import libtirpc-1.3.3-1.el9

SOURCES/libtirpc-1.3.3-blacklist-close.patch

@@ -0,0 +1,51 @@
+commit a013336ecdc476d7357398d9cd24b114070bb767
+Author: Rosen Penev <rosenp@gmail.com>
+Date:   Tue Oct 25 12:34:56 2022 -0400
+
+    Add missing extern
+    
+    Fixes compilation warning.
+    
+    Signed-off-by: Rosen Penev <rosenp@gmail.com>
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff --git a/src/svc_auth.c b/src/svc_auth.c
+index ce8bbd8..789d6af 100644
+--- a/src/svc_auth.c
++++ b/src/svc_auth.c
+@@ -66,6 +66,9 @@ static struct authsvc *Auths = NULL;
+ 
+ extern SVCAUTH svc_auth_none;
+ 
++#ifdef AUTHDES_SUPPORT
++extern enum auth_stat _svcauth_des(struct svc_req *rqst, struct rpc_msg *msg);
++#endif
+ /*
+  * The call rpc message, msg has been obtained from the wire.  The msg contains
+  * the raw form of credentials and verifiers.  authenticate returns AUTH_OK
+
+commit 55526c52a449907e4d34b829b96141afab530b23
+Author: Zhi Li <yieli@redhat.com>
+Date:   Mon Oct 24 13:46:54 2022 -0400
+
+    bindresvport.c: fix a potential resource leakage
+    
+    Close the FILE *fp of load_blacklist() in another
+    return path to avoid potential resource leakage.
+    
+    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2135405
+    Signed-off-by: Zhi Li <yieli@redhat.com>
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff --git a/src/bindresvport.c b/src/bindresvport.c
+index 5c0ddcf..efeb1cc 100644
+--- a/src/bindresvport.c
++++ b/src/bindresvport.c
+@@ -130,6 +130,7 @@ load_blacklist (void)
+ 	  if (list == NULL)
+ 	    {
+ 	      free (buf);
++	      fclose (fp);
+ 	      return;
+ 	    }
+ 	}

SOURCES/libtirpc-1.3.3-clnt-raw-ptr.patch

@@ -0,0 +1,51 @@
+commit 4a2d85c64110ee9e21a8c4f9dafd6b0ae621506d
+Author: Zhi Li <yieli@redhat.com>
+Date:   Fri Oct 28 14:19:04 2022 -0400
+
+    clnt_raw.c: fix a possible null pointer dereference
+    
+    Since clntraw_private could be dereferenced before
+    allocated, protect it by checking its value in advance.
+    
+    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2138317
+    Signed-off-by: Zhi Li <yieli@redhat.com>
+    Signed-off-by: Steve Dickson <steved@redhat.com>
+
+diff --git a/src/clnt_raw.c b/src/clnt_raw.c
+index 31f9d0c..03f839d 100644
+--- a/src/clnt_raw.c
++++ b/src/clnt_raw.c
+@@ -142,7 +142,7 @@ clnt_raw_call(h, proc, xargs, argsp, xresults, resultsp, timeout)
+ 	struct timeval timeout;
+ {
+ 	struct clntraw_private *clp = clntraw_private;
+-	XDR *xdrs = &clp->xdr_stream;
++	XDR *xdrs;
+ 	struct rpc_msg msg;
+ 	enum clnt_stat status;
+ 	struct rpc_err error;
+@@ -154,6 +154,7 @@ clnt_raw_call(h, proc, xargs, argsp, xresults, resultsp, timeout)
+ 		mutex_unlock(&clntraw_lock);
+ 		return (RPC_FAILED);
+ 	}
++	xdrs = &clp->xdr_stream;
+ 	mutex_unlock(&clntraw_lock);
+ 
+ call_again:
+@@ -245,7 +246,7 @@ clnt_raw_freeres(cl, xdr_res, res_ptr)
+ 	void *res_ptr;
+ {
+ 	struct clntraw_private *clp = clntraw_private;
+-	XDR *xdrs = &clp->xdr_stream;
++	XDR *xdrs;
+ 	bool_t rval;
+ 
+ 	mutex_lock(&clntraw_lock);
+@@ -254,6 +255,7 @@ clnt_raw_freeres(cl, xdr_res, res_ptr)
+ 		mutex_unlock(&clntraw_lock);
+ 		return (rval);
+ 	}
++	xdrs = &clp->xdr_stream;
+ 	mutex_unlock(&clntraw_lock);
+ 	xdrs->x_op = XDR_FREE;
+ 	return ((*xdr_res)(xdrs, res_ptr));

SPECS/libtirpc.spec

@@ -2,7 +2,7 @@
 
 Name:			libtirpc
 Version:		1.3.3
-Release:		0%{?dist}
+Release:		1%{?dist}
 Summary:		Transport Independent RPC Library
 License:		SISSL and BSD
 URL:  			http://git.linux-nfs.org/?p=steved/libtirpc.git;a=summary
@@ -13,6 +13,12 @@ BuildRequires:		krb5-devel
 BuildRequires:		gcc
 BuildRequires: make
 
+#
+# RHEL9.2
+#
+Patch001: libtirpc-1.3.3-blacklist-close.patch
+Patch002: libtirpc-1.3.3-clnt-raw-ptr.patch
+
 %description
 This package contains SunLib's implementation of transport-independent
 RPC (TI-RPC) documentation.  This library forms a piece of the base of 
@@ -115,6 +121,10 @@ mv %{buildroot}%{_mandir}/man3 %{buildroot}%{_mandir}/man3t
 * Wed Mar 15 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 1.3.3-0
 - Rebuilt for MSVSphere 9.1.
 
+* Thu Nov 03 2022 Steve Dickson <steved@redhat.com> - 1.3.3-1
+- bindresvport.c: fix a potential resource leakage (bz 2135405)
+- clnt_raw.c: fix a possible null pointer dereference (bz 2138317)
+
 * Mon Aug 15 2022 Steve Dickson <steved@redhat.com> - 1.3.3
 - Rebased to libtirpc-1.3.3 (bz 2118157)