From f2631979b656a041c5bf3163b60c177f7bf17a34 Mon Sep 17 00:00:00 2001
From: xh <xingheyd@163.com>
Date: Tue, 20 May 2025 17:22:24 +0800
Subject: [PATCH] fix build failed for bind CVE-2024-1737

---
 ...-presence-of-dns_zone_setmaxrrperset.patch | 79 +++++++++++++++++++
 bind-dyndb-ldap.spec                          |  9 ++-
 2 files changed, 87 insertions(+), 1 deletion(-)
 create mode 100644 backport-Detect-presence-of-dns_zone_setmaxrrperset.patch

diff --git a/backport-Detect-presence-of-dns_zone_setmaxrrperset.patch b/backport-Detect-presence-of-dns_zone_setmaxrrperset.patch
new file mode 100644
index 0000000..3f85f0f
--- /dev/null
+++ b/backport-Detect-presence-of-dns_zone_setmaxrrperset.patch
@@ -0,0 +1,79 @@
+From 33a671ebd0c4019c6ebb7e46a8329dbcdb4cc18d Mon Sep 17 00:00:00 2001
+From: Petr Menšík <pemensik@redhat.com>
+Date: Aug 07 2024 14:19:46 +0000
+Subject: Detect presence of dns_zone_setmaxrrperset
+
+
+Because it were backported into bind-9.16 branch by upstream and testing
+of simpler variant fails in some cases. This assumes these call do not
+appear only after 9.18.28, but may be backported into previous versions.
+Tests just call presence and assumes dns_db_setmaxtypepername will be
+present also.
+
+Conflict: context adapt
+Reference: https://pagure.io/bind-dyndb-ldap/c/33a671ebd0c4019c6ebb7e46a8329dbcdb4cc18d
+---
+ configure.ac      |  4 ++++
+ src/ldap_driver.c | 25 +++++++++++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index 9f7f364..ea59639 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -169,6 +169,10 @@ AC_CHECK_LIB([dns], [dns_result_totext],
+   [AC_DEFINE([HAVE_DNS_RESULT_TOTEXT], 1, [Define if dns library provides dns_result_totext])]
+ )
+ 
++AC_CHECK_LIB([dns], [dns_db_setmaxrrperset],
++  [AC_DEFINE([HAVE_DNS_DB_SETMAXRRPERSET], 1, [Define if dns library provides dns_db_setmaxrrperset])]
++)
++
+ dnl Older autoconf (2.59, for example) doesn't define docdir
+ [[ ! -n "$docdir" ]] && docdir='${datadir}/doc/${PACKAGE_TARNAME}'
+ AC_SUBST([docdir])
+diff --git a/src/ldap_driver.c b/src/ldap_driver.c
+index e4aeeb2..8d9edf7 100644
+--- a/src/ldap_driver.c
++++ b/src/ldap_driver.c
+@@ -926,6 +926,27 @@ adjusthashsize(dns_db_t *db, size_t size) {
+ }
+ #endif
+ 
++#if HAVE_DNS_DB_SETMAXRRPERSET
++/* Calls added to fix CVE-2024-1737 in 9.18.28 */
++static void
++setmaxrrperset(dns_db_t *db, uint32_t value) {
++	ldapdb_t *ldapdb = (ldapdb_t *) db;
++
++	REQUIRE(VALID_LDAPDB(ldapdb));
++
++	return dns_db_setmaxrrperset(ldapdb->rbtdb, value);
++}
++
++static void
++setmaxtypepername(dns_db_t *db, uint32_t value) {
++	ldapdb_t *ldapdb = (ldapdb_t *) db;
++
++	REQUIRE(VALID_LDAPDB(ldapdb));
++
++	return dns_db_setmaxtypepername(ldapdb->rbtdb, value);
++}
++#endif
++
+ static dns_dbmethods_t ldapdb_methods = {
+ 	attach,
+ 	detach,
+@@ -988,6 +1009,10 @@ static dns_dbmethods_t ldapdb_methods = {
+ #if LIBDNS_VERSION_MAJOR >= 1606 && LIBDNS_VERSION_MAJOR < 1720
+ 	adjusthashsize, /* adjusthashsize */
+ #endif
++#if HAVE_DNS_DB_SETMAXRRPERSET
++       setmaxrrperset, /* setmaxrrperset */
++       setmaxtypepername, /* setmaxtypepername */
++#endif
+ };
+ 
+ isc_result_t ATTR_NONNULLS
+-- 
+2.33.0
\ No newline at end of file
diff --git a/bind-dyndb-ldap.spec b/bind-dyndb-ldap.spec
index 58ced5d..651a3a1 100644
--- a/bind-dyndb-ldap.spec
+++ b/bind-dyndb-ldap.spec
@@ -5,7 +5,7 @@
 
 Name:           bind-dyndb-ldap
 Version:        11.10
-Release:        2
+Release:        3
 Summary:        LDAP back-end plug-in for BIND
 License:        GPLv2+
 URL:            https://releases.pagure.org/bind-dyndb-ldap
@@ -18,6 +18,7 @@ Patch3:         bind-dyndb-ldap-bind-9.18.10-staleok.patch
 Patch4:         bind-dyndb-ldap-11.10-bind-9.18.11.patch
 Patch5:         backport-bind-dyndb-ldap-bind-9.18.24.patch
 Patch6:         backport-bind-dyndb-ldap-dns_name_init.patch
+Patch7:         backport-Detect-presence-of-dns_zone_setmaxrrperset.patch
 
 BuildRequires:  bind-devel >= %{bind_version}
 BuildRequires:  krb5-devel
@@ -98,6 +99,12 @@ sed -i.bak -e "$SEDSCRIPT" /etc/named.conf
 
 
 %changelog
+* Tue May 20 2025 xinghe <xinghe2@h-partners.com> - 11.10-3
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:fix build failed for bind CVE-2024-1737
+
 * Wed Mar 20 2024 xinghe <xinghe2@h-partners.com> - 11.10-2
 - Type:bugfix
 - CVE:NA
-- 
Gitee