From 85d9f736b5d0a546c876becde790ea0fbff77759 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Mon, 29 Jan 2018 17:48:17 +0100
Subject: [PATCH] Process included directories in alphabetical order

---
 ...ed-directories-in-alphabetical-order.patch | 74 +++++++++++++++++++
 krb5.spec                                     |  6 +-
 2 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100644 Process-included-directories-in-alphabetical-order.patch

diff --git a/Process-included-directories-in-alphabetical-order.patch b/Process-included-directories-in-alphabetical-order.patch
new file mode 100644
index 0000000..df80196
--- /dev/null
+++ b/Process-included-directories-in-alphabetical-order.patch
@@ -0,0 +1,74 @@
+From 5d5a6a48e9529fccac9e4c3487577276f8da69ef Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Mon, 29 Jan 2018 12:10:53 +0100
+Subject: [PATCH] Process included directories in alphabetical order
+
+readdir() and FindFirstFile()/FindNextFile() do not define any
+ordering on the entries they return.  Use sorted scandir() instead on
+Unix-likes.
+
+(cherry picked from commit c2734538945d284a21bc8ad17404fca1eecdcf86)
+---
+ src/util/profile/prof_parse.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/src/util/profile/prof_parse.c b/src/util/profile/prof_parse.c
+index 1baceea9e..6c77f3a0c 100644
+--- a/src/util/profile/prof_parse.c
++++ b/src/util/profile/prof_parse.c
+@@ -241,12 +241,18 @@ static int valid_name(const char *filename)
+     }
+     return 1;
+ }
++#ifndef _WIN32
++static int valid_name_scandir(const struct dirent *d)
++{
++    return valid_name(d->d_name);
++}
++#endif
+ 
+ /*
+  * Include files within dirname.  Only files with names ending in ".conf", or
+  * consisting entirely of alphanumeric characters, dashes, and underscores are
+  * included.  This restriction avoids including editor backup files, .rpmsave
+- * files, and the like.
++ * files, and the like.  Files are processed in alphanumeric order.
+  */
+ static errcode_t parse_include_dir(const char *dirname,
+                                    struct profile_node *root_section)
+@@ -287,18 +293,17 @@ cleanup:
+ 
+ #else /* not _WIN32 */
+ 
+-    DIR     *dir;
+     char    *pathname;
+     errcode_t retval = 0;
+-    struct dirent *ent;
++    struct dirent **namelist;
++    int num_ents, i;
+ 
+-    dir = opendir(dirname);
+-    if (dir == NULL)
++    num_ents = scandir(dirname, &namelist, &valid_name_scandir, &alphasort);
++    if (num_ents == -1)
+         return PROF_FAIL_INCLUDE_DIR;
+-    while ((ent = readdir(dir)) != NULL) {
+-        if (!valid_name(ent->d_name))
+-            continue;
+-        if (asprintf(&pathname, "%s/%s", dirname, ent->d_name) < 0) {
++
++    for (i = 0; i < num_ents; i++) {
++        if (asprintf(&pathname, "%s/%s", dirname, namelist[i]->d_name) < 0) {
+             retval = ENOMEM;
+             break;
+         }
+@@ -307,7 +312,8 @@ cleanup:
+         if (retval)
+             break;
+     }
+-    closedir(dir);
++
++    free(namelist);
+     return retval;
+ #endif /* not _WIN32 */
+ }
diff --git a/krb5.spec b/krb5.spec
index b189d73..ac23f76 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.16
 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
-Release: 2
+Release: 3
 
 # lookaside-cached sources; two downloads and a build artifact
 Source0: https://web.mit.edu/kerberos/dist/krb5/1.16/krb5-%{version}%{prerelease}.tar.gz
@@ -60,6 +60,7 @@ Patch33: krb5-1.13-dirsrv-accountlock.patch
 Patch34: krb5-1.9-debuginfo.patch
 Patch35: krb5-1.11-run_user_0.patch
 Patch36: krb5-1.11-kpasswdtest.patch
+Patch37: Process-included-directories-in-alphabetical-order.patch
 
 License: MIT
 URL: http://web.mit.edu/kerberos/www/
@@ -719,6 +720,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Jan 29 2018 Robbie Harwood <rharwood@redhat.com> - 1.16-3
+- Process included directories in alphabetical order
+
 * Tue Dec 12 2017 Robbie Harwood <rharwood@redhat.com> - 1.16-2
 - Fix network service dependencies
 - Resolves: #1525230