evutil: don't call memset before memcpy

(cherry picked from commit 76df883b3a365e65058da1888b7738e72ace7956)

backport-evutil-don-t-call-memset-before-memcpy.patch

@@ -0,0 +1,39 @@
+From 39073df8318364fc868ab6d90a345ea4fc66e864 Mon Sep 17 00:00:00 2001
+From: Liu Dongmiao <liudongmiao@gmail.com>
+Date: Sat, 30 Mar 2024 21:44:50 +0800
+Subject: [PATCH] evutil: don't call memset before memcpy
+
+In `evutil_parse_sockaddr_port`, it would `memset` the `out` to zero,
+however, the `memset` is unnecessary before `memcpy`, and may cause
+undefined behavior if the `outlen` is invalid.
+
+This should close #1573.
+
+Reference:https://github.com/libevent/libevent/commit/39073df8
+---
+ evutil.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/evutil.c b/evutil.c
+index 9817f08..cc0133f 100644
+--- a/evutil.c
++++ b/evutil.c
+@@ -2216,7 +2216,6 @@ evutil_parse_sockaddr_port(const char *ip_as_string, struct sockaddr *out, int *
+ 		if ((int)sizeof(sin6) > *outlen)
+ 			return -1;
+ 		sin6.sin6_scope_id = if_index;
+-		memset(out, 0, *outlen);
+ 		memcpy(out, &sin6, sizeof(sin6));
+ 		*outlen = sizeof(sin6);
+ 		return 0;
+@@ -2235,7 +2234,6 @@ evutil_parse_sockaddr_port(const char *ip_as_string, struct sockaddr *out, int *
+ 			return -1;
+ 		if ((int)sizeof(sin) > *outlen)
+ 			return -1;
+-		memset(out, 0, *outlen);
+ 		memcpy(out, &sin, sizeof(sin));
+ 		*outlen = sizeof(sin);
+ 		return 0;
+-- 
+2.27.0
+

libevent.spec

@@ -1,6 +1,6 @@
 Name:           libevent
 Version:        2.1.12
-Release:        9
+Release:        10
 Summary:        An event notification library
 
 License:        BSD
@@ -22,6 +22,7 @@ Patch6000: backport-ssl-do-not-trigger-EOF-if-some-data-had-been-successf.patch
 Patch6001: backport-http-eliminate-redundant-bev-fd-manipulating-and-cac.patch
 Patch6002: backport-http-fix-fd-leak-on-fd-reset-by-using-bufferevent_re.patch
 Patch6003: backport-bufferevent-introduce-bufferevent_replacefd-like-set.patch
+Patch6004: backport-evutil-don-t-call-memset-before-memcpy.patch
 
 %description
 Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets,
@@ -82,6 +83,9 @@ rm -f %{buildroot}%{_libdir}/*.la
 
 
 %changelog
+* Mon Apr 01 2024 shixuantong <shixuantong1@huawei.com> - 2.1.12-10
+- evutil: don't call memset before memcpy
+
 * Mon Sep 18 2023 shixuantong <shixuantong1@huawei.com> - 2.1.12-9
 - eliminate redundant bev fd manipulating and caching