-*- coding: utf-8 -*- Changes for APR 1.7.6 *) test/testsock.c (test_get_addr): Fix test to portably switch the socket to non-blocking mode using apr_socket_timeout_set(). Also make the test SKIP for the case where the connect() completes synchronously. [Ivan Zhakov] *) network_io/win32/sockets.c: (apr_socket_connect): Copy the remote address by value rather than by reference. This ensures that the sockaddr object returned by apr_socket_addr_get is allocated from the same pool as the socket object itself, as apr_socket_accept does; avoiding any potential lifetime mismatches. [Ivan Zhakov] *) CMake: Install include/apr_encode.h. [Ivan Zhakov] *) CMake: Fix installation PDB files with multi-config generators. [Ivan Zhakov] Changes for APR 1.7.5 *) SECURITY: CVE-2023-49582: Apache Portable Runtime (APR): Unexpected lax shared memory permissions (cve.mitre.org) Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue. Credits: Thomas Stangner *) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()" and "classic mmap" shared memory implementations. [Joe Orton, Ruediger Pluem] *) Fix missing ';' for XML/HTML hex entities from apr_escape_entity(). [Yann Ylavic] *) Fix crash in apr_pool_create() with --enable-pool-debug=all|owner. [Yann Ylavic] *) Improve platform detection by updating config.guess and config.sub. [Rainer Jung] *) CMake: Add support for CMAKE_WARNING_AS_ERROR. [Ivan Zhakov] *) CMake: Enable support for MSVC runtime library selection by abstraction. [Ivan Zhakov] *) CMake: Export installed targets (libapr-1, apr-1, libaprapp-1, aprapp-1) to apr:: namespace. [Ivan Zhakov] Changes for APR 1.7.4 *) Fix a regression where writing to a file opened with both APR_FOPEN_APPEND and APR_FOPEN_BUFFERED did not properly append the data on Windows. (This regression was introduced in APR 1.7.3) [Evgeny Kotkov] Changes for APR 1.7.3 *) apr-1-config: Fix crosscompiling detection in apr-1-config. PR 66510 [Ruediger Pluem] *) configure: Add --enable-sysv-shm to use SysV shared memory (shmget) if available. [Ruediger Pluem] *) apr_socket_sendfile: Use WSAIoctl() to get TransmitFile function pointer on Windows. [Ivan Zhakov] *) apr_dir_read: Do not request short file names on Windows 7 and later. [Ivan Zhakov] *) apr_file_gets: Optimize for buffered files on Windows. [Evgeny Kotkov] *) Fix a deadlock when writing to locked files opened with APR_FOPEN_APPEND on Windows. PR 50058. [Evgeny Kotkov] *) Don't seek to the end when opening files with APR_FOPEN_APPEND on Windows. [Evgeny Kotkov] *) apr_file_write: Optimize large writes to buffered files on Windows. [Evgeny Kotkov] *) apr_file_read: Optimize large reads from buffered files on Windows. [Evgeny Kotkov] Changes for APR 1.7.2 *) Correct a packaging issue in 1.7.1. The contents of the release were correct, but the top level directory was misnamed. Changes for APR 1.7.1 *) SECURITY: CVE-2022-24963 (cve.mitre.org) Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. *) SECURITY: CVE-2022-28331 (cve.mitre.org) On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow. *) SECURITY: CVE-2021-35940 (cve.mitre.org) Restore fix for out-of-bounds array dereference in apr_time_exp*() functions. (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and later 1.6.x releases, but was missing in 1.7.0.) [Stefan Sperling] *) configure: Fix various build issues for compilers enforcing strict C99 compliance. PR 66396, 66408, 66426. [Florian Weimer <fweimer redhat.com>, Sam James <sam gentoo.org>] *) apr_atomic_read64(): Fix non-atomic read on 32-bit Windows [Ivan Zhakov] *) configure: Prefer posix name-based shared memory over SysV IPC. [Jim Jagielski] *) configure: Add --disable-sctp argument to forcibly disable SCTP support, or --enable-sctp which fails if SCTP support is not detected. [Lubos Uhliarik <luhliari redhat.com>, Joe Orton] *) Fix handle leak in the Win32 apr_uid_current implementation. PR 61165. [Ivan Zhakov] *) Add error handling for lseek() failures in apr_file_write() and apr_file_writev(). [Joe Orton] *) Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp() created file to avoid a fd and inode leak when/if later passed to apr_file_setaside(). [Yann Ylavic] *) APR's configure script uses AC_TRY_RUN to detect whether the return type of strerror_r is int. When cross-compiling this defaults to no. This commit adds an AC_CACHE_CHECK so users who cross-compile APR may influence the outcome with a configure variable. [Sebastian Kemper <sebastian_ml gmx net>] *) Add a cache check with which users who cross-compile APR can influence the outcome of the /dev/zero test by setting the variable ac_cv_mmap__dev_zero=yes [Sebastian Kemper <sebastian_ml gmx net>] *) Trick autoconf into printing the correct default prefix in the help. [Stefan Fritsch] *) Don't try to use PROC_PTHREAD by default when cross compiling. [Yann Ylavic] *) Add the ability to cross compile APR. [Graham Leggett] *) While cross-compiling, the tools/gen_test_char could not be executed at build time, use AX_PROG_CC_FOR_BUILD to build native tools/gen_test_char Support explicit libtool by variable assigning before buildcheck.sh, it is helpful for cross-compiling (such as libtool=aarch64-linux-libtool) [Hongxu Jia <hongxu.jia windriver.com>] *) Avoid an overflow on 32 bit platforms. [René Hjortskov Nielsen <r... hjortskov.dk>] *) Use AC_CHECK_SIZEOF, so as to support cross compiling. PR 56053. [Mike Frysinger <vapier gentoo.org>] *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov] *) apr_pools: Fix pool debugging output so that creation events are always emitted before allocation events and subpool destruction events are emitted on pool clear/destroy for proper accounting. [Brane Čibej] *) apr_socket_listen: Allow larger listen backlog values on Windows 8+. [Evgeny Kotkov <evgeny.kotkov visualsvn.com>] *) Fixed: apr_get_oslevel() was returning APR_WIN_XP on Windows 10 *) Fix attempt to free invalid memory on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix double free on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix a regression in apr_stat() for root path on Windows. [Ivan Zhakov] Changes for APR 1.7.0 *) apr_dir_read: [Unix] Dropped the preference of the dirread_r() flavor for dirread(), because the former is both deprecated and unneeded. [Yann Ylavic, William Rowe] *) apr_file_info: [Win32 only] Treat only "name surrogate" reparse points as symlinks, and not other reparse tag types. PR47630 [Oleg Liatte <olegliatte gmail.com>] *) Test %ld vs. %lld to avoid compiler emits using APR_OFF_T_FMT, in the case of apparently equivilant long and long long types. [William Rowe] *) Recognize APPLE predefined macros as equivilant to DARWIN. [Jim Jagielski] *) Signals: Allow handling of SIGUSR2 in apr_signal_thread. [Yann Ylavic] *) Atomics: Support for 64bit ints. [Jim Jagielski] *) Add the apr_encode_* API that implements RFC4648 and RFC7515 compliant BASE64, BASE64URL, BASE32, BASE32HEX and BASE16 encode/decode functions. [Graham Leggett] *) rand: Use arc4random_buf() on BSD platforms and getrandom() on Linux, when available. [Christian Weisgerber <naddy openbsd.org, Yann Ylavic] *) Add apr_sockaddr_zone_set, apr_sockaddr_zone_set to set and retrieve the zone for link-local IPv6 addresses. [Joe Orton] *) apr_sockaddr_equal: Compare link-local IPv6 addresses with different zones as not equal. [Joe Orton] *) apr_sockaddr_ip_getbuf, apr_sockaddr_ip_get: Append "%zone" for IPv6 link-local addresses. [Joe Orton] *) Locks: add a --disable-timedlocks config option in case users encounter more platforms where it fails [Nick Kew]. *) apr_allocator, apr_pools: Add apr_allocator_page_size() and apr_allocator_min_order_set() to respectively get the (system's) page size in use and set the minimum allocation size for an allocator (expressed in 2^order pages). [Yann Ylavic] *) locks: provide portable implementations of timedlock()s for posix-sems, sysv-sems and pthreads for those platforms that lack native versions (eg: OSX/macOS). [Jim Jagielski] *) locks: Introduce apr_{thread,proc,global}_mutex_timedlock(). [Yann Ylavic] Changes for APR 1.6.x and later: *) http://svn.apache.org/viewvc/apr/apr/branches/1.6.x/CHANGES?view=markup Changes for APR 1.5.x and later: *) http://svn.apache.org/viewvc/apr/apr/branches/1.5.x/CHANGES?view=markup Changes for APR 1.4.x and later: *) http://svn.apache.org/viewvc/apr/apr/branches/1.4.x/CHANGES?view=markup Changes for APR 1.3.x and later: *) http://svn.apache.org/viewvc/apr/apr/branches/1.3.x/CHANGES?view=markup Changes for APR 1.2.x and later: *) http://svn.apache.org/viewvc/apr/apr/branches/1.2.x/CHANGES?view=markup Changes for APR 1.1.x and later: *) http://svn.apache.org/viewvc/apr/apr/branches/1.1.x/CHANGES?view=markup Changes for APR 1.0.x and later: *) http://svn.apache.org/viewvc/apr/apr/branches/1.0.x/CHANGES?view=markup Changes for APR 0.9.x and later/earlier: *) http://svn.apache.org/viewvc/apr/apr/branches/0.9.x/CHANGES?view=markup