Issues found with existing distfiles:
distfiles/eclipse-sourceBuild-srcIncluded-3.0.1.zip
distfiles/fortran-utils-1.1.tar.gz
distfiles/ivykis-0.39.tar.gz
distfiles/enum-1.11.tar.gz
distfiles/pvs-3.2-libraries.tgz
distfiles/pvs-3.2-linux.tgz
distfiles/pvs-3.2-solaris.tgz
distfiles/pvs-3.2-system.tgz
No changes made to these distinfo files.
Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden). All existing
SHA1 digests retained for now as an audit trail.
*) MySQL driver: Fix incorrect handling of bad parameter in the
driver support for apr_dbd_transaction_end().
*) apr_crypto_get_driver(): Fix invalid storage reference on error path.
*) Fix compile failure for Android.
*) Fix to let ODBC driver build with MSVC6, which does not have intptr_t
*) Windows cmake build: Fix incompatiblities with Visual Studio
generators with all cmake versions, and the NMake Makefile generator
with cmake 2.8.12 and later.
*) Fix detection of Berkeley DB 6.0.
*) Improve platform detection for bundled expat by updating
config.guess and config.sub.
Changelog:
Changes with APR-util 1.5.3
*) Cygwin: Use correct file extension when loading APR DSOs. Bug 55587.
[Carlo Bramini <carlo.bramix libero.it>]
*) Add experimental cmake-based build system for Windows. Refer to
README.cmake for more information. [Jeff Trawick, Tom Donovan]
*) Fix warnings in odbc driver on 64bit systems.
Bug 55197 [Tom Donovan]
*) Add support to apr_memcache for unix domain sockets. Bug 54573 [Remi
Gacogne <rgacogne+asf aquaray.com>]
*) Add support for Berkeley DB 6.0. [Rainer Jung]
*) Improve platform detection for bundled expat by updating
config.guess and config.sub. [Rainer Jung]
Changes with APR-util 1.5.2
*) Windows: Add command line makefiles. [Gregg Smith]
*) apr_uri_parse(): Do not accept invalid characters in the scheme.
Per RFC 3986 3.3, enforce that the first segment of a relative path does
not contain a colon. PR 52479. [Stefan Fritsch]
*) Fix memory leak in hook sorting function. PR 51256.
[<horowity checkpoint com>]
*) Speedup md5 calculation by avoiding some copying on little endian
architectures. PR 49011. [Stefan Fritsch, Stefan Fuhrmann
<stefanfuhrmann alice-dsl de>]
*) Use heap memory for crypt in apr_password_validate(), to reduce stack
usage. PR 54572. [Stefan Fritsch]
*) Fix password validation failure for all crypt and crypt_r based
algorithms. PR 54603. [Harvey Eneman <harvey.eneman oracle.com>]
*) Fix syntax error in crypto/apr_passwd.c on non-glibc systems. PR 54275.
[Stefan Fritsch]
*) Fix potential data corruption in apr_brigade_write() and friends if
the last bucket of the brigade is a heap bucket that has been split,
and there are still references to the next part of the original bucket
in use. [Stefan Fritsch]
*) Remove duplicated logic in apr_brigade_puts(). PR 53740. [Christophe
Jaillet <christophe jaillet wanadoo fr>]
*) apr_crypto: If --with-crypto is passed to configure but no crypto
libraries are enabled, autodetect available libraries. [Jeff Trawick]
*) memcache: Fix dead server retry logic. [Gavin Shelley <columbusmonkey me.com>]
Changes with APR-util 1.5.1
*) testmemcache: Fix crash. PR 52705. [Peter Poeml <peter poeml de>]
*) MinGW: Support shared builds of apr-util when apr is shared.
PR 46175. [Carlo Bramini <carlo.bramix libero.it>, Jeff Trawick]
*) Add support for Berkeley DB 5.2 and 5.3. Simplify detection script.
PR 53684. [Rainer Jung]
*) configure: Allow to specify library specific custom linker flags
via the LDADD_XXX variables. [Rainer Jung]
*) apr_password_validate(): Fix intermittent errors on systems
such as FreeBSD where the crypt() function is used.
(Broken only in 1.5.0) [Jeff Trawick]
*) Improve platform detection for bundled expat by updating
config.guess and config.sub. [Rainer Jung]
Changes with APR-util 1.5.0
*) dbd_pgsql_escape: Use PQescapeStringConn. [Nick Kew]
*) apr_password_validate, apr_bcrypt_encode: Add support for bcrypt encoded
passwords. The bcrypt implementation uses code from crypt_blowfish
written by Solar Designer <solar openwall com>. apr_bcrypt_encode creates
hashes with "$2y$" prefix, but apr_password_validate also accepts the old
prefix "$2a$". PR 49288. [Stefan Fritsch]
*) APR dbd: Allow to use apr_dbd_get_row() with a different pool than
apr_dbd_select(). PR 53533. [<arthur echo gmail com>]
*) APR dbd FreeTDS support: Fix spurious API errors caused by uninitialized
fields. [TROY.LIU 劉春偉 <TROY.LIU deltaww.com.cn>]
*) apr_password_validate: Increase maximum hash string length to allow
more than 9999 rounds with sha512-crypt. PR 53410. [Stefan Fritsch]
*) Fix segfaults in crypt() and crypt_r() failure modes.
PR 47272. [Arkadiusz Miskiewicz <arekm pld-linux.org>]
*) apr_crypto: Ensure that the if/else that governs the static
initialisation of each crypto driver works when the first driver
isn't in use. [Graham Leggett]
*) apr_crypto: Ensure the *driver variable is initialised when a statically
compiled library is initialised for the first time. [Graham Leggett]
*) apr_crypto: Ensure the *driver variable is initialised when the library
has already been loaded. Fix ported from apr_dbd. [Graham Leggett]
*) apr_crypto: Move the static initialisation of DRIVER_LOAD from
apr_crypto_init() to apr_crypto_get_driver(), so that we don't lose
the parameters. [Graham Leggett]
Changes with APR-util 1.4.3
*) Fix potential data corruption in apr_brigade_write() and friends if
the last bucket of the brigade is a heap bucket that has been split,
and there are still references to the next part of the original bucket
in use. [Stefan Fritsch]
*) Remove duplicated logic in apr_brigade_puts(). PR 53740. [Christophe
Jaillet <christophe jaillet wanadoo fr>]
*) memcache: Fix dead server retry logic. [Gavin Shelley <columbusmonkey me.com>]
*) Improve platform detection for bundled expat by updating
config.guess and config.sub. [Rainer Jung]
*) APR dbd: Allow to use apr_dbd_get_row() with a different pool than
apr_dbd_select(). PR 53533. [<arthur echo gmail com>]
*) APR dbd FreeTDS support: Fix spurious API errors caused by uninitialized
fields. [TROY.LIU 劉春偉 <TROY.LIU deltaww.com.cn>]
*) apr_password_validate: Increase maximum hash string length to allow
more than 9999 rounds with sha512-crypt. PR 53410. [Stefan Fritsch]
*) Fix segfaults in crypt() and crypt_r() failure modes.
PR 47272. [Arkadiusz Miskiewicz <arekm pld-linux.org>]
*) apr_crypto: Ensure that the if/else that governs the static
initialisation of each crypto driver works when the first driver
isn't in use. [Graham Leggett]
*) apr_crypto: Ensure the *driver variable is initialised when a statically
compiled library is initialised for the first time. [Graham Leggett]
*) apr_crypto: Ensure the *driver variable is initialised when the library
has already been loaded. Fix ported from apr_dbd. [Graham Leggett]
Changes with APR-util 1.4.2 (not released)
*) apr_crypto: Move the static initialisation of DRIVER_LOAD from
apr_crypto_init() to apr_crypto_get_driver(), so that we don't lose
the parameters. [Graham Leggett]
Changelog:
Changes with APR-Util 1.4.1
*) Apply Windows build fixes for the apr_crypto API. [Mladen Turk]
Changes with APR-util 1.4.0
*) apr_ldap_init: Pass secure=1 to ldapssl_init() with Solaris LDAP SDK.
PR: 42682 [Stefan Fritsch]
*) apr_memcache_server_create: Fix possible segfault. PR 51064.
[Michajlo Matijkiw <michajlo_matijkiw comcast com>]
*) apr_thread_pool: Fix thread unsafe pool usage. [Stefan Fritsch]
*) Do not include apr.h and apr_errno.h from system search path in
apu_errno.h. PR 46487 [Rainer Jung]
*) Add optional dbm, openssl and nss subpackages to the RPM spec file.
[Graham Leggett]
*) apr_dbd_freetds: The sybdb.h header file might be freetds/sybdb.h
or sybdb.h. [Graham Leggett]
*) Add apr_crypto implementations for OpenSSL and Mozilla NSS. Add a unit
test to verify the interoperability of the two modules. Builds default
to disabled unless explicitly enabled.
[Graham Leggett]
*) Add the apr_crypto interface, a rewrite of the earlier apr_ssl code,
based on the modular dso interface used for dbd and ldap. Initially,
the interface supports symmetrical encryption and decryption. The
purpose of the interface is to offer portable and interoperable
access to basic crypto using the native crypto libraries present on
each platform. [Graham Leggett]
*) Add trace probes to hooks, making it easier to inspect APR Hook based
applications with DTrace or other such mechanisms.
[Theo Schlossnagle <jesus omniti.com>, generalized by Jeff Trawick]
*) Implement resource list when threads are unavailable. PR 24325
[Bojan Smojver]
Changes with APR-util 1.3.13
*) Fix a failure of configure to detect ldap_set_rebind_proc(),
encountered on Fedora 15 with gcc 4.6. [Bojan Smojver]
*) apr_thread_pool: Fix thread unsafe pool usage. [Stefan Fritsch]
*) Improve platform detection for bundled expat by updating
config.guess and config.sub. [Rainer Jung]
*) Sync libtool handling of bundled expat from APR. [Rainer Jung]
- apr_dbd_oracle: fix endianness issue in prepared statements.
Bug 50690. [Stefan Ruppert <sr myarm.com>]
- apr_ldap: resolve possible hangs or crashes when the pool passed
to apr_ldap_rebind_init() is cleaned up and apr_ldap_rebind
is re-initted and re-used. PR50918. [Eric Covener]
- DBD ODBC support: Fix stack buffer overwrite when an unexpected
number of parameters is passed to open. Fix range checking of the
APR DBD type enum passed to some of the APIs. [Jeff Trawick]
- Add support for Berkeley DB 5.1.
[Rainer Jung]
- SECURITY: CVE-2010-1623 (cve.mitre.org)
Fix a denial of service attack against apr_brigade_split_line().
[Stefan Fritsch]
- SECURITY: CVE-2009-3560, CVE-2009-3720 (cve.mitre.org)
Fix two buffer over-read flaws in the bundled copy of expat which
could cause applications to crash while parsing specially-crafted
XML documents. [Joe Orton]
- Upgrade bundled copy of expat library to 1.95.7. [Joe Orton]
- apr_thread_pool: Fix some potential deadlock situations. Bug 49709.
[Joe Mudd <Joe.Mudd sas.com>]
- apr_thread_pool_create: Fix pool corruption caused by multithreaded
use of the pool when multiple initial threads are created. Bug 47843.
[Alex Korobka <akorobka fxcm.com>]
- apr_thread_pool_create(): Only set the output thread pool handle on
success. [Paul Querna]
- DBD ODBC support: Fix memory corruption using apr_dbd_datum_get() with
several different data types, including APR_DBD_TYPE_TIME. Bug 49645.
[<kappa psilambda.com>]
- Add support for Berkeley DB 4.8 and 5.0. Bug 49866, Bug 49179.
[Bernhard Rosenkraenzer <br blankpage.ch>,
Arfrever Frehtes Taifersar Arahesis <arfrever.fta gmail.com>]
- Make bundled expat compatible with libtool 2.x. Bug 49053.
[Rainer Jung]
- Prefer libtool 1.x when searching for libtool in
bundled expat release process. [Rainer Jung, Jim Jagielski]
- Improve platform detection for bundled expat by updating
config.guess and config.sub. [Rainer Jung]
Patch supplied by Mihai Chelaru, approved by Alistair Crooks.
- SECURITY: CVE-2009-2412 (cve.mitre.org)
Fix overflow in rmm, where size alignment was taking place.
[Matt Lewis <mattlewis@google.com>, Sander Striker]
- Make sure that "make check" is used in the RPM spec file, so that
the crypto, dbd and dbm tests pass. [Graham Leggett]
- Make sure the mysql version of dbd_mysql_get_entry() respects the
rule that if the column number exceeds the number of columns, we
return NULL. [Graham Leggett]
- Ensure the dbm module is packaged up correctly in the RPM.
[Graham Leggett]
- Clarify the error messages within the dbd tests. [Graham Leggett]
Changes since 1.3.7:
- Use locally scoped variables in PostgreSQL driver to avoid stomping
on return codes.
- Fix race conditions in initialisation of DBD, DBM and DSO.
- Expose DBM libs in apu-1-config by default. To avoid that, use
apu-1-config --avoid-dbm --libs. To get just DBM libs, use
apu-1-config --dbm-libs.
- Make sure --without-ldap works.
apr-util in version 1.3.5: handle the files
${PREFIX}lib/apr-util-1/apr_dbm_db*, installed by this package when
the package option 'db4' is selected, via another PLIST_VAR, 'db4'.
- SECURITY:
Fix a denial of service attack against the apr_xml_* interface
using the "billion laughs" entity expansion technique.
- SECURITY: CVE-2009-0023 (cve.mitre.org)
Fix underflow in apr_strmatch_precompile.
- Minor build and bug fixes.
- SECURITY: CVE-2009-0023 (cve.mitre.org)
Fix underflow in apr_strmatch_precompile.
- Fix off by one overflow in apr_brigade_vprintf.
- APR_LDAP_SIZELIMIT should prefer LDAP_DEFAULT_LIMIT/-1 when the
SDK supports it, but in the absence of LDAP_DEFAULT_LIMIT (and
LDAP_NO_LIMIT/0) it is not safe to use a literal -1.
Bug 23356
- Clean up ODBC types. Warnings seen when compiling packages for
Fedora 11.
- Use of my_init() requires my_global.h and my_sys.h.
- Fix apr_memcache_multgetp memory corruption and incorrect error
handling. Bug 46588
- Fix memcache memory leak with persistent connections.
Bug 46482
- Add Oracle 11 support.
- apr_dbd_freetds: Avoid segfault when process is NULL.
Do no print diagnostics to stderr. Never allow driver to exit
process.
- apr_dbd_freetds: The sybdb.h header file might be freetds/sybdb.h
or sybdb.h.
- LDAP detection improvements: --with-ldap now supports library names
containing non-alphanumeric characters, such as libldap-2.4.so. New
option --with-lber can be used to override the default liblber name.
Fix a problem reporting the lber library from apu-N-config.
- Suppress pgsql column-out-of-range warning.
- Fix a buffer overrun and password matching for SHA passwords.
- Introduce DSO handling of the db, gdbm and ndbm drivers, so these are
loaded as .so's on first demand, unless --disable-util-dso is configured.
- Fix a segfault in the DBD testcase when the DBD modules were not present.
This changes the buildlink3.mk files to use an include guard for the
recursive include. The use of BUILDLINK_DEPTH, BUILDLINK_DEPENDS,
BUILDLINK_PACKAGES and BUILDLINK_ORDER is handled by a single new
variable BUILDLINK_TREE. Each buildlink3.mk file adds a pair of
enter/exit marker, which can be used to reconstruct the tree and
to determine first level includes. Avoiding := for large variables
(BUILDLINK_ORDER) speeds up parse time as += has linear complexity.
The include guard reduces system time by avoiding reading files over and
over again. For complex packages this reduces both %user and %sys time to
half of the former time.
