[rpms/civetweb] new: rhbz#2391892

[Kaleb S. KEITHLEY <kkeithle@redhat.com>]

A new commit has been pushed.

Repo   : rpms/civetweb
Branch : new
Commit : db495affcd1cb3651614324adf4637b90dac6138
Author : Kaleb S. KEITHLEY <kkeithle@redhat.com>
Date   : 2025-09-03T08:51:22-04:00
Stats  : +88/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/civetweb/c/db495affcd1cb3651614324adf4637b90dac6138?branch=new

Log:
rhbz#2391892

---
diff --git a/0002-src-civetweb.c.patch b/0002-src-civetweb.c.patch
new file mode 100644
index 0000000..fc3a024
--- /dev/null
+++ b/0002-src-civetweb.c.patch
@@ -0,0 +1,83 @@
+From 76e222bcb77ba8452e5da4e82ae6cecd499c25e0 Mon Sep 17 00:00:00 2001
+From: krispybyte <krispybyte@proton.me>
+Date: Sat, 21 Jun 2025 23:33:50 +0300
+Subject: [PATCH 1/2] Fix heap overflow in directory URI slash redirection
+
+---
+ src/civetweb.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/src/civetweb.c b/src/civetweb.c
+index bbc9aa8be..e969c939f 100644
+--- a/src/civetweb.c
++++ b/src/civetweb.c
+@@ -15579,7 +15579,6 @@ handle_request(struct mg_connection *conn)
+ 	/* 12. Directory uris should end with a slash */
+ 	if (file.stat.is_directory && ((uri_len = (int)strlen(ri->local_uri)) > 0)
+ 	    && (ri->local_uri[uri_len - 1] != '/')) {
+-
+ 		/* Path + server root */
+ 		size_t buflen = UTF8_PATH_MAX * 2 + 2;
+ 		char *new_path;
+@@ -15592,12 +15591,26 @@ handle_request(struct mg_connection *conn)
+ 			mg_send_http_error(conn, 500, "out or memory");
+ 		} else {
+ 			mg_get_request_link(conn, new_path, buflen - 1);
+-			strcat(new_path, "/");
++
++			size_t len = strlen(new_path);
++			if (len + 1 < buflen) {
++				new_path[len] = '/';
++				new_path[len + 1] = '\0';
++				len += 1;
++			}
++
+ 			if (ri->query_string) {
+-				/* Append ? and query string */
+-				strcat(new_path, "?");
+-				strcat(new_path, ri->query_string);
++				if (len + 1 < buflen) {
++					new_path[len] = '?';
++					new_path[len + 1] = '\0';
++					len += 1;
++				}
++
++				/* Append with size of space left for query string + null terminator */
++				size_t max_append = buflen - len - 1;
++				strncat(new_path, ri->query_string, max_append);
+ 			}
++
+ 			mg_send_http_redirect(conn, new_path, 301);
+ 			mg_free(new_path);
+ 		}
+
+From d5321963b1d0bc953101de91f8588bf83db73bf5 Mon Sep 17 00:00:00 2001
+From: krispybyte <krispybyte@proton.me>
+Date: Sun, 22 Jun 2025 00:23:06 +0300
+Subject: [PATCH 2/2] Fit code style
+
+---
+ src/civetweb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/civetweb.c b/src/civetweb.c
+index e969c939f..6af91f874 100644
+--- a/src/civetweb.c
++++ b/src/civetweb.c
+@@ -15596,14 +15596,14 @@ handle_request(struct mg_connection *conn)
+ 			if (len + 1 < buflen) {
+ 				new_path[len] = '/';
+ 				new_path[len + 1] = '\0';
+-				len += 1;
++				len++;
+ 			}
+ 
+ 			if (ri->query_string) {
+ 				if (len + 1 < buflen) {
+ 					new_path[len] = '?';
+ 					new_path[len + 1] = '\0';
+-					len += 1;
++					len++;
+ 				}
+ 
+ 				/* Append with size of space left for query string + null terminator */

diff --git a/civetweb.spec b/civetweb.spec
index a6d4688..f8a5262 100644
--- a/civetweb.spec
+++ b/civetweb.spec
@@ -4,11 +4,12 @@
 Name:           civetweb
 Summary:        Embedded C/C++ web server
 Version:        1.16
-Release:        8%{?dev:%{dev}}%{?dist}
+Release:        9%{?dev:%{dev}}%{?dist}
 License:        MIT
 Url:            https://github.com/civetweb/civetweb
 Source:         https://github.com/%{name}/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 Patch:		0001-CMakeLists.txt.patch
+Patch:		0002-src-civetweb.c.patch
 BuildRequires:  cmake make gcc-c++
 
 %description
@@ -62,6 +63,9 @@ mkdir -p %{buildroot}%{_docdir}/civetweb
 %{_datadir}/pkgconfig/*
 
 %changelog
+* Wed Sep 3 2025 Kaleb S. KEITHLEY <kkeithle at redhat.com> - 1.16-9
+- civetweb 1.16
+
 * Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.16-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild