$ git show --format=fuller --patch-with-stat --summary fe21eb8f9a20b2c4bf013b07a28fc8fddae25438

commit fe21eb8f9a20b2c4bf013b07a28fc8fddae25438
Author:     tpgxyz <tpgxyz@gmail.com>
AuthorDate: Fri Dec 6 11:14:33 2019 +0100
Commit:     tpgxyz <tpgxyz@gmail.com>
CommitDate: Fri Dec 6 11:14:33 2019 +0100

    build with Oz, add patch from Fedora
---
 .abf.yml                                      |  3 -
 Address-some-optimized-out-memset-calls.patch | 95 +++++++++++++++++++++++++++
 krb5.spec                                     | 14 ++--
 wget-log                                      | 11 ++++
 4 files changed, 114 insertions(+), 9 deletions(-)
 create mode 100644 Address-some-optimized-out-memset-calls.patch
 create mode 100644 wget-log

diff --git a/.abf.yml b/.abf.yml
index a4ea6b4..ce2f43a 100644
--- a/.abf.yml
+++ b/.abf.yml
@@ -1,6 +1,3 @@
-removed_sources:
-  krb5-1.16.1.tar.gz: 8353f2d900a7d52499c7c2605d5e295f71dd5e67
-  krb5-1.16.2.tar.gz: 6d6ef205194be386fb5f4e6bef32cb9fc79e853b
 sources:
   krb5-1.10.3-pdf.tar.xz: 150677b2d8159746b282bc1c358e0e475e7200c4
   krb5-1.16.3.tar.gz: eb074220289f1f16fd61b7ef406b500ad26ca0bd
diff --git a/Address-some-optimized-out-memset-calls.patch b/Address-some-optimized-out-memset-calls.patch
new file mode 100644
index 0000000..f14cebc
--- /dev/null
+++ b/Address-some-optimized-out-memset-calls.patch
@@ -0,0 +1,95 @@
+From 772178a22bc43df83bfa74992d55f99a5153c03e Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Sun, 30 Dec 2018 16:40:28 -0500
+Subject: [PATCH] Address some optimized-out memset() calls
+
+Ilja Van Sprundel reported a list of memset() calls which gcc
+optimizes out.  In krb_auth_su.c, use zap() to clear the password, and
+remove two memset() calls when there is no password to clear.  In
+iakerb.c, remove an unnecessary memset() before setting the only two
+fields of the IAKERB header structure.  In svr_principal.c, use
+krb5_free_key_keyblock_contents() instead of hand-freeing key data.
+In asn1_k_encode.c, remove an unnecessary memset() of the kdc_req_hack
+shell before returning.
+
+(cherry picked from commit 1057b0befec1f1c0e9d4da5521a58496e2dc0997)
+(cherry picked from commit 0d83197140d2040d47ca79f006126e503680f661)
+---
+ src/clients/ksu/krb_auth_su.c      |  4 +---
+ src/lib/gssapi/krb5/iakerb.c       |  1 -
+ src/lib/kadm5/srv/svr_principal.c  | 10 ++--------
+ src/lib/krb5/asn.1/asn1_k_encode.c |  1 -
+ 4 files changed, 3 insertions(+), 13 deletions(-)
+
+diff --git a/src/clients/ksu/krb_auth_su.c b/src/clients/ksu/krb_auth_su.c
+index 7af48195c..e39685fff 100644
+--- a/src/clients/ksu/krb_auth_su.c
++++ b/src/clients/ksu/krb_auth_su.c
+@@ -183,21 +183,19 @@ krb5_boolean ksu_get_tgt_via_passwd(context, client, options, zero_password,
+     if (code ) {
+         com_err(prog_name, code, _("while reading password for '%s'\n"),
+                 client_name);
+-        memset(password, 0, sizeof(password));
+         return (FALSE);
+     }
+ 
+     if ( pwsize == 0) {
+         fprintf(stderr, _("No password given\n"));
+         *zero_password = TRUE;
+-        memset(password, 0, sizeof(password));
+         return (FALSE);
+     }
+ 
+     code = krb5_get_init_creds_password(context, &creds, client, password,
+                                         krb5_prompter_posix, NULL, 0, NULL,
+                                         options);
+-    memset(password, 0, sizeof(password));
++    zap(password, sizeof(password));
+ 
+ 
+     if (code) {
+diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
+index bb1072fe4..47c161ec9 100644
+--- a/src/lib/gssapi/krb5/iakerb.c
++++ b/src/lib/gssapi/krb5/iakerb.c
+@@ -262,7 +262,6 @@ iakerb_make_token(iakerb_ctx_id_t ctx,
+     /*
+      * Assemble the IAKERB-HEADER from the realm and cookie
+      */
+-    memset(&iah, 0, sizeof(iah));
+     iah.target_realm = *realm;
+     iah.cookie = cookie;
+ 
+diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
+index a59a65e8f..61ce60da7 100644
+--- a/src/lib/kadm5/srv/svr_principal.c
++++ b/src/lib/kadm5/srv/svr_principal.c
+@@ -2091,14 +2091,8 @@ static int decrypt_key_data(krb5_context context,
+         ret = krb5_dbe_decrypt_key_data(context, NULL, &key_data[i], &keys[i],
+                                         NULL);
+         if (ret) {
+-            for (; i >= 0; i--) {
+-                if (keys[i].contents) {
+-                    memset (keys[i].contents, 0, keys[i].length);
+-                    free( keys[i].contents );
+-                }
+-            }
+-
+-            memset(keys, 0, n_key_data*sizeof(krb5_keyblock));
++            for (; i >= 0; i--)
++                krb5_free_keyblock_contents(context, &keys[i]);
+             free(keys);
+             return ret;
+         }
+diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
+index 29f6b903d..716ceee59 100644
+--- a/src/lib/krb5/asn.1/asn1_k_encode.c
++++ b/src/lib/krb5/asn.1/asn1_k_encode.c
+@@ -532,7 +532,6 @@ decode_kdc_req_body(const taginfo *t, const unsigned char *asn1, size_t len,
+         if (ret) {
+             free_kdc_req_body(b);
+             free(h.server_realm.data);
+-            memset(&h, 0, sizeof(h));
+             return ret;
+         }
+         b->server->realm = h.server_realm;
diff --git a/krb5.spec b/krb5.spec
index e81e61a..0588df9 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -41,11 +41,12 @@
 # enable checking after compile
 %define enable_check 0
 %{?_with_check: %global %enable_check 1}
+%global optflags %{optflags} -Oz
 
 Summary:	The Kerberos network authentication system
 Name:		krb5
 Version:	1.16.3
-Release:	1
+Release:	2
 License:	MIT
 Url:		http://web.mit.edu/kerberos/www/
 Group:		System/Libraries
@@ -87,6 +88,7 @@ Patch75:	krb5-pkinit-debug.patch
 Patch86:	krb5-1.9-debuginfo.patch
 Patch107:	krb5-aarch64.patch
 Patch108:	krb5-1.12.2-python3.patch
+Patch109:	Address-some-optimized-out-memset-calls.patch
 
 BuildRequires:	bison
 BuildRequires:	flex
@@ -320,15 +322,15 @@ sed -i "406d" src/include/k5-platform.h
 
 %serverbuild
 # it does not work with -fPIE and someone added that to the serverbuild macro...
-CFLAGS=`echo $CFLAGS|sed -e 's|-fPIE||g'`
-CXXFLAGS=`echo $CXXFLAGS|sed -e 's|-fPIE||g'`
-RPM_OPT_FLAGS=`echo $RPM_OPT_FLAGS|sed -e 's|-fPIE||g'`
+CFLAGS=$(echo $CFLAGS|sed -e 's|-fPIE||g')
+CXXFLAGS=$(echo $CXXFLAGS|sed -e 's|-fPIE||g')
+RPM_OPT_FLAGS=$(echo $RPM_OPT_FLAGS|sed -e 's|-fPIE||g')
 
 cd src
 # Work out the CFLAGS and CPPFLAGS which we intend to use.
 INCLUDES=-I%{_includedir}/et
-CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC`"
-CPPFLAGS="`echo $DEFINES $INCLUDES`"
+CFLAGS="$(echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC)"
+CPPFLAGS="$(echo $DEFINES $INCLUDES)"
 
 %configure \
 	CC="%{__cc}" \
diff --git a/wget-log b/wget-log
new file mode 100644
index 0000000..6abd946
--- /dev/null
+++ b/wget-log
@@ -0,0 +1,11 @@
+--2019-12-06 11:14:01--  http://svnweb.mageia.org/packages/cauldron/krb5/current/SOURCES/Address-some-optimized-out-memset-calls.patch?revision=1356976
+Translacja svnweb.mageia.org... 212.85.158.151, 2a02:2178:2:7::7
+Łączenie się z svnweb.mageia.org|212.85.158.151|:80... połączono.
+Żądanie HTTP wysłano, oczekiwanie na odpowiedź... 200 OK
+Długość: nieznana [text/plain]
+Zapis do: `Address-some-optimized-out-memset-calls.patch?revision=1356976'
+
+
                          Address-some-optimized-out     [<=>                                                                                                                  ]       0  --.-KB/s               
Address-some-optimized-out-memset-calls.patch?revisi     [ <=>                                                                                                                 ]   3,76K  --.-KB/s     w 0s      
+
+2019-12-06 11:14:03 (145 MB/s) - zapisano `Address-some-optimized-out-memset-calls.patch?revision=1356976' [3850]
+