[OE-core][scarthgap][PATCH 5/5] apr-util: Fix CVE-2026-34502

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

From: Hetvi Thakar <hthakar@cisco.com>

Backport the upstream memcache validation fix [1] and its follow-up
parsing correction [2] to address CVE-2026-34502 [3].

[1] https://github.com/apache/apr-util/commit/f1c98dd0847c43375daf3789c936685adbc6d872
[2] https://github.com/apache/apr-util/commit/997c02ce5b9db44083c580e3e47095f5ac4524ae
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34502

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../apr/apr-util/CVE-2026-34502_p1.patch      | 106 ++++++++++++++++++
 .../apr/apr-util/CVE-2026-34502_p2.patch      |  38 +++++++
 meta/recipes-support/apr/apr-util_1.6.3.bb    |   2 +
 3 files changed, 146 insertions(+)
 create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch
 create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch

diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch
new file mode 100644
index 0000000000..d4c6cb39b4
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch
@@ -0,0 +1,106 @@
+From f1c98dd0847c43375daf3789c936685adbc6d872 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 3 Aug 2026 12:33:18 +0000
+Subject: [PATCH] Merge r1936812 from aprutil 1.7.x:
+
+Merge r1936811 from apr trunk:
+
+apr_memcache: error checking
+
+Reviewed By: covener, jorton, jfclere
+
+
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936813 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2026-34502
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/f1c98dd0847c43375daf3789c936685adbc6d872]
+
+(cherry picked from commit f1c98dd0847c43375daf3789c936685adbc6d872)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ memcache/apr_memcache.c | 31 ++++++++++++++++++++++++++++---
+ 1 file changed, 28 insertions(+), 3 deletions(-)
+
+diff --git a/memcache/apr_memcache.c b/memcache/apr_memcache.c
+index 2c7bd1de..137be778 100644
+--- a/memcache/apr_memcache.c
++++ b/memcache/apr_memcache.c
+@@ -595,6 +595,11 @@ static apr_status_t get_server_line(apr_memcache_conn_t *conn)
+     conn->blen = bsize;
+     conn->buffer[bsize] = '\0';
+ 
++    /* Validate CRLF line termination to prevent integer underflow attacks */
++    if (bsize < 2 || conn->buffer[bsize-2] != '\r' || conn->buffer[bsize-1] != '\n') {
++        return APR_EGENERAL;
++    }
++
+     return apr_brigade_cleanup(conn->tb);
+ }
+ 
+@@ -1087,9 +1092,14 @@ apr_memcache_version(apr_memcache_server_t *ms,
+     }
+ 
+     if (strncmp(MS_VERSION, conn->buffer, MS_VERSION_LEN) == 0) {
+-        *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1, 
+-                                conn->blen - MS_VERSION_LEN - 2);
+-        rv = APR_SUCCESS;
++        if (conn->blen < MS_VERSION_LEN + 2) {
++            rv = APR_EGENERAL;
++        }
++        else {
++            *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1, 
++                                    conn->blen - MS_VERSION_LEN - 2);
++            rv = APR_SUCCESS;
++       } 
+     }
+     else {
+         rv = APR_EGENERAL;
+@@ -1555,23 +1565,35 @@ apr_memcache_multgetp(apr_memcache_t *mc,
+ static const char *stat_read_string(apr_pool_t *p, char *buf, apr_size_t len)
+ {
+     /* remove trailing \r\n and null char */
++    if (len < 2) {
++        return apr_pstrdup(p, "");
++    }
+     return apr_pstrmemdup(p, buf, len-2);
+ }
+ 
+ static apr_uint32_t stat_read_uint32(apr_pool_t *p, char *buf, apr_size_t  len)
+ {
++    if (len < 2) {
++        return 0;
++    }
+     buf[len-2] = '\0';
+     return atoi(buf);
+ }
+ 
+ static apr_uint64_t stat_read_uint64(apr_pool_t *p, char *buf, apr_size_t  len)
+ {
++    if (len < 2) {
++        return 0;
++    }
+     buf[len-2] = '\0';
+     return apr_atoi64(buf);
+ }
+ 
+ static apr_time_t stat_read_time(apr_pool_t *p, char *buf, apr_size_t  len)
+ {
++    if (len < 2) {
++        return 0;
++    }
+     buf[len-2] = '\0';
+     return apr_time_from_sec(atoi(buf));
+ }
+@@ -1583,6 +1605,9 @@ static apr_time_t stat_read_rtime(apr_pool_t *p, char *buf, apr_size_t  len)
+     char *usecs;
+     const char *sep = ":.";
+ 
++    if (len < 2) {
++        return apr_time_make(0, 0);
++    }
+     buf[len-2] = '\0';
+ 
+     secs = apr_strtok(buf, sep, &tok);
diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch
new file mode 100644
index 0000000000..844ad8109d
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch
@@ -0,0 +1,38 @@
+From 997c02ce5b9db44083c580e3e47095f5ac4524ae Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Fri, 7 Aug 2026 14:23:29 +0000
+Subject: [PATCH] fix memcache version parsing
+
+partial port of 1936966 from trunk
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936975 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2026-34502
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/997c02ce5b9db44083c580e3e47095f5ac4524ae]
+
+(cherry picked from commit 997c02ce5b9db44083c580e3e47095f5ac4524ae)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ memcache/apr_memcache.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/memcache/apr_memcache.c b/memcache/apr_memcache.c
+index 137be778..74146712 100644
+--- a/memcache/apr_memcache.c
++++ b/memcache/apr_memcache.c
+@@ -1092,12 +1092,12 @@ apr_memcache_version(apr_memcache_server_t *ms,
+     }
+ 
+     if (strncmp(MS_VERSION, conn->buffer, MS_VERSION_LEN) == 0) {
+-        if (conn->blen < MS_VERSION_LEN + 2) {
++        if (conn->blen < MS_VERSION_LEN + 4) {
+             rv = APR_EGENERAL;
+         }
+         else {
+             *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1, 
+-                                    conn->blen - MS_VERSION_LEN - 2);
++                                    conn->blen - MS_VERSION_LEN - 3);
+             rv = APR_SUCCESS;
+        } 
+     }
diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb
index 341975fbca..9da2da0816 100644
--- a/meta/recipes-support/apr/apr-util_1.6.3.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.3.bb
@@ -18,6 +18,8 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \
            file://CVE-2026-32327-dependent.patch \
            file://CVE-2026-32327.patch \
            file://CVE-2026-34501.patch \
+           file://CVE-2026-34502_p1.patch \
+           file://CVE-2026-34502_p2.patch \
            file://run-ptest \
            "
 
-- 
2.35.6