build using clang

SOURCES/0054-curl-7.61.1-CVE-2023-38546.patch

@@ -103,7 +103,7 @@ index b3c0063b2cfb2..41e9e7a6914e0 100644
 -  char *filename;  /* file we read from/write to */
    bool running;    /* state info, for cookie adding information */
 -  long numcookies; /* number of cookies in the "jar" */
-+  int numcookies; /* number of cookies in the "jar" */
++  int numcookies;  /* number of cookies in the "jar" */
    bool newsession; /* new session, discard session cookies on load */
    int lastct;      /* last creation-time used in the jar */
  };

SOURCES/0061-curl-7.61.1-CVE-2024-2398.patch

@@ -1,80 +0,0 @@
-From deca8039991886a559b67bcd6701db800a5cf764 Mon Sep 17 00:00:00 2001
-From: Stefan Eissing <stefan@eissing.org>
-Date: Wed, 6 Mar 2024 09:36:08 +0100
-Subject: [PATCH] http2: push headers better cleanup
-
-- provide common cleanup method for push headers
-
-Closes #13054
----
- lib/http2.c | 34 +++++++++++++++-------------------
- 1 file changed, 15 insertions(+), 19 deletions(-)
-
-diff --git a/lib/http2.c b/lib/http2.c
-index c63ecd38371ab4..96868728a53a1f 100644
---- a/lib/http2.c
-+++ b/lib/http2.c
-@@ -271,6 +271,15 @@ static CURLcode http2_data_setup(struct Curl_cfilter *cf,
-   return http2_perform_getsock(conn, sock, numsocks);
- }
- 
-+static void free_push_headers(struct HTTP *http)
-+{
-+  size_t i;
-+  for(i = 0; i<http->push_headers_used; i++)
-+    free(http->push_headers[i]);
-+  Curl_safefree(http->push_headers);
-+  http->push_headers_used = 0;
-+}
-+
- /*
-  * http2_stream_free() free HTTP2 stream related data
-  */
-@@ -306,11 +315,7 @@ static void http2_data_done(struct Curl_cfilter *cf,
-     http->header_recvbuf = NULL; /* clear the pointer */
-     Curl_add_buffer_free(http->trailer_recvbuf);
-     http->trailer_recvbuf = NULL; /* clear the pointer */
--    for(; http->push_headers_used > 0; --http->push_headers_used) {
--      free(http->push_headers[http->push_headers_used - 1]);
--    }
--    free(http->push_headers);
--    http->push_headers = NULL;
-+    free_push_headers(http);
-   }
- }
- 
-@@ -860,7 +861,6 @@ static int push_promise(struct Curl_cfilter *cf,
-     struct curl_pushheaders heads;
-     CURLMcode rc;
-     struct http_conn *httpc;
--    size_t i;
-     /* clone the parent */
-     struct Curl_easy *newhandle = duphandle(data);
-     if(!newhandle) {
-@@ -904,11 +904,7 @@ static int push_promise(struct Curl_cfilter *cf,
-     Curl_set_in_callback(data, false);
- 
-     /* free the headers again */
--    for(i = 0; i<stream->push_headers_used; i++)
--      free(stream->push_headers[i]);
--    free(stream->push_headers);
--    stream->push_headers = NULL;
--    stream->push_headers_used = 0;
-+    free_push_headers(stream);
- 
-     if(rv) {
-       /* denied, kill off the new handle again */
-@@ -1426,10 +1422,10 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
-             stream->push_headers_alloc) {
-       char **headp;
-       stream->push_headers_alloc *= 2;
--      headp = Curl_saferealloc(stream->push_headers,
--                               stream->push_headers_alloc * sizeof(char *));
-+      headp = realloc(stream->push_headers,
-+                      stream->push_headers_alloc * sizeof(char *));
-       if(!headp) {
--        stream->push_headers = NULL;
-+        free_push_headers(stream);
-         return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
-       }
-       stream->push_headers = headp;

SPECS/curl.spec

@@ -1,7 +1,7 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
 Version: 7.61.1
-Release: 34%{?dist}.2
+Release: 33%{?dist}.5
 License: MIT
 Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz
 
@@ -154,29 +154,26 @@ Patch52:  0052-curl-7.61.1-certs.patch
 # when keyboard-interactive auth fails, try password
 Patch53:  0053-curl-7.61.1-password-when-keyboard-interactive-fails.patch
 
-# cap SFTP packet size sent
+# fix cookie injection with none file (CVE-2023-38546)
-Patch54:  0054-curl-7.61.1-64K-sftp.patch
+Patch54:  0054-curl-7.61.1-CVE-2023-38546.patch
 
 # unify the upload/method handling (CVE-2023-28322)
 Patch55:  0055-curl-7.61.1-CVE-2023-28322.patch
 
-# fix cookie injection with none file (CVE-2023-38546)
-Patch56:  0056-curl-7.61.1-CVE-2023-38546.patch
-
 # consolidate nghttp2_session_mem_recv() call paths
-Patch57:  0057-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch
+Patch56:  0056-curl-7.61.1-consolidate-nghttp2-session-mem-recv.patch
 
 # when marked for closure and wanted to close == OK
-Patch58:  0058-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch
+Patch57:  0057-curl-7.61.1-error-in-the-HTTP2-framing-layer.patch
 
 # lowercase the domain names before PSL checks (CVE-2023-46218)
-Patch59:  0059-curl-7.61.1-CVE-2023-46218.patch
+Patch58:  0058-curl-7.61.1-CVE-2023-46218.patch
 
 # lowercase headernames
-Patch60:  0060-curl-7.61.1-lowercase-headernames.patch
+Patch59:  0059-curl-7.61.1-lowercase-headernames.patch
 
-# provide common cleanup method for push headers (CVE-2024-2398)
+# cap SFTP packet size sent
-Patch61:  0061-curl-7.61.1-CVE-2024-2398.patch
+Patch60:  0060-curl-7.61.1-64K-sftp.patch
 
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
@@ -199,7 +196,7 @@ URL: https://curl.haxx.se/
 BuildRequires: automake
 BuildRequires: brotli-devel
 BuildRequires: coreutils
-BuildRequires: gcc
+BuildRequires: clang
 BuildRequires: groff
 BuildRequires: krb5-devel
 BuildRequires: libidn2-devel
@@ -411,7 +408,6 @@ git apply %{PATCH52}
 %patch58 -p1
 %patch59 -p1
 %patch60 -p1
-%patch61 -p1
 
 # make tests/*.py use Python 3
 sed -e '1 s|^#!/.*python|#!%{__python3}|' -i tests/*.py
@@ -441,6 +437,8 @@ echo "582" >> tests/data/DISABLED
 sed -e 's/^35$/35,52/' -i tests/data/test323
 
 %build
+export CC=/usr/bin/clang
+export CXX=/usr/bin/clang++
 mkdir build-{full,minimal}
 export common_configure_opts=" \
     --cache-file=../config.cache \
@@ -574,20 +572,23 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
 
 %changelog
-* Wed Aug 14 2024 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-34.el8_10.2
+* Wed Jan 24 2024 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-33.el8_9.5
-- provide common cleanup method for push headers (CVE-2024-2398)
+- cap SFTP packet size sent (RHEL-5485)
 
-* Tue Jun 25 2024 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-34.el8_10.1
+* Tue Dec 05 2023 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-33.el8_9.4
-- fix incorrect backport of bz2229800 (RHEL-44684)
-
-* Tue Sep 19 2023 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-34
-- when keyboard-interactive auth fails, try password (#2229800)
-- cap SFTP packet size sent (RHEL-5311)
 - unify the upload/method handling (CVE-2023-28322)
-- fix cookie injection with none file (CVE-2023-38546)
+- fix HTTP2 connection failure with HTTP2 framing layer (RHEL-15296)
-- fix HTTP2 connection failure with HTTP2 framing layer (RHEL-5657)
 - lowercase the domain names before PSL checks (CVE-2023-46218)
 
+* Thu Oct 12 2023 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-33.el8_9.3
+- fix cookie injection with none file (CVE-2023-38546)
+
+* Mon Sep 25 2023 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-33.el8_9.2
+- fix 'incompatible pointer type' reported by OpenScanHub (#2240033)
+
+* Fri Sep 22 2023 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-33.el8_9.1
+- when keyboard-interactive auth fails, try password (#2240033)
+
 * Tue Jun 27 2023 Jacek Migacz <jmigacz@redhat.com> - 7.61.1-33
 - fix host name wildcard checking (CVE-2023-28321)
 - rebuild certs with 2048-bit RSA keys