diff --git a/.gitignore b/.gitignore
index 4a8feaf..7292af7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@ apr-1.3.9.tar.bz2
 /apr-1.6.3.tar.bz2
 /apr-1.6.5.tar.bz2
 /apr-1.7.0.tar.bz2
+/apr-1.7.0
diff --git a/apr-1.7.0-r1891269+.patch b/apr-1.7.0-r1891269+.patch
new file mode 100644
index 0000000..1949d1a
--- /dev/null
+++ b/apr-1.7.0-r1891269+.patch
@@ -0,0 +1,239 @@
+# ./pullrev.sh 1891269 1891198 1891196
+http://svn.apache.org/viewvc?view=revision&revision=1891269
+http://svn.apache.org/viewvc?view=revision&revision=1891198
+http://svn.apache.org/viewvc?view=revision&revision=1891196
+
+--- apr-1.7.0/include/arch/unix/apr_arch_thread_mutex.h
++++ apr-1.7.0/include/arch/unix/apr_arch_thread_mutex.h
+@@ -33,8 +33,10 @@
+ struct apr_thread_mutex_t {
+     apr_pool_t *pool;
+     pthread_mutex_t mutex;
++#ifndef HAVE_PTHREAD_MUTEX_TIMEDLOCK
+     apr_thread_cond_t *cond;
+     int locked, num_waiters;
++#endif
+ };
+ #endif
+ 
+--- apr-1.7.0/locks/unix/thread_mutex.c
++++ apr-1.7.0/locks/unix/thread_mutex.c
+@@ -102,6 +102,7 @@
+ {
+     apr_status_t rv;
+ 
++#ifndef HAVE_PTHREAD_MUTEX_TIMEDLOCK
+     if (mutex->cond) {
+         apr_status_t rv2;
+ 
+@@ -133,6 +134,7 @@
+ 
+         return rv;
+     }
++#endif
+ 
+     rv = pthread_mutex_lock(&mutex->mutex);
+ #ifdef HAVE_ZOS_PTHREADS
+@@ -148,6 +150,7 @@
+ {
+     apr_status_t rv;
+ 
++#ifndef HAVE_PTHREAD_MUTEX_TIMEDLOCK
+     if (mutex->cond) {
+         apr_status_t rv2;
+ 
+@@ -177,6 +180,7 @@
+ 
+         return rv;
+     }
++#endif
+ 
+     rv = pthread_mutex_trylock(&mutex->mutex);
+     if (rv) {
+@@ -281,6 +285,7 @@
+ {
+     apr_status_t status;
+ 
++#ifndef HAVE_PTHREAD_MUTEX_TIMEDLOCK
+     if (mutex->cond) {
+         status = pthread_mutex_lock(&mutex->mutex);
+         if (status) {
+@@ -303,6 +308,7 @@
+ 
+         mutex->locked = 0;
+     }
++#endif
+ 
+     status = pthread_mutex_unlock(&mutex->mutex);
+ #ifdef HAVE_ZOS_PTHREADS
+@@ -318,9 +324,12 @@
+ {
+     apr_status_t rv, rv2 = APR_SUCCESS;
+ 
++#ifndef HAVE_PTHREAD_MUTEX_TIMEDLOCK
+     if (mutex->cond) {
+         rv2 = apr_thread_cond_destroy(mutex->cond);
+     }
++#endif
++
+     rv = apr_pool_cleanup_run(mutex->pool, mutex, thread_mutex_cleanup);
+     if (rv == APR_SUCCESS) {
+         rv = rv2;
+--- apr-1.7.0/random/unix/sha2.c
++++ apr-1.7.0/random/unix/sha2.c
+@@ -425,7 +425,7 @@
+         usedspace = freespace = 0;
+ }
+ 
+-void apr__SHA256_Final(sha2_byte digest[], SHA256_CTX* context) {
++void apr__SHA256_Final(sha2_byte digest[SHA256_DIGEST_LENGTH], SHA256_CTX* context) {
+         sha2_word32     *d = (sha2_word32*)digest;
+         unsigned int    usedspace;
+ 
+@@ -496,7 +496,7 @@
+         usedspace = 0;
+ }
+ 
+-char *apr__SHA256_End(SHA256_CTX* context, char buffer[]) {
++char *apr__SHA256_End(SHA256_CTX* context, char buffer[SHA256_DIGEST_STRING_LENGTH]) {
+         sha2_byte       digest[SHA256_DIGEST_LENGTH], *d = digest;
+         int             i;
+ 
+--- apr-1.7.0/time/unix/time.c
++++ apr-1.7.0/time/unix/time.c
+@@ -142,6 +142,9 @@
+     static const int dayoffset[12] =
+     {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275};
+ 
++    if (xt->tm_mon < 0 || xt->tm_mon >= 12)
++        return APR_EBADDATE;
++
+     /* shift new year to 1st March in order to make leap year calc easy */
+ 
+     if (xt->tm_mon < 2)
+--- apr-1.7.0/time/win32/time.c
++++ apr-1.7.0/time/win32/time.c
+@@ -54,6 +54,9 @@
+     static const int dayoffset[12] =
+     {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334};
+ 
++    if (tm->wMonth < 1 || tm->wMonth > 12)
++        return APR_EBADDATE;
++
+     /* Note; the caller is responsible for filling in detailed tm_usec,
+      * tm_gmtoff and tm_isdst data when applicable.
+      */
+@@ -228,6 +231,9 @@
+     static const int dayoffset[12] =
+     {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275};
+ 
++    if (xt->tm_mon < 0 || xt->tm_mon >= 12)
++        return APR_EBADDATE;
++
+     /* shift new year to 1st March in order to make leap year calc easy */
+ 
+     if (xt->tm_mon < 2)
+--- apr-1.7.0/file_io/unix/readwrite.c
++++ apr-1.7.0/file_io/unix/readwrite.c
+@@ -146,7 +146,7 @@
+ 
+ APR_DECLARE(apr_status_t) apr_file_write(apr_file_t *thefile, const void *buf, apr_size_t *nbytes)
+ {
+-    apr_size_t rv;
++    apr_size_t rv = APR_SUCCESS;
+ 
+     if (thefile->buffered) {
+         char *pos = (char *)buf;
+@@ -160,13 +160,14 @@
+              * logically reading from
+              */
+             apr_int64_t offset = thefile->filePtr - thefile->dataRead + thefile->bufpos;
+-            if (offset != thefile->filePtr)
+-                lseek(thefile->filedes, offset, SEEK_SET);
++            if (offset != thefile->filePtr) {
++                thefile->filePtr = lseek(thefile->filedes, offset, SEEK_SET);
++                if (thefile->filePtr == -1) rv = errno;
++            }
+             thefile->bufpos = thefile->dataRead = 0;
+             thefile->direction = 1;
+         }
+ 
+-        rv = 0;
+         while (rv == 0 && size > 0) {
+             if (thefile->bufpos == thefile->bufsize)   /* write buffer is full*/
+                 rv = apr_file_flush_locked(thefile);
+@@ -244,12 +245,15 @@
+              */
+             apr_int64_t offset = thefile->filePtr - thefile->dataRead +
+                                  thefile->bufpos;
+-            if (offset != thefile->filePtr)
+-                lseek(thefile->filedes, offset, SEEK_SET);
++            if (offset != thefile->filePtr) {
++                thefile->filePtr = lseek(thefile->filedes, offset, SEEK_SET);
++                if (thefile->filePtr == -1) rv = errno;
++            }
+             thefile->bufpos = thefile->dataRead = 0;
+         }
+ 
+         file_unlock(thefile);
++        if (rv) return rv;
+     }
+ 
+     if ((bytes = writev(thefile->filedes, vec, nvec)) < 0) {
+--- apr-1.7.0/locks/unix/proc_mutex.c
++++ apr-1.7.0/locks/unix/proc_mutex.c
+@@ -1518,11 +1518,10 @@
+ 
+ APR_DECLARE(const char *) apr_proc_mutex_defname(void)
+ {
+-    apr_status_t rv;
+     apr_proc_mutex_t mutex;
+ 
+-    if ((rv = proc_mutex_choose_method(&mutex, APR_LOCK_DEFAULT,
+-                                       NULL)) != APR_SUCCESS) {
++    if (proc_mutex_choose_method(&mutex, APR_LOCK_DEFAULT,
++                                 NULL) != APR_SUCCESS) {
+         return "unknown";
+     }
+ 
+--- apr-1.7.0/memory/unix/apr_pools.c
++++ apr-1.7.0/memory/unix/apr_pools.c
+@@ -1338,7 +1338,7 @@
+     apr_size_t free_index;
+ 
+     pool_concurrency_set_used(pool);
+-    ps.node = active = pool->active;
++    ps.node = pool->active;
+     ps.pool = pool;
+     ps.vbuff.curpos  = ps.node->first_avail;
+ 
+--- apr-1.7.0/test/teststr.c
++++ apr-1.7.0/test/teststr.c
+@@ -394,6 +394,19 @@
+     ABTS_STR_EQUAL(tc, apr_cstr_skip_prefix("",      "12"),    NULL);
+ }
+ 
++static void pstrcat(abts_case *tc, void *data)
++{
++    ABTS_STR_EQUAL(tc, apr_pstrcat(p, "a", "bc", "def", NULL),
++                   "abcdef");
++    ABTS_STR_EQUAL(tc, apr_pstrcat(p, NULL), "");
++    ABTS_STR_EQUAL(tc, apr_pstrcat(p,
++                                   "a", "b", "c", "d", "e",
++                                   "f", "g", "h", "i", "j",
++                                   "1", "2", "3", "4", "5",
++                                   NULL),
++                   "abcdefghij12345");
++}
++
+ abts_suite *teststr(abts_suite *suite)
+ {
+     suite = ADD_SUITE(suite)
+@@ -412,6 +425,7 @@
+     abts_run_test(suite, string_cpystrn, NULL);
+     abts_run_test(suite, snprintf_overflow, NULL);
+     abts_run_test(suite, skip_prefix, NULL);
++    abts_run_test(suite, pstrcat, NULL);
+ 
+     return suite;
+ }
diff --git a/apr.spec b/apr.spec
index ab4f8bd..3b1e068 100644
--- a/apr.spec
+++ b/apr.spec
@@ -6,7 +6,7 @@
 Summary: Apache Portable Runtime library
 Name: apr
 Version: 1.7.0
-Release: 9.2%{?dist}
+Release: 9.3%{?dist}
 # ASL 2.0: everything
 # ISC: network_io/apr-1.4.6/network_io/unix/inet_?to?.c
 # BSD with advertising: strings/apr_snprintf.c, strings/apr_fnmatch.c,
@@ -20,6 +20,7 @@ Source1: apr-wrapper.h
 Patch1: apr-1.2.2-libdir.patch
 Patch2: apr-1.2.7-pkgconf.patch
 Patch3: apr-1.7.0-deepbind.patch
+Patch4: apr-1.7.0-r1891269+.patch
 BuildRequires: gcc, autoconf, libtool, libuuid-devel, python3
 # To enable SCTP support
 BuildRequires: lksctp-tools-devel
@@ -47,6 +48,7 @@ C data structures and routines.
 %patch1 -p1 -b .libdir
 %patch2 -p1 -b .pkgconf
 %patch3 -p1 -b .deepbind
+%patch4 -p1 -b .r1891269+
 
 %build
 # regenerate configure script etc.
@@ -131,6 +133,9 @@ popd
 %{_datadir}/aclocal/*.m4
 
 %changelog
+* Wed Jul  7 2021 Joe Orton <jorton@redhat.com> - 1.7.0-9.3
+- add various Coverity/Clang cleanups (#1977418)
+
 * Fri Jun 18 2021 Joe Orton <jorton@redhat.com> - 1.7.0-9.2
 - package additional build/* files in apr-devel (#1945078)
 
diff --git a/pullrev.sh b/pullrev.sh
new file mode 100755
index 0000000..ca166b0
--- /dev/null
+++ b/pullrev.sh
@@ -0,0 +1,54 @@
+#!/bin/sh -e
+
+if [ $# -lt 1 ]; then
+    echo "What?"
+    exit 1
+fi
+
+repo="https://svn.apache.org/repos/asf/apr/apr/trunk"
+repo="https://svn.apache.org/repos/asf/apr/apr/branches/1.7.x"
+ver=1.7.0
+prefix="apr-${ver}"
+suffix="r$1${2:++}"
+fn="${prefix}-${suffix}.patch"
+vcurl="http://svn.apache.org/viewvc?view=revision&revision="
+
+if test -f ${fn}; then
+    mv -v -f ${fn} ${fn}\~
+    echo "# $0 $*" > ${fn}
+    sed '1{/#.*pullrev/d;};/^--- /,$d' < ${fn}\~ >> ${fn}
+else
+    echo "# $0 $*" > ${fn}
+fi
+
+new=0
+for r in $*; do
+   if ! grep -q "${vcurl}${r}" ${fn}; then
+       echo "${vcurl}${r}"
+       new=1
+   fi
+done >> ${fn}
+
+[ $new -eq 0 ] || echo >> ${fn}
+
+prev=/dev/null
+for r in $*; do
+    echo "+ fetching ${r}"
+    this=`mktemp /tmp/pullrevXXXXXX`
+    svn diff -c ${r} ${repo} | filterdiff --remove-timestamps --clean -x 'CHANGES' -x 'next-number' -x 'STATUS' \
+        --addprefix="${prefix}/" > ${this}
+    next=`mktemp /tmp/pullrevXXXXXX`
+    combinediff --quiet ${prev} ${this} > ${next}
+    rm -f "${this}"
+    [ "${prev}" = "/dev/null" ] || rm -f "${prev}"
+    prev=${next}
+done
+
+cat ${prev} >> ${fn}
+
+vi "${fn}"
+echo "+ git add ${fn}" 
+git add "${fn}"
+echo "+ spec template:"
+echo "PatchN: ${fn}"
+echo "%patchN -p1 -b .${suffix}"