!186 [sync] PR-183: fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream

From: @openeuler-sync-bot 
Reviewed-by: @sunsuwan 
Signed-off-by: @sunsuwan

backport-CVE-2023-38709-header-validation-after-content.patch

@@ -0,0 +1,97 @@
+From ac20389f3c816d990aba21720f1492b69ac5cb44 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Wed, 3 Apr 2024 12:12:23 +0000
+Subject: [PATCH] header validation after content-* are eval'ed
+ 
+backport r1916770 from trunk
+Submitted By: ylavic
+ 
+ 
+ 
+ 
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916778 13f79535-47bb-0310-9956-ffa450edef68
+ 
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/ac20389f3c816d990aba21720f1492b69ac5cb44
+
+---
+ modules/http/http_filters.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index cef601c..f20aee7 100644
+--- a/modules/http/http_filters.c
++++ b/modules/http/http_filters.c
+@@ -1365,6 +1365,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+          */
+         apr_table_clear(r->headers_out);
+         apr_table_clear(r->err_headers_out);
++        r->content_type = r->content_encoding = NULL;
++        r->content_languages = NULL;
++        r->clength = r->chunked = 0;
+         apr_brigade_cleanup(b);
+ 
+         /* Don't recall ap_die() if we come back here (from its own internal
+@@ -1381,8 +1384,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         APR_BRIGADE_INSERT_TAIL(b, e);
+         e = apr_bucket_eos_create(c->bucket_alloc);
+         APR_BRIGADE_INSERT_TAIL(b, e);
+-        r->content_type = r->content_encoding = NULL;
+-        r->content_languages = NULL;
+         ap_set_content_length(r, 0);
+         recursive_error = 1;
+     }
+@@ -1409,6 +1410,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+     if (!apr_is_empty_table(r->err_headers_out)) {
+         r->headers_out = apr_table_overlay(r->pool, r->err_headers_out,
+                                            r->headers_out);
++        apr_table_clear(r->err_headers_out);
+     }
+ 
+     /*
+@@ -1428,6 +1430,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         fixup_vary(r);
+     }
+ 
++
++    /*
++     * Control cachability for non-cacheable responses if not already set by
++     * some other part of the server configuration.
++     */
++    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
++        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
++        ap_recent_rfc822_date(date, r->request_time);
++        apr_table_addn(r->headers_out, "Expires", date);
++    }
++
+     /*
+      * Now remove any ETag response header field if earlier processing
+      * says so (such as a 'FileETag None' directive).
+@@ -1440,6 +1453,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+     basic_http_header_check(r, &protocol);
+     ap_set_keepalive(r);
+ 
++    /* 204/304 responses don't have content related headers */
+     if (AP_STATUS_IS_HEADER_ONLY(r->status)) {
+         apr_table_unset(r->headers_out, "Transfer-Encoding");
+         apr_table_unset(r->headers_out, "Content-Length");
+@@ -1482,16 +1496,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         apr_table_setn(r->headers_out, "Content-Language", field);
+     }
+ 
+-    /*
+-     * Control cachability for non-cacheable responses if not already set by
+-     * some other part of the server configuration.
+-     */
+-    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
+-        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
+-        ap_recent_rfc822_date(date, r->request_time);
+-        apr_table_addn(r->headers_out, "Expires", date);
+-    }
+-
+     /* This is a hack, but I can't find anyway around it.  The idea is that
+      * we don't want to send out 0 Content-Lengths if it is a head request.
+      * This happens when modules try to outsmart the server, and return
+-- 
+2.33.0
+

backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch

@@ -0,0 +1,201 @@
+From 61645eaac828e2603203d2dfafca938f22580655 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Wed, 3 Apr 2024 11:49:53 +0000
+Subject: [PATCH] let httpd handle CL/TE for non-http handlers
+
+Submitted By: ylavic, covener
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1916769 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/61645eaac828e2603203d2dfafca938f22580655
+
+---
+ include/util_script.h           |  2 ++
+ modules/aaa/mod_authnz_fcgi.c   |  8 ++++++++
+ modules/generators/cgi_common.h | 16 +++++++++++++---
+ modules/http/http_filters.c     | 12 ++++++++++++
+ modules/proxy/ajp_header.c      | 10 ++++++++++
+ modules/proxy/mod_proxy_fcgi.c  |  9 +++++++++
+ modules/proxy/mod_proxy_scgi.c  |  8 ++++++++
+ modules/proxy/mod_proxy_uwsgi.c |  6 ++++++
+ 8 files changed, 68 insertions(+), 3 deletions(-)
+
+diff --git a/include/util_script.h b/include/util_script.h
+index 3566bd3..0557c7f 100644
+--- a/include/util_script.h
++++ b/include/util_script.h
+@@ -225,6 +225,8 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer,
+  */
+ AP_DECLARE(void) ap_args_to_table(request_rec *r, apr_table_t **table);
+ 
++#define AP_TRUST_CGILIKE_CL_ENVVAR "ap_trust_cgilike_cl"
++
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/modules/aaa/mod_authnz_fcgi.c b/modules/aaa/mod_authnz_fcgi.c
+index 1aadcc2..69743f1 100644
+--- a/modules/aaa/mod_authnz_fcgi.c
++++ b/modules/aaa/mod_authnz_fcgi.c
+@@ -571,6 +571,14 @@ static apr_status_t handle_response(const fcgi_provider_conf *conf,
+                                       "parsing -> %d/%d",
+                                       fn, status, r->status);
+ 
++                        /* FCGI has its own body framing mechanism which we don't
++                         * match against any provided Content-Length, so let the
++                         * core determine C-L vs T-E based on what's actually sent.
++                         */
++                        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
++                            apr_table_unset(r->headers_out, "Content-Length");
++                        apr_table_unset(r->headers_out, "Transfer-Encoding");
++
+                         if (rspbuf) { /* caller wants to see response body,
+                                        * if any
+                                        */
+diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h
+index 69df73c..66f9418 100644
+--- a/modules/generators/cgi_common.h
++++ b/modules/generators/cgi_common.h
+@@ -26,6 +26,7 @@
+ 
+ #include "httpd.h"
+ #include "util_filter.h"
++#include "util_script.h"
+ 
+ static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv;
+ static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps;
+@@ -428,9 +429,18 @@ static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb,
+         char sbuf[MAX_STRING_LEN];
+         int ret;
+ 
+-        if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
+-                                                        APLOG_MODULE_INDEX)))
+-        {
++        ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf,
++                                                   APLOG_MODULE_INDEX);
++
++        /* xCGI has its own body framing mechanism which we don't
++         * match against any provided Content-Length, so let the
++         * core determine C-L vs T-E based on what's actually sent.
++         */
++        if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
++            apr_table_unset(r->headers_out, "Content-Length");
++        apr_table_unset(r->headers_out, "Transfer-Encoding");
++
++        if (ret != OK) {
+             /* In the case of a timeout reading script output, clear
+              * the brigade to avoid a second attempt to read the
+              * output. */
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index 1a8df34..cef601c 100644
+--- a/modules/http/http_filters.c
++++ b/modules/http/http_filters.c
+@@ -778,6 +778,18 @@ static APR_INLINE int check_headers(request_rec *r)
+     struct check_header_ctx ctx;
+     core_server_config *conf =
+             ap_get_core_module_config(r->server->module_config);
++    const char *val;
++ 
++    if ((val = apr_table_get(r->headers_out, "Transfer-Encoding"))) {
++        if (apr_table_get(r->headers_out, "Content-Length")) {
++            apr_table_unset(r->headers_out, "Content-Length");
++            r->connection->keepalive = AP_CONN_CLOSE;
++        }
++        if (!ap_is_chunked(r->pool, val)) {
++            r->connection->keepalive = AP_CONN_CLOSE;
++            return 0;
++        }
++    }
+ 
+     ctx.r = r;
+     ctx.strict = (conf->http_conformance != AP_HTTP_CONFORMANCE_UNSAFE);
+diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
+index a09a2e4..0266a7d 100644
+--- a/modules/proxy/ajp_header.c
++++ b/modules/proxy/ajp_header.c
+@@ -17,6 +17,8 @@
+ #include "ajp_header.h"
+ #include "ajp.h"
+ 
++#include "util_script.h"
++
+ APLOG_USE_MODULE(proxy_ajp);
+ 
+ static const char *response_trans_headers[] = {
+@@ -669,6 +671,14 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
+         }
+     }
+ 
++    /* AJP has its own body framing mechanism which we don't
++     * match against any provided Content-Length, so let the
++     * core determine C-L vs T-E based on what's actually sent.
++     */
++    if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
++        apr_table_unset(r->headers_out, "Content-Length");
++    apr_table_unset(r->headers_out, "Transfer-Encoding");
++
+     return APR_SUCCESS;
+ }
+ 
+diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c
+index 831bd15..d420df6 100644
+--- a/modules/proxy/mod_proxy_fcgi.c
++++ b/modules/proxy/mod_proxy_fcgi.c
+@@ -779,6 +779,15 @@ recv_again:
+ 
+                             status = ap_scan_script_header_err_brigade_ex(r, ob,
+                                 NULL, APLOG_MODULE_INDEX);
++
++                            /* FCGI has its own body framing mechanism which we don't
++                             * match against any provided Content-Length, so let the
++                             * core determine C-L vs T-E based on what's actually sent.
++                             */
++                            if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
++                                apr_table_unset(r->headers_out, "Content-Length");
++                            apr_table_unset(r->headers_out, "Transfer-Encoding");
++
+                             /* suck in all the rest */
+                             if (status != OK) {
+                                 apr_bucket *tmp_b;
+diff --git a/modules/proxy/mod_proxy_scgi.c b/modules/proxy/mod_proxy_scgi.c
+index 5444a5c..d63c833 100644
+--- a/modules/proxy/mod_proxy_scgi.c
++++ b/modules/proxy/mod_proxy_scgi.c
+@@ -390,6 +390,14 @@ static int pass_response(request_rec *r, proxy_conn_rec *conn)
+         return status;
+     }
+ 
++    /* SCGI has its own body framing mechanism which we don't
++     * match against any provided Content-Length, so let the
++     * core determine C-L vs T-E based on what's actually sent.
++     */
++    if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR))
++        apr_table_unset(r->headers_out, "Content-Length");
++    apr_table_unset(r->headers_out, "Transfer-Encoding");
++
+     conf = ap_get_module_config(r->per_dir_config, &proxy_scgi_module);
+     if (conf->sendfile && conf->sendfile != scgi_sendfile_off) {
+         short err = 1;
+diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c
+index fd76c95..4e57196 100644
+--- a/modules/proxy/mod_proxy_uwsgi.c
++++ b/modules/proxy/mod_proxy_uwsgi.c
+@@ -404,6 +404,12 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend,
+         return HTTP_BAD_GATEWAY;
+     }
+ 
++    /* T-E wins over C-L */
++    if (apr_table_get(r->headers_out, "Transfer-Encoding")) {
++        apr_table_unset(r->headers_out, "Content-Length");
++        backend->close = 1;
++    }
++
+     if ((buf = apr_table_get(r->headers_out, "Content-Type"))) {
+         ap_set_content_type(r, apr_pstrdup(r->pool, buf));
+     }
+-- 
+2.33.0
+

backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch

@@ -0,0 +1,71 @@
+From 0d73970ec161300a55b630f71bbf72b5c41f28b9 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Wed, 3 Apr 2024 12:12:55 +0000
+Subject: [PATCH] Merge r1916771 from trunk:
+ 
+bail after too many failed reads
+ 
+Submitted By: icing
+ 
+ 
+ 
+ 
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916779 13f79535-47bb-0310-9956-ffa450edef68
+ 
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/0d73970ec161300a55b630f71bbf72b5c41f28b9
+
+---
+ modules/http2/h2_session.c | 10 +++++++---
+ modules/http2/h2_stream.c  |  1 +
+ modules/http2/h2_stream.h  |  1 +
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c
+index 1e560e4..5724fda 100644
+--- a/modules/http2/h2_session.c
++++ b/modules/http2/h2_session.c
+@@ -319,9 +319,13 @@ static int on_header_cb(nghttp2_session *ngh2, const nghttp2_frame *frame,
+     
+     status = h2_stream_add_header(stream, (const char *)name, namelen,
+                                   (const char *)value, valuelen);
+-    if (status != APR_SUCCESS
+-        && (!stream->rtmp
+-            || stream->rtmp->http_status == H2_HTTP_STATUS_UNSET)) {
++    if (status != APR_SUCCESS &&
++        (!stream->rtmp ||
++         stream->rtmp->http_status == H2_HTTP_STATUS_UNSET ||
++         /* We accept a certain amount of failures in order to reply
++          * with an informative HTTP error response like 413. But if the
++          * client is too wrong, we fail the request a RESET of the stream */
++         stream->request_headers_failed > 100)) {
+         return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+     }
+     return 0;
+diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c
+index f6c9202..ee87555 100644
+--- a/modules/http2/h2_stream.c
++++ b/modules/http2/h2_stream.c
+@@ -813,6 +813,7 @@ apr_status_t h2_stream_add_header(h2_stream *stream,
+     
+ cleanup:
+     if (error) {
++        ++stream->request_headers_failed;
+         set_error_response(stream, error);
+         return APR_EINVAL; 
+     }
+diff --git a/modules/http2/h2_stream.h b/modules/http2/h2_stream.h
+index d68d426..405978a 100644
+--- a/modules/http2/h2_stream.h
++++ b/modules/http2/h2_stream.h
+@@ -91,6 +91,7 @@ struct h2_stream {
+     struct h2_request *rtmp;    /* request being assembled */
+     apr_table_t *trailers_in;   /* optional, incoming trailers */
+     int request_headers_added;  /* number of request headers added */
++    int request_headers_failed; /* number of request headers failed to add */
+ 
+ #if AP_HAS_RESPONSE_BUCKETS
+     ap_bucket_response *response; /* the final, non-interim response or NULL */
+-- 
+2.33.0
+

backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch

@@ -0,0 +1,74 @@
+From 8fe3cc79d1bcb4a20a0c56853d82e85c8a88b8f5 Mon Sep 17 00:00:00 2001
+From: Graham Leggett <minfrin@apache.org>
+Date: Mon, 20 Nov 2023 13:17:25 +0000
+Subject: [PATCH] Backport to v2.4:
+
+   *) core: Fix use after free warning with gcc -fanalyzer.
+      trunk patch: http://svn.apache.org/r1892413
+      2.4.x patch: https://svn.apache.org/repos/asf/httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch
+      +1: minfrin, ylavic, jorton
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913983 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:The changelog contains context adaptation and does not contain the STATUS file
+Reference:https://github.com/apache/httpd/commit/8fe3cc79d1bcb4a20a0c56853d82e85c8a88b8f5
+
+---
+ CHANGES           |  2 ++
+ server/mpm_unix.c | 16 ++++++++++------
+ 2 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/CHANGES b/CHANGES
+index 518b39a..c495da0 100644
+--- a/CHANGES
++++ b/CHANGES
+@@ -1,6 +1,8 @@
+                                                          -*- coding: utf-8 -*-
+ Changes with Apache 2.4.59
+ 
++  *) core: Fix use after free warning with gcc -fanalyzer. [Joe Orton]
++
+   *) mod_ssl: release memory to the OS when needed. [Giovanni Bechis]
+ 
+ Changes with Apache 2.4.58
+diff --git a/server/mpm_unix.c b/server/mpm_unix.c
+index 8c4d233..ed4555a 100644
+--- a/server/mpm_unix.c
++++ b/server/mpm_unix.c
+@@ -259,10 +259,12 @@ AP_DECLARE(void) ap_reclaim_child_processes(int terminate,
+         while (cur_extra) {
+             ap_generation_t old_gen;
+             extra_process_t *next = cur_extra->next;
++            pid_t pid = cur_extra->pid;
+ 
+-            if (reclaim_one_pid(cur_extra->pid, action_table[cur_action].action)) {
+-                if (ap_unregister_extra_mpm_process(cur_extra->pid, &old_gen) == 1) {
+-                    mpm_callback(-1, cur_extra->pid, old_gen);
++            if (reclaim_one_pid(pid, action_table[cur_action].action)) {
++                if (ap_unregister_extra_mpm_process(pid, &old_gen) == 1) {
++                    /* cur_extra dangling pointer from here. */
++                    mpm_callback(-1, pid, old_gen);
+                 }
+                 else {
+                     AP_DEBUG_ASSERT(1 == 0);
+@@ -307,10 +309,12 @@ AP_DECLARE(void) ap_relieve_child_processes(ap_reclaim_callback_fn_t *mpm_callba
+     while (cur_extra) {
+         ap_generation_t old_gen;
+         extra_process_t *next = cur_extra->next;
++        pid_t pid = cur_extra->pid;
+ 
+-        if (reclaim_one_pid(cur_extra->pid, DO_NOTHING)) {
+-            if (ap_unregister_extra_mpm_process(cur_extra->pid, &old_gen) == 1) {
+-                mpm_callback(-1, cur_extra->pid, old_gen);
++        if (reclaim_one_pid(pid, DO_NOTHING)) {
++            if (ap_unregister_extra_mpm_process(pid, &old_gen) == 1) {
++                /* cur_extra dangling pointer from here. */
++                mpm_callback(-1, pid, old_gen);
+             }
+             else {
+                 AP_DEBUG_ASSERT(1 == 0);
+-- 
+2.33.0
+

backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch

@@ -0,0 +1,55 @@
+From 32881a76e31f8bafa498999bae5237c3a6418317 Mon Sep 17 00:00:00 2001
+From: Jean-Frederic Clere <jfclere@apache.org>
+Date: Wed, 14 Feb 2024 14:27:03 +0000
+Subject: [PATCH] * mod_slotmem_shm: Use ap_os_is_path_absolute() to make it
+ portable.
+
+Reviewed by: jfclere, jorton, covener
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1915791 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/32881a76e31f8bafa498999bae5237c3a6418317
+
+---
+ changes-entries/mod_slotmem_shm.txt | 3 +++
+ modules/slotmem/mod_slotmem_shm.c   | 4 ++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+ create mode 100644 changes-entries/mod_slotmem_shm.txt
+
+diff --git a/changes-entries/mod_slotmem_shm.txt b/changes-entries/mod_slotmem_shm.txt
+new file mode 100644
+index 0000000..767711f
+--- /dev/null
++++ b/changes-entries/mod_slotmem_shm.txt
+@@ -0,0 +1,3 @@
++   *) mod_slotmem_shm: Use ap_os_is_path_absolute() to make it portable.
++      [Jean-Frederic Clere]
++
+diff --git a/modules/slotmem/mod_slotmem_shm.c b/modules/slotmem/mod_slotmem_shm.c
+index f4eaa84..4d14faf 100644
+--- a/modules/slotmem/mod_slotmem_shm.c
++++ b/modules/slotmem/mod_slotmem_shm.c
+@@ -92,7 +92,7 @@ static int slotmem_filenames(apr_pool_t *pool,
+     const char *fname = NULL, *pname = NULL;
+ 
+     if (slotname && *slotname && strcasecmp(slotname, "none") != 0) {
+-        if (slotname[0] != '/') {
++        if (!ap_os_is_path_absolute(pool, slotname)) {
+             /* Each generation needs its own file name. */
+             int generation = 0;
+             ap_mpm_query(AP_MPMQ_GENERATION, &generation);
+@@ -109,7 +109,7 @@ static int slotmem_filenames(apr_pool_t *pool,
+ 
+         if (persistname) {
+             /* Persisted file names are immutable... */
+-            if (slotname[0] != '/') {
++            if (!ap_os_is_path_absolute(pool, slotname)) {
+                 pname = apr_pstrcat(pool, DEFAULT_SLOTMEM_PREFIX,
+                                     slotname, DEFAULT_SLOTMEM_SUFFIX,
+                                     DEFAULT_SLOTMEM_PERSIST_SUFFIX,
+-- 
+2.33.0
+

backport-release-memory-to-the-OS-when-needed.patch

@@ -0,0 +1,101 @@
+From 80560d29c8bc6dac44c8a7f7767e54e0ec52c5e6 Mon Sep 17 00:00:00 2001
+From: Graham Leggett <minfrin@apache.org>
+Date: Sat, 18 Nov 2023 11:20:14 +0000
+Subject: [PATCH] Backport to v2.4:
+
+  *) mod_ssl: release memory to the OS when needed
+     Trunk version of patch:
+       https://svn.apache.org/r1898410
+       https://svn.apache.org/r1898366
+        svn merge -c 1898366 ^/httpd/httpd/trunk .
+        svn merge -c 1898410 ^/httpd/httpd/trunk .
+     +1: gbechis, ylavic, jorton
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913909 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:The changelog contains context adaptation and does not contain the STATUS file
+Reference:https://github.com/apache/httpd/commit/80560d29c8bc6dac44c8a7f7767e54e0ec52c5e6
+
+---
+ CHANGES                         | 4 ++++
+ modules/ssl/ssl_engine_init.c   | 7 ++++++-
+ modules/ssl/ssl_util_ocsp.c     | 5 ++++-
+ modules/ssl/ssl_util_stapling.c | 4 +++-
+ 4 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/CHANGES b/CHANGES
+index 4a2aa4a..518b39a 100644
+--- a/CHANGES
++++ b/CHANGES
+@@ -1,4 +1,8 @@
+                                                          -*- coding: utf-8 -*-
++Changes with Apache 2.4.59
++
++  *) mod_ssl: release memory to the OS when needed. [Giovanni Bechis]
++
+ Changes with Apache 2.4.58
+ 
+   *) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
+diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
+index 3d0d0b8..e42672e 100644
+--- a/modules/ssl/ssl_engine_init.c
++++ b/modules/ssl/ssl_engine_init.c
+@@ -1801,6 +1801,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
+         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02208)
+                      "SSL proxy client cert initialization failed");
+         ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
++        sk_X509_INFO_free(sk);
+         return ssl_die(s);
+     }
+ 
+@@ -1810,7 +1811,11 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
+         int i;
+ 
+         X509_INFO *inf = sk_X509_INFO_value(pkp->certs, n);
+-        X509_STORE_CTX_init(sctx, store, inf->x509, NULL);
++        if (!X509_STORE_CTX_init(sctx, store, inf->x509, NULL)) {
++            sk_X509_INFO_free(sk);
++            X509_STORE_CTX_free(sctx);
++            return ssl_die(s);
++        }
+ 
+         /* Attempt to verify the client cert */
+         if (X509_verify_cert(sctx) != 1) {
+diff --git a/modules/ssl/ssl_util_ocsp.c b/modules/ssl/ssl_util_ocsp.c
+index b9c8a0b..a202a72 100644
+--- a/modules/ssl/ssl_util_ocsp.c
++++ b/modules/ssl/ssl_util_ocsp.c
+@@ -370,8 +370,11 @@ static STACK_OF(X509) *modssl_read_ocsp_certificates(const char *file)
+     while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) {
+         if (!other_certs) {
+                 other_certs = sk_X509_new_null();
+-                if (!other_certs)
++                if (!other_certs) {
++                        X509_free(x509);
++                        BIO_free(bio);
+                         return NULL;
++                }
+         }
+                 
+         if (!sk_X509_push(other_certs, x509)) {
+diff --git a/modules/ssl/ssl_util_stapling.c b/modules/ssl/ssl_util_stapling.c
+index c9d1d8e..a2ed99b 100644
+--- a/modules/ssl/ssl_util_stapling.c
++++ b/modules/ssl/ssl_util_stapling.c
+@@ -117,8 +117,10 @@ static X509 *stapling_get_issuer(modssl_ctx_t *mctx, X509 *x)
+     }
+ 
+     inctx = X509_STORE_CTX_new();
+-    if (!X509_STORE_CTX_init(inctx, st, NULL, NULL))
++    if (!X509_STORE_CTX_init(inctx, st, NULL, NULL)) {
++        X509_STORE_CTX_free(inctx);
+         return 0;
++    }
+     if (X509_STORE_CTX_get1_issuer(&issuer, inctx, x) <= 0)
+         issuer = NULL;
+     X509_STORE_CTX_cleanup(inctx);
+-- 
+2.33.0
+

backport-remove-dependency-on-xmlstring-header.patch

@@ -0,0 +1,45 @@
+From 27a68e54b7c6d2ae80dca396fd2727852897dab1 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 21 Nov 2023 12:58:47 +0000
+Subject: [PATCH] mod_xml2enc: remove dependency on xmlstring header
+
+Submitted by: ttachi <tachihara@hotmail.com>
+
+Github: closes #393
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1914013 13f79535-47bb-0310-9956-ffa450edef68
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/27a68e54b7c6d2ae80dca396fd2727852897dab1
+
+---
+ changes-entries/xmlchar.txt   | 2 ++
+ modules/filters/mod_xml2enc.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+ create mode 100644 changes-entries/xmlchar.txt
+
+diff --git a/changes-entries/xmlchar.txt b/changes-entries/xmlchar.txt
+new file mode 100644
+index 0000000..d0e0630
+--- /dev/null
++++ b/changes-entries/xmlchar.txt
+@@ -0,0 +1,2 @@
++ *) mod_xml2enc: Tolerate libxml2 2.12.0 and later.
++    [ttachi <tachihara AT hotmail.com>]
+diff --git a/modules/filters/mod_xml2enc.c b/modules/filters/mod_xml2enc.c
+index 76046b4..4f9a897 100644
+--- a/modules/filters/mod_xml2enc.c
++++ b/modules/filters/mod_xml2enc.c
+@@ -209,7 +209,7 @@ static void sniff_encoding(request_rec* r, xml2ctx* ctx)
+   
+     /* to sniff, first we look for BOM */
+     if (ctx->xml2enc == XML_CHAR_ENCODING_NONE) {
+-        ctx->xml2enc = xmlDetectCharEncoding((const xmlChar*)ctx->buf,
++        ctx->xml2enc = xmlDetectCharEncoding((const unsigned char*)ctx->buf,
+                                              ctx->bytes); 
+         if (HAVE_ENCODING(ctx->xml2enc)) {
+             ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(01432)
+-- 
+2.33.0
+

httpd.spec

@@ -8,7 +8,7 @@
 Name:             httpd
 Summary:          Apache HTTP Server
 Version:          2.4.58
-Release:          1
+Release:          2
 License:          ASL 2.0
 URL:              https://httpd.apache.org/
 Source0:          https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -69,6 +69,13 @@ Patch15:          backport-httpd-2.4.43-gettid.patch
 Patch16:          backport-httpd-2.4.43-r1861793+.patch
 Patch17:          backport-httpd-2.4.48-r1828172+.patch
 Patch18:          backport-httpd-2.4.46-htcacheclean-dont-break.patch
+Patch19:          backport-release-memory-to-the-OS-when-needed.patch
+Patch20:          backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch
+Patch21:          backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch
+Patch22:          backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch
+Patch23:          backport-CVE-2023-38709-header-validation-after-content.patch
+Patch24:          backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch
+Patch25:          backport-remove-dependency-on-xmlstring-header.patch
 
 BuildRequires:    gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel
 BuildRequires:    zlib-devel libselinux-devel lua-devel brotli-devel
@@ -505,6 +512,12 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Mon May 06 2024 chengyechun <chengyechun1@huaiwe.com> - 2.4.58-2
+- Type:CVE
+- ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
+- SUG:NA
+- DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream
+
 * Mon Jan 29 2024 chengyechun <chengyechun1@huawei.com> - 2.4.58-1
 - Type:enhancement
 - ID:NA