!17 [sync] PR-14: Fix for CVE-2012-6687 in the FastCGI Package

From: @openeuler-sync-bot 
Reviewed-by: @wk333 
Signed-off-by: @wk333

FCGI-0.78-CVE-2012-6687.patch

@@ -0,0 +1,84 @@
+Description: fix CVE-2012-6687 in bundled libfcgi
+Origin: https://bugs.launchpad.net/ubuntu/+source/libfcgi/+bug/933417
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815840
+Forwarded: https://rt.cpan.org/Ticket/Display.html?id=118405
+
+--- a/os_unix.c
++++ b/os_unix.c
+@@ -36,6 +36,7 @@
+ #include <sys/time.h>
+ #include <sys/un.h>
+ #include <signal.h>
++#include <poll.h>
+ 
+ #ifdef HAVE_NETDB_H
+ #include <netdb.h>
+@@ -97,6 +98,9 @@
+ static int shutdownPending = FALSE;
+ static int shutdownNow = FALSE;
+ 
++static int libfcgiOsClosePollTimeout = 2000;
++static int libfcgiIsAfUnixKeeperPollTimeout = 2000;
++
+ void OS_ShutdownPending()
+ {
+     shutdownPending = TRUE;
+@@ -162,6 +166,16 @@
+     if(libInitialized)
+         return 0;
+ 
++    char *libfcgiOsClosePollTimeoutStr = getenv( "LIBFCGI_OS_CLOSE_POLL_TIMEOUT" );
++    if(libfcgiOsClosePollTimeoutStr) {
++        libfcgiOsClosePollTimeout = atoi(libfcgiOsClosePollTimeoutStr);
++    }
++
++    char *libfcgiIsAfUnixKeeperPollTimeoutStr = getenv( "LIBFCGI_IS_AF_UNIX_KEEPER_POLL_TIMEOUT" );
++    if(libfcgiIsAfUnixKeeperPollTimeoutStr) {
++        libfcgiIsAfUnixKeeperPollTimeout = atoi(libfcgiIsAfUnixKeeperPollTimeoutStr);
++    }
++
+     asyncIoTable = (AioInfo *)malloc(asyncIoTableSize * sizeof(AioInfo));
+     if(asyncIoTable == NULL) {
+         errno = ENOMEM;
+@@ -761,19 +775,16 @@
+     {
+         if (shutdown(fd, 1) == 0)
+         {
+-            struct timeval tv;
+-            fd_set rfds;
++            struct pollfd pfd;
+             int rv;
+             char trash[1024];
+ 
+-            FD_ZERO(&rfds);
++            pfd.fd = fd;
++            pfd.events = POLLIN;
+ 
+             do 
+             {
+-                FD_SET(fd, &rfds);
+-                tv.tv_sec = 2;
+-                tv.tv_usec = 0;
+-                rv = select(fd + 1, &rfds, NULL, NULL, &tv);
++                rv = poll(&pfd, 1, libfcgiOsClosePollTimeout);
+             }
+             while (rv > 0 && read(fd, trash, sizeof(trash)) > 0);
+         }
+@@ -1123,13 +1134,11 @@
+  */
+ static int is_af_unix_keeper(const int fd)
+ {
+-    struct timeval tval = { READABLE_UNIX_FD_DROP_DEAD_TIMEVAL };
+-    fd_set read_fds;
+-
+-    FD_ZERO(&read_fds);
+-    FD_SET(fd, &read_fds);
++    struct pollfd pfd;
++    pfd.fd = fd;
++    pfd.events = POLLIN;
+ 
+-    return select(fd + 1, &read_fds, NULL, NULL, &tval) >= 0 && FD_ISSET(fd, &read_fds);
++    return poll(&pfd, 1, libfcgiIsAfUnixKeeperPollTimeout) >= 0 && (pfd.revents & POLLIN);
+ }
+ 
+ /*

perl-FCGI.spec

@@ -1,17 +1,59 @@
+# Perform functional tests using FCGI::Client.
+# RHEL does not include FCGI::Client due to its dependencies.
+%bcond_with perl_FCGI_enables_client_tests
+
 Name:           perl-FCGI
 Epoch:          1
-Version:        0.78
+Version:        0.82
-Release:        11
+Release:        3
 Summary:        FastCGI Perl bindings
 License:        OML
 URL:            https://metacpan.org/release/FCGI
 Source0:        https://cpan.metacpan.org/authors/id/E/ET/ETHER/FCGI-%{version}.tar.gz
-BuildRequires:  findutils gcc make perl-interpreter perl-devel perl-generators
+Patch0:		    FCGI-0.78-CVE-2012-6687.patch
-BuildRequires:  perl(Config) perl(Cwd) perl(ExtUtils::MakeMaker) >= 6.76
+
-BuildRequires:  perl(File::Copy) perl(Getopt::Long) perl(IO::File)
+# bash for sh executed from Makefile.PL
-BuildRequires:  perl(strict) perl(XSLoader) perl(Test)
+BuildRequires:  bash
-Requires:       perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
+BuildRequires:  coreutils
-Requires:       perl(Carp) perl(XSLoader)
+BuildRequires:  findutils
+BuildRequires:  gcc
+# grep executed by configure
+BuildRequires:  grep
+BuildRequires:  make
+BuildRequires:  perl-devel
+BuildRequires:  perl-generators
+BuildRequires:  perl-interpreter
+BuildRequires:  perl(:VERSION) >= 5.6
+BuildRequires:  perl(Config)
+BuildRequires:  perl(Cwd)
+# ExtUtils::Liblist not used
+BuildRequires:  perl(ExtUtils::MakeMaker) >= 6.76
+BuildRequires:  perl(File::Copy)
+# File::Spec not used on Linux
+BuildRequires:  perl(Getopt::Long)
+BuildRequires:  perl(IO::File)
+# sed executed by configure
+BuildRequires:  sed
+# Run-time:
+# Carp not used at tests
+BuildRequires:  perl(strict)
+BuildRequires:  perl(XSLoader)
+# Tests:
+BuildRequires:  perl(Test)
+%if %{with perl_FCGI_enables_client_tests}
+BuildRequires:  perl(FCGI::Client)
+BuildRequires:  perl(File::Temp)
+BuildRequires:  perl(IO::Socket)
+BuildRequires:  perl(Test::More) >= 0.88
+BuildRequires:  perl(warnings)
+%endif
+Requires:       perl(Carp)
+Requires:       perl(XSLoader)
+# fcgiapp.c, os_unix.c, os_win32.c are copied and modified from FastCGI
+# Developer's Kit of an unknown version, bug #736612
+Provides:       bundled(fcgi)
+
+%{?perl_default_filter}
 
 %description
 FastCGI Perl bingdings.
@@ -26,8 +68,12 @@ Obsoletes:     perl-FCGI-doc < %{epoch}:%{version}-%{release}
 Documentation for developing programs that will use FCGI.
 
 %prep
-%autosetup -n FCGI-%{version} -p1 -S git
+%autosetup -n FCGI-%{version} -p1
 find . -type f -exec chmod -c -x {} +
+%if %{without perl_FCGI_enables_client_tests}
+rm -f t/02-unix_domain_socket.t
+perl -i -ne 'print $_ unless m{^t/02-unix_domain_socket\.t}' MANIFEST
+%endif
 
 %build
 perl Makefile.PL INSTALLDIRS=vendor OPTIMIZE="%{optflags}" NO_PACKLIST=1
@@ -50,6 +96,18 @@ make test
 %doc ChangeLog README
 
 %changelog
-* Tue Apr 14 2020 Jeffery.Gao <gaojianxing@huawei.com> - 1:0.78-11
+* Fri Jan 10 2025 pengjian <pengjian23@mails.ucas.ac.cn> - 1:0.82-3
-- Package init
+- Introduced environment variable-controlled polling timeouts 
+for the close and connection-keeping functions in the os_unix.c file.
 
+* Thu Aug 17 2023 yang-chaohao <yangchaohao@huawei.com> - 1:0.82-2
+- The bcond definition statement format is not recognized. Modified its definition format
+
+* Wed Jul 19 2023 leeffo <liweiganga@uniontech.com> - 1:0.82-1
+- upgrade to version 0.82
+
+* Wed Jun 09 2021 zhaoyao<zhaoyao32@huawei.com> - 1:0.78-12
+- %prep no longer patched with git
+
+* Tue Apr 14 2020 Jeffery.Gao <gaojianxing@huawei.com> - 1:0.78-11
+- Package init