORAGE_ABORT;
++ }
++
+ ret = fdh->field_get(key_dec,
+ value_dec,
+ (size_t)value_dec_len,
+@@ -136,9 +143,13 @@
+ struct mg_form_data_handler *fdh)
+ {
+ char key_dec[1024];
++ int key_dec_len;
+ (void)conn;
+
+- mg_url_decode(key, (int)key_len, key_dec, (int)sizeof(key_dec), 1);
++ key_dec_len = mg_url_decode(key, (int)key_len, key_dec, (int)sizeof(key_dec), 1);
++ if (key_dec_len < 0) {
++ return MG_FORM_FIELD_STORAGE_ABORT;
++ }
+
+ return fdh->field_get(key_dec, value, value_len, fdh->user_data);
+ }
+@@ -188,6 +199,7 @@
+ int buf_fill = 0;
+ int r;
+ int field_count = 0;
++ int abort_read = 0;
+ struct mg_file fstore = STRUCT_FILE_INITIALIZER;
+ int64_t file_size = 0; /* init here, to a avoid a false positive
+ "uninitialized variable used" warning */
+@@ -278,6 +290,7 @@
+ conn, data, (size_t)keylen, val, (size_t *)&vallen, fdh);
+ if (r == MG_FORM_FIELD_HANDLE_ABORT) {
+ /* Stop request handling */
++ abort_read = 1;
+ break;
+ }
+ if (r == MG_FORM_FIELD_HANDLE_NEXT) {
+@@ -320,6 +333,7 @@
+ r = field_stored(conn, path, file_size, fdh);
+ if (r == MG_FORM_FIELD_HANDLE_ABORT) {
+ /* Stop request handling */
++ abort_read = 1;
+ break;
+ }
+
+@@ -358,6 +372,7 @@
+ if ((field_storage & MG_FORM_FIELD_STORAGE_ABORT)
+ == MG_FORM_FIELD_STORAGE_ABORT) {
+ /* Stop parsing the request */
++ abort_read = 1;
+ break;
+ }
+
+@@ -386,7 +401,7 @@
+ * Here we use "POST", and read the data from the request body.
+ * The data read on the fly, so it is not required to buffer the
+ * entire request in memory before processing it. */
+- for (;;) {
++ while (!abort_read) {
+ const char *val;
+ const char *next;
+ ptrdiff_t keylen, vallen;
+@@ -440,6 +455,7 @@
+ if ((field_storage & MG_FORM_FIELD_STORAGE_ABORT)
+ == MG_FORM_FIELD_STORAGE_ABORT) {
+ /* Stop parsing the request */
++ abort_read = 1;
+ break;
+ }
+
+@@ -468,6 +484,15 @@
+ } else {
+ vallen = (ptrdiff_t)strlen(val);
+ end_of_key_value_pair_found = all_data_read;
++ if ((buf + buf_fill) > (val + vallen)) {
++ /* Avoid DoS attacks by having a zero byte in the middle of
++ * a request that is supposed to be URL encoded. Since this
++ * request is certainly invalid, according to the protocol
++ * specification, stop processing it. Fixes #1348 */
++ abort_read = 1;
++ break;
++ }
++
+ }
+
+ if (field_storage == MG_FORM_FIELD_STORAGE_GET) {
+@@ -489,6 +514,7 @@
+ get_block++;
+ if (r == MG_FORM_FIELD_HANDLE_ABORT) {
+ /* Stop request handling */
++ abort_read = 1;
+ break;
+ }
+ if (r == MG_FORM_FIELD_HANDLE_NEXT) {
+@@ -557,7 +583,6 @@
+ val = buf;
+ }
+ }
+-
+ } while (!end_of_key_value_pair_found);
+
+ #if !defined(NO_FILESYSTEMS)
+@@ -568,6 +593,7 @@
+ r = field_stored(conn, path, file_size, fdh);
+ if (r == MG_FORM_FIELD_HANDLE_ABORT) {
+ /* Stop request handling */
++ abort_read = 1;
+ break;
+ }
+ } else {
+@@ -581,7 +607,7 @@
+ }
+ #endif /* NO_FILESYSTEMS */
+
+- if (all_data_read && (buf_fill == 0)) {
++ if ((all_data_read && (buf_fill == 0)) || abort_read) {
+ /* nothing more to process */
+ break;
+ }
+@@ -937,6 +963,7 @@
+ get_block++;
+ if (r == MG_FORM_FIELD_HANDLE_ABORT) {
+ /* Stop request handling */
++ abort_read = 1;
+ break;
+ }
+ if (r == MG_FORM_FIELD_HANDLE_NEXT) {
+@@ -1011,6 +1038,7 @@
+ fdh);
+ if (r == MG_FORM_FIELD_HANDLE_ABORT) {
+ /* Stop request handling */
++ abort_read = 1;
+ break;
+ }
+ if (r == MG_FORM_FIELD_HANDLE_NEXT) {
+@@ -1039,6 +1067,7 @@
+ r = field_stored(conn, path, file_size, fdh);
+ if (r == MG_FORM_FIELD_HANDLE_ABORT) {
+ /* Stop request handling */
++ abort_read = 1;
+ break;
+ }
+ } else {
+@@ -1057,6 +1086,7 @@
+ if ((field_storage & MG_FORM_FIELD_STORAGE_ABORT)
+ == MG_FORM_FIELD_STORAGE_ABORT) {
+ /* Stop parsing the request */
++ abort_read = 1;
+ break;
+ }
+
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..b6d5aa3
--- /dev/null
+++ b/README.md
@@ -0,0 +1,3 @@
+# civetweb
+
+The civetweb package
diff --git a/civetweb.spec b/civetweb.spec
new file mode 100644
index 0000000..fc44a2e
--- /dev/null
+++ b/civetweb.spec
@@ -0,0 +1,111 @@
+
+#%%global dev rc1
+
+Name: civetweb
+Summary: Embedded C/C++ web server
+Version: 1.16
+Release: 13%{?dev:%{dev}}%{?dist}
+License: MIT
+Url: https://github.com/civetweb/civetweb
+Source: https://github.com/%{name}/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
+Patch: 0001-CMakeLists.txt.patch
+Patch: 0002-src-civetweb.c.patch
+Patch: 0003-src-civetweb.c.patch
+BuildRequires: cmake make gcc-c++
+
+%description
+Civetweb is an easy to use, powerful, C (C/C++) embeddable web server
+with optional CGI, SSL and Lua support.
+
+CivetWeb can be used by developers as a library, to add web server
+functionality to an existing application. It can also be used by end
+users as a stand-alone web server running on a Windows or Linux PC.
+It is available as single executable, no installation is required.
+
+%package devel
+Summary: Civetweb Client Library C and C++ header files
+Requires: %{name}%{?_isa} = %{version}-%{release}
+
+%description devel
+Civetweb shared libs and associated header files
+
+%prep
+%autosetup -p1
+
+%build
+%{cmake} . \
+ -G "Unix Makefiles" \
+ -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+ -DBUILD_CONFIG=rpmbuild \
+ -DCIVETWEB_ENABLE_CXX:BOOL=ON \
+ -DBUILD_SHARED_LIBS:BOOL=ON \
+ -DCIVETWEB_BUILD_TESTING:BOOL=OFF
+
+export GCC_COLORS=
+export VERBOSE=1
+%cmake_build %{?_smp_mflags}
+
+%install
+%cmake_install
+mkdir -p %{buildroot}%{_docdir}/civetweb
+
+%files
+%{_bindir}/civetweb
+%{_libdir}/libcivetweb.so.*
+%{_libdir}/libcivetweb-cpp.so.*
+%license LICENSE.md
+%doc README.md RELEASE_NOTES.md SECURITY.md
+
+%files devel
+%{_includedir}/*.h
+%{_libdir}/libcivetweb.so
+%{_libdir}/libcivetweb-cpp.so
+%{_libdir}/cmake/civetweb/*
+%{_datadir}/pkgconfig/*
+
+%changelog
+* Thu Feb 19 2026 Kaleb S. KEITHLEY <kkeithle at redhat.com> - 1.16-13
+- civetweb 1.16, handle cmake-4 doesn't support cmake < 3.5
+- upstream, civetweb-1.16+ has updated to minimum cmake-3.10, and there
+ don't seem to be any adverse effects building civetweb with that change.
+ And someday there might even be a civetweb-1.17.
+
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Mon Sep 29 2025 Kaleb S. KEITHLEY <kkeithle at redhat.com> - 1.16-10
+- civetweb 1.16, rhbz 2400162-2400166
+
+* Wed Sep 3 2025 Kaleb S. KEITHLEY <kkeithle at redhat.com> - 1.16-9
+- civetweb 1.16
+
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Wed Jul 16 2025 Kaleb S. KEITHLEY <kkeithle at redhat.com> - 1.16-7
+- civetweb 1.16, rhbz#2380496
+
+* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jan 23 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Apr 11 2023 Kaleb S. KEITHLEY <kkeithle at redhat.com> - 1.16-1
+- civetweb 1.16 GA
+
+* Tue Mar 7 2023 Kaleb S. KEITHLEY <kkeithle at redhat.com> - 1.15-1
+- civetweb 1.15 GA, initial build
+
diff --git a/dead.package b/dead.package
deleted file mode 100644
index 8fa38d2..0000000
--- a/dead.package
+++ /dev/null
@@ -1 +0,0 @@
-unused by any packages
diff --git a/sources b/sources
new file mode 100644
index 0000000..d19ce22
--- /dev/null
+++ b/sources
@@ -0,0 +1 @@
+SHA512 (civetweb-1.16.tar.gz) = a0b943dfc76d7fd47f5a7d2c834fd38ddd4cf01a11730cf2f7cfaf32fea9698f59672f3a0f86ac80e0abc315d94d2367a500d37013f305c87d45e84cf39ca816
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-25 3:02 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-25 3:02 [rpms/civetweb] epel10.3: Unretirement request: https://forge.fedoraproject.org/releng/fedora-scm-requests/issues/347 releng-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox