From f09ae85f8c3544b8b84887e6ae40fcff27e9c243 Mon Sep 17 00:00:00 2001
From: chengyechun <chengyechun1@huawei.com>
Date: Wed, 20 Jul 2022 17:33:11 +0800
Subject: [PATCH] fix CVE-2022-28330

---
 backport-CVE-2022-28330.patch | 33 +++++++++++++++++++++++++++++++++
 httpd.spec                    | 11 +++++++++--
 2 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100644 backport-CVE-2022-28330.patch

diff --git a/backport-CVE-2022-28330.patch b/backport-CVE-2022-28330.patch
new file mode 100644
index 0000000..d944fa2
--- /dev/null
+++ b/backport-CVE-2022-28330.patch
@@ -0,0 +1,33 @@
+From 258698607821acfda8f90d9d17e44d18c30f8d77 Mon Sep 17 00:00:00 2001
+From: covener <covener@apache.org>
+Date: Wed, 1 Ju0 2022 12:37:44 UTC
+Subject: [PATCH] mod_isapi:use consistent filename
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/258698607821acfda8f90d9d17e44d18c30f8d77
+
+---
+ modules/arch/win32/mod_isapi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/modules/arch/win32/mod_isapi.c b/modules/arch/win32/mod_isapi.c
+index 5592a57..a9816e5 100644
+--- a/modules/arch/win32/mod_isapi.c
++++ b/modules/arch/win32/mod_isapi.c
+@@ -976,11 +976,11 @@ static int APR_THREAD_FUNC regfnServerSupportFunction(isapi_cid    *cid,
+             return 0;
+         }
+ 
+-        len = (apr_uint32_t)strlen(r->filename);
++        len = (apr_uint32_t)strlen(subreq->filename);
+ 
+         if ((subreq->finfo.filetype == APR_DIR)
+               && (!subreq->path_info)
+-              && (file[len - 1] != '/'))
++              && (subreq->filename[len - 1] != '/'))
+             file = apr_pstrcat(cid->r->pool, subreq->filename, "/", NULL);
+         else
+             file = apr_pstrcat(cid->r->pool, subreq->filename,
+-- 
+2.23.0
+
diff --git a/httpd.spec b/httpd.spec
index 7504176..d8b72da 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -8,7 +8,7 @@
 Name:             httpd
 Summary:          Apache HTTP Server
 Version:          2.4.51
-Release:          6
+Release:          7
 License:          ASL 2.0
 URL:              https://httpd.apache.org/
 Source0:          https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -85,6 +85,7 @@ Patch31:          backport-CVE-2022-26377.patch
 Patch32:          backport-CVE-2022-30522.patch
 Patch33:          backport-CVE-2022-30556.patch
 Patch34:          backport-Switch-from-PCRE-to-PCRE2.patch
+Patch35:          backport-CVE-2022-28330.patch
 
 BuildRequires:    gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel
 BuildRequires:    zlib-devel libselinux-devel lua-devel brotli-devel
@@ -517,7 +518,13 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
-* Sat Jun 25 2022 seuzw <930zhaowei@163.com> - 2.4.51-6
+* Thu Jul 21 2022 chengyechun <chengyechun1@huawei.com> - 2.4.51-7
+- Type:CVE
+- ID:CVE-2022-28330
+- SUG:restart
+- DESC:fix CVE-2022-28330
+
+* Sat Jun 25 2022 seuzw <930zhaowei@163.com> - 2.4.51-5
 - Type:bugfix
 - ID:NA
 - SUG:restart