[OE-core][scarthgap][PATCH 4/5] apr-util: Fix CVE-2026-34501

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

From: Hetvi Thakar <hthakar@cisco.com>

Backport the upstream Redis response-length and error-checking fix [1]
to address CVE-2026-34501 [2].

[1] https://github.com/apache/apr-util/commit/e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34501

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../apr/apr-util/CVE-2026-34501.patch         | 128 ++++++++++++++++++
 meta/recipes-support/apr/apr-util_1.6.3.bb    |   1 +
 2 files changed, 129 insertions(+)
 create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34501.patch

diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch
new file mode 100644
index 0000000000..0056e62171
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch
@@ -0,0 +1,128 @@
+From e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 3 Aug 2026 12:28:37 +0000
+Subject: [PATCH] Merge r1936809 from aprutil 1.7.x:
+
+Merge r1936808 from apr trunk:
+
+apr_redis error checking
+
+Submitted By: jfclere
+Reviewed By: jfclere, jorton, covener
+
+
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936810 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2026-34501
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2]
+
+(cherry picked from commit e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ redis/apr_redis.c | 54 +++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 43 insertions(+), 11 deletions(-)
+
+diff --git a/redis/apr_redis.c b/redis/apr_redis.c
+index 8d01fdd6..e7fe2071 100644
+--- a/redis/apr_redis.c
++++ b/redis/apr_redis.c
+@@ -853,26 +853,42 @@ APU_DECLARE(apr_status_t) apr_redis_setex(apr_redis_t *rc,
+     return rv;
+ }
+ 
++/* Redis upstream default is 512Mb. This code will try to read the entire
++ * response into a brigade, and then copy that into a pool, so impose
++ * some reasonable limit since RAM consumption will be double this.
++ * https://redis.io/docs/latest/develop/reference/protocol-spec/#bulk-strings
++ */
++#ifndef APR_REDIS_MAX_BULK_LEN
++#define APR_REDIS_MAX_BULK_LEN (64 * 1024 * 1024)
++#endif
++
+ static apr_status_t grab_bulk_resp(apr_redis_server_t *rs, apr_redis_t *rc,
+                                    apr_redis_conn_t *conn, apr_pool_t *p,
+                                    char **baton, apr_size_t *new_length)
+ {
+-    char *length;
++    /* conn->buffer contains "$<length>\r\n" */
++    char *length = conn->buffer + 1;
+     char *last;
+     apr_status_t rv;
+     apr_size_t len = 0;
++    long val;
++
+     *new_length = 0;
++    *baton = NULL;
+ 
+-    length = apr_strtok(conn->buffer + 1, " ", &last);
+-    if (length) {
+-        len = strtol(length, (char **) NULL, 10);
++    errno = 0;
++    last = NULL;
++    val = strtol(length, &last, 10);
++    if (errno || last == NULL || last == length || *last != '\r'
++        || val < 0 || val > APR_REDIS_MAX_BULK_LEN) {
++        rs_bad_conn(rs, conn);
++        if (rc)
++            apr_redis_disable_server(rc, rs);
++        return val > APR_REDIS_MAX_BULK_LEN ? APR_ENOSPC : APR_EGENERAL;
+     }
++    len = (apr_size_t)val;
+ 
+-    if (len == 0) {
+-        *new_length = 0;
+-        *baton = NULL;
+-    }
+-    else {
++    if (len) {
+         apr_bucket_brigade *bbb;
+         apr_bucket *e;
+ 
+@@ -907,6 +923,11 @@ static apr_status_t grab_bulk_resp(apr_redis_server_t *rs, apr_redis_t *rc,
+ 
+         conn->bb = bbb;
+ 
++        if (len < 2) {
++            *baton = NULL;
++            *new_length = 0;
++            return APR_EGENERAL;
++        }
+         *new_length = len - 2;
+         (*baton)[*new_length] = '\0';
+     }
+@@ -992,6 +1013,10 @@ APU_DECLARE(apr_status_t) apr_redis_getp(apr_redis_t *rc,
+     }
+     else if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) {
+         rv = grab_bulk_resp(rs, rc, conn, p, baton, new_length);
++        if (rv != APR_SUCCESS) {
++            /* grab_bulk_resp already called rs_bad_conn; do not also release */
++            return rv;
++        }
+     }
+     else {
+         rv = APR_EGENERAL;
+@@ -1172,12 +1197,19 @@ apr_redis_info(apr_redis_server_t *rs, apr_pool_t *p, char **baton)
+         return rv;
+     }
+ 
+-    if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) {
++    if (strncmp(RS_NOT_FOUND_GET, conn->buffer, RS_NOT_FOUND_GET_LEN) == 0) {
++        rv = APR_NOTFOUND;
++    }
++    else if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) {
+         apr_size_t nl;
+         rv = grab_bulk_resp(rs, NULL, conn, p, baton, &nl);
++        if (rv != APR_SUCCESS) {
++            /* grab_bulk_resp already called rs_bad_conn; do not also release */
++            return rv;
++        }
+     } else {
+         rs_bad_conn(rs, conn);
+-        rv = APR_EGENERAL;
++        return APR_EGENERAL;
+     }
+ 
+     rs_release_conn(rs, conn);
diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb
index 3051a08eaf..341975fbca 100644
--- a/meta/recipes-support/apr/apr-util_1.6.3.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.3.bb
@@ -17,6 +17,7 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \
            file://CVE-2025-49506_p2.patch \
            file://CVE-2026-32327-dependent.patch \
            file://CVE-2026-32327.patch \
+           file://CVE-2026-34501.patch \
            file://run-ptest \
            "
 
-- 
2.35.6