bugfix: backport fixes for CVE-2024-24989 and CVE-2024-24990.

.travis.yml

@@ -113,14 +113,17 @@ env:
     - OPENSSL_INC=$OPENSSL_PREFIX/include
     - OPENRESTY_PREFIX=/opt/openresty
   jobs:
-    - OPENSSL_VER=1.1.1w OPENSSL_PATCH_VER=1.1.1f ENABLE_HTTP3_OPTION=--with-http_v3_module
+    - OPENSSL_VER=1.1.0l OPENSSL_PATCH_VER=1.1.0d
+    - OPENSSL_VER=1.1.1s OPENSSL_PATCH_VER=1.1.1f ENABLE_HTTP3_OPTION=--with-http_v3_module
 
 jobs:
     include:
         - <<: *linux-s390x
-          env: OPENSSL_VER=1.1.1w OPENSSL_PATCH_VER=1.1.1f ENABLE_HTTP3_OPTION=--with-http_v3_module
+          env: OPENSSL_VER=1.1.0l OPENSSL_PATCH_VER=1.1.0d
+        - <<: *linux-s390x
+          env: OPENSSL_VER=1.1.1l OPENSSL_PATCH_VER=1.1.1f ENABLE_HTTP3_OPTION=--with-http_v3_module
         - <<: *linux-ppc64le
-          env: OPENSSL_VER=1.1.1w OPENSSL_PATCH_VER=1.1.1f ENABLE_HTTP3_OPTION=--with-http_v3_module
+          env: OPENSSL_VER=1.1.1s OPENSSL_PATCH_VER=1.1.1f ENABLE_HTTP3_OPTION=--with-http_v3_module
 
 install:
   - cpanm --sudo --notest Test::Nginx IPC::Run3 > build.log 2>&1 || (cat build.log && exit 1)

util/configure

@@ -554,6 +554,9 @@ _END_
             "\n";
     }
 
+    # disable pcre2 by default
+    push @ngx_opts, '--without-pcre2';
+
     if (!$opts->{no_stream}
         && ! $opts->{no_stream_ssl}
         && ! $opts->{stream_ssl})
@@ -776,8 +779,8 @@ _END_
         }
 
         if ($on_solaris) {
-            $extra_opts .= " INSTALL_X='\$(INSTALL) -m 0755' " .
-                    "INSTALL_F='\$(INSTALL) -m 0644'";
+            $extra_opts .= " INSTALL_X='$root_dir/build/install -m 0755' " .
+                    "INSTALL_F='$root_dir/build/install -m 0644'";
         }
 
         if (defined $cc) {
@@ -950,7 +953,7 @@ _EOC_
             }
 
             if ($on_solaris) {
-                #$extra_opts .= " INSTALL='\$(INSTALL)'";
+                #$extra_opts .= " INSTALL=$root_dir/build/install";
                 if ($opts->{debug}) {
                     $extra_opts .=
                         " CJSON_CFLAGS=\"-g -O -fpic -DUSE_INTERNAL_ISINF\"";
@@ -994,7 +997,7 @@ _EOC_
                 "LUA_LIB_DIR=$lualib_prefix";
 
             if ($on_solaris) {
-                $extra_opts .= " INSTALL='\$(INSTALL)'";
+                $extra_opts .= " INSTALL=$root_dir/build/install";
             }
 
             if ($opts->{debug}) {
@@ -1047,7 +1050,7 @@ _EOC_
             }
 
             if ($on_solaris) {
-                $extra_opts .= " INSTALL='\$(INSTALL)'";
+                $extra_opts .= " INSTALL=$root_dir/build/install";
                 if ($opts->{debug}) {
                     $extra_opts .= " CFLAGS=\"-g -O -Wall\"";
                 }
@@ -1098,7 +1101,7 @@ _EOC_
             }
 
             if ($on_solaris) {
-                $extra_opts .= " INSTALL='\$(INSTALL)'";
+                $extra_opts .= " INSTALL=$root_dir/build/install";
                 if ($opts->{debug}) {
                     $extra_opts .= " CFLAGS=\"-g -O -Wall\"";
 
@@ -1146,10 +1149,8 @@ _EOC_
         } else {
             $target_dir = "\$(DESTDIR)$prefix/bin/";
         }
-        push @make_install_cmds,
-            "mkdir '$target_dir'",
-            "cd $root_dir/build/$opm_dir && "
-                . "\$(INSTALL) bin/* '$target_dir'";
+        push @make_install_cmds, "cd $root_dir/build/$opm_dir && "
+             . "$root_dir/build/install bin/* $target_dir";
     }
 
     # configure resty-cli:
@@ -1163,7 +1164,7 @@ _EOC_
             $target_dir = "\$(DESTDIR)$prefix/bin/";
         }
         push @make_install_cmds, "cd $root_dir/build/$resty_cli_dir && "
-             . "\$(INSTALL) bin/* $target_dir";
+             . "$root_dir/build/install bin/* $target_dir";
 
         if ($platform ne 'msys') {
             # patch the resty script:
@@ -1246,7 +1247,7 @@ sub add_lua_lib ($$$) {
 
         my $extra_opts =
         " DESTDIR=\$(DESTDIR) LUA_LIB_DIR=$lualib_prefix"
-        ." INSTALL='\$(INSTALL)'";
+        ." INSTALL=$root_dir/build/install";
 
         push @make_install_cmds, "cd $root_dir/build/$dir && " .
         "\$(MAKE) install$extra_opts";
@@ -1559,12 +1560,7 @@ sub gen_makefile {
         print $out "DESTDIR ?= $root_dir/\n\n";
     }
 
-    print $out <<_EOC_;
-INSTALL := $root_dir/build/install
-
-.PHONY: all install clean
-
-_EOC_
+    print $out ".PHONY: all install clean\n\n";
 
     print $out "all:\n\t" . join("\n\t", @make_cmds) . "\n\n";
 

util/ver

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 main_ver=1.25.3
-minor_ver=1
+minor_ver=2
 version=$main_ver.$minor_ver
 echo $version