Address CVE-2019-19204 CVE-2019-19203 CVE-2019-19012

Another fix backports out of request from PHP maintainer (#1728971)

oniguruma-15c4228-bz1755880_2.patch

@@ -0,0 +1,32 @@
+commit 15c4228aa2ffa02140a99912dd3177df0b1841c6
+Author: K.Kosako <kkosako0@gmail.com>
+Date:   Fri Oct 4 19:54:40 2019 +0900
+
+    fix #156: Heap buffer overflow in match_at() with case-insensitive match
+
+diff --git a/src/regcomp.c b/src/regcomp.c
+index cd379a2..52f6f01 100644
+--- a/src/regcomp.c
++++ b/src/regcomp.c
+@@ -734,8 +734,8 @@ add_compile_string(UChar* s, int mb_len, int str_len,
+     COP(reg)->exact_n.s = p;
+   }
+   else {
++    xmemset(COP(reg)->exact.s, 0, sizeof(COP(reg)->exact.s));
+     xmemcpy(COP(reg)->exact.s, s, (size_t )byte_len);
+-    COP(reg)->exact.s[byte_len] = '\0';
+   }
+ 
+   return 0;
+diff --git a/src/regexec.c b/src/regexec.c
+index e471491..4bcd8a9 100644
+--- a/src/regexec.c
++++ b/src/regexec.c
+@@ -2889,6 +2889,7 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
+           DATA_ENSURE(0);
+           q = lowbuf;
+           while (len-- > 0) {
++            if (ps >= endp) goto fail;
+             if (*ps != *q) goto fail;
+             ps++; q++;
+           }

oniguruma-CVE-2019-16163.patch

@@ -0,0 +1,49 @@
+commit 4097828d7cc87589864fecf452f2cd46c5f37180
+Author: K.Kosako <kosako@sofnec.co.jp>
+Date:   Mon Jul 29 12:52:56 2019 +0900
+
+    fix #147: Stack Exhaustion Problem caused by some parsing functions in regcomp.c making recursive calls to themselves.
+
+diff --git a/src/regparse.c b/src/regparse.c
+index 123d6cb..1a1ef6b 100644
+--- a/src/regparse.c
++++ b/src/regparse.c
+@@ -6239,6 +6239,7 @@ parse_char_class(Node** np, PToken* tok, UChar** src, UChar* end, ScanEnv* env)
+   env->parse_depth++;
+   if (env->parse_depth > ParseDepthLimit)
+     return ONIGERR_PARSE_DEPTH_LIMIT_OVER;
++
+   prev_cc = (CClassNode* )NULL;
+   r = fetch_token_in_cc(tok, src, end, env);
+   if (r == TK_CHAR && tok->u.c == '^' && tok->escaped == 0) {
+@@ -7820,14 +7821,18 @@ static int
+ parse_exp(Node** np, PToken* tok, int term, UChar** src, UChar* end,
+           ScanEnv* env, int group_head)
+ {
+-  int r, len, group = 0;
++  int r, len, group;
+   Node* qn;
+   Node** tp;
++  unsigned int parse_depth;
+ 
++  group = 0;
+   *np = NULL;
+   if (tok->type == (enum TokenSyms )term)
+     goto end_of_token;
+ 
++  parse_depth = env->parse_depth;
++
+   switch (tok->type) {
+   case TK_ALT:
+   case TK_EOT:
+@@ -8145,6 +8150,10 @@ parse_exp(Node** np, PToken* tok, int term, UChar** src, UChar* end,
+       if (is_invalid_quantifier_target(*tp))
+         return ONIGERR_TARGET_OF_REPEAT_OPERATOR_INVALID;
+ 
++      parse_depth++;
++      if (parse_depth > ParseDepthLimit)
++        return ONIGERR_PARSE_DEPTH_LIMIT_OVER;
++
+       qn = node_new_quantifier(tok->u.repeat.lower, tok->u.repeat.upper,
+                                r == TK_INTERVAL);
+       CHECK_NULL_RETURN_MEMERR(qn);

oniguruma-CVE-2019-19012-2-backport.patch

@@ -0,0 +1,52 @@
+--- onig-6.9.2/src/regexec.c.CVE-2019-19012-2	2019-11-29 01:43:09.491168972 +0900
++++ onig-6.9.2/src/regexec.c	2019-11-29 11:21:30.886372465 +0900
+@@ -4471,14 +4471,14 @@
+ #endif
+ 
+   p = s;
+-  if (reg->dmin > 0) {
++  if (reg->dmin != 0) {
++    if (end - p <= reg->dmin)
++      return 0; /* fail */
+     if (ONIGENC_IS_SINGLEBYTE(reg->enc)) {
+       p += reg->dmin;
+     }
+     else {
+       UChar *q = p + reg->dmin;
+-
+-      if (q >= end) return 0; /* fail */
+       while (p < q) p += enclen(reg->enc, p);
+     }
+   }
+@@ -4513,7 +4513,7 @@
+   }
+ 
+   if (p && p < range) {
+-    if (p - reg->dmin < s) {
++    if (p - s < reg->dmin) {
+     retry_gate:
+       pprev = p;
+       p += enclen(reg->enc, p);
+@@ -4561,6 +4561,7 @@
+           *low_prev = onigenc_get_prev_char_head(reg->enc,
+                                                  (pprev ? pprev : str), p);
+       }
++      *high = p;
+     }
+     else {
+       if (reg->dmax != INFINITE_LEN) {
+@@ -4585,9 +4586,12 @@
+           }
+         }
+       }
++      /* no needs to adjust *high, *high is used as range check only */
++      if (p - str < reg->dmin)
++        *high = (UChar* )str;
++      else
++        *high = p - reg->dmin;
+     }
+-    /* no needs to adjust *high, *high is used as range check only */
+-    *high = p - reg->dmin;
+ 
+ #ifdef ONIG_DEBUG_SEARCH
+     fprintf(stderr,

oniguruma-CVE-2019-19012-3-backport.patch

@@ -0,0 +1,71 @@
+--- onig-6.9.2/src/regexec.c.CVE-2019-19012-3	2019-11-29 11:26:09.207220372 +0900
++++ onig-6.9.2/src/regexec.c	2019-11-29 11:43:32.583653353 +0900
+@@ -4612,9 +4612,6 @@ backward_search_range(regex_t* reg, cons
+ {
+   UChar *p;
+ 
+-  if (range == 0) goto fail;
+-
+-  range += reg->dmin;
+   p = s;
+ 
+  retry:
+@@ -4683,8 +4680,21 @@ backward_search_range(regex_t* reg, cons
+ 
+     /* no needs to adjust *high, *high is used as range check only */
+     if (reg->dmax != INFINITE_LEN) {
+-      *low  = p - reg->dmax;
+-      *high = p - reg->dmin;
++      if (p - str < reg->dmax)
++        *low = (UChar* )str;
++      else
++        *low = p - reg->dmax;
++
++      if (reg->dmin != 0) {
++        if (p - str < reg->dmin)
++          *high = (UChar* )str;
++        else
++          *high = p - reg->dmin;
++      }
++      else {
++        *high = p;
++      }
++
+       *high = onigenc_get_right_adjust_char_head(reg->enc, adjrange, *high);
+     }
+ 
+@@ -4972,18 +4982,24 @@ onig_search_with_param(regex_t* reg, con
+ 
+     if (reg->optimize != OPTIMIZE_NONE) {
+       UChar *low, *high, *adjrange, *sch_start;
++      const UChar *min_range;
+ 
+       if (range < end)
+         adjrange = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, range);
+       else
+         adjrange = (UChar* )end;
+ 
++      if (end - range > reg->dmin)
++        min_range = range + reg->dmin;
++      else
++        min_range = end;
++
+       if (reg->dmax != INFINITE_LEN &&
+           (end - range) >= reg->threshold_len) {
+         do {
+           sch_start = s + reg->dmax;
+           if (sch_start > end) sch_start = (UChar* )end;
+-          if (backward_search_range(reg, str, end, sch_start, range, adjrange,
++          if (backward_search_range(reg, str, end, sch_start, min_range, adjrange,
+                                     &low, &high) <= 0)
+             goto mismatch;
+ 
+@@ -5013,7 +5029,7 @@ onig_search_with_param(regex_t* reg, con
+                                                         start, sch_start);
+           }
+         }
+-        if (backward_search_range(reg, str, end, sch_start, range, adjrange,
++        if (backward_search_range(reg, str, end, sch_start, min_range, adjrange,
+                                   &low, &high) <= 0) goto mismatch;
+       }
+     }

oniguruma-CVE-2019-19012-4-backport.patch

@@ -0,0 +1,57 @@
+--- onig-6.9.2/src/regexec.c.CVE-2019-19012-4	2019-11-29 12:00:47.015072189 +0900
++++ onig-6.9.2/src/regexec.c	2019-11-29 12:32:23.232860721 +0900
+@@ -4911,15 +4911,19 @@ onig_search_with_param(regex_t* reg, con
+     if (reg->optimize != OPTIMIZE_NONE) {
+       UChar *sch_range, *low, *high, *low_prev;
+ 
+-      sch_range = (UChar* )range;
+       if (reg->dmax != 0) {
+         if (reg->dmax == INFINITE_LEN)
+           sch_range = (UChar* )end;
+         else {
+-          sch_range += reg->dmax;
+-          if (sch_range > end) sch_range = (UChar* )end;
++          if (end - range < reg->dmax)
++            sch_range = (UChar* )end;
++          else {
++            sch_range = (UChar* )range + reg->dmax;
++          }
+         }
+       }
++      else
++        sch_range = (UChar* )range;
+ 
+       if ((end - start) < reg->threshold_len)
+         goto mismatch;
+@@ -4995,8 +4999,12 @@ onig_search_with_param(regex_t* reg, con
+       if (reg->dmax != INFINITE_LEN &&
+           (end - range) >= reg->threshold_len) {
+         do {
+-          sch_start = s + reg->dmax;
+-          if (sch_start > end) sch_start = (UChar* )end;
++          if (end - s > reg->dmax)
++            sch_start = s + reg->dmax;
++          else {
++            sch_start = (UChar* )end;
++           }
++
+           if (backward_search_range(reg, str, end, sch_start, min_range, adjrange,
+                                     &low, &high) <= 0)
+             goto mismatch;
+@@ -5020,11 +5028,13 @@ onig_search_with_param(regex_t* reg, con
+           if (reg->dmax == INFINITE_LEN)
+             sch_start = (UChar* )end;
+           else {
+-            sch_start += reg->dmax;
+-            if (sch_start > end) sch_start = (UChar* )end;
+-            else
++            if (end - s < reg->dmax)
++              sch_start = (UChar* )end;
++            else {
++              sch_start += reg->dmax;
+               sch_start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc,
+                                                         start, sch_start);
++            }
+           }
+         }
+         if (backward_search_range(reg, str, end, sch_start, min_range, adjrange,

oniguruma-CVE-2019-19012-5-backport.patch

@@ -0,0 +1,43 @@
+--- onig-6.9.2/src/regexec.c.CVE-2019-19012-5	2019-11-29 12:32:23.232860721 +0900
++++ onig-6.9.2/src/regexec.c	2019-11-29 13:32:24.401699168 +0900
+@@ -4824,13 +4824,16 @@ onig_search_with_param(regex_t* reg, con
+         goto mismatch_no_msa;
+ 
+       if (range > start) {
+-        if ((OnigLen )(min_semi_end - start) > reg->anchor_dmax) {
++        if (min_semi_end - start > reg->anchor_dmax) {
+           start = min_semi_end - reg->anchor_dmax;
+           if (start < end)
+             start = onigenc_get_right_adjust_char_head(reg->enc, str, start);
+         }
+-        if ((OnigLen )(max_semi_end - (range - 1)) < reg->anchor_dmin) {
+-          range = max_semi_end - reg->anchor_dmin + 1;
++        if (max_semi_end - (range - 1) < reg->anchor_dmin) {
++          if (max_semi_end - str + 1 < reg->anchor_dmin)
++            goto mismatch_no_msa;
++          else
++            range = max_semi_end - reg->anchor_dmin + 1;
+         }
+ 
+         if (start > range) goto mismatch_no_msa;
+@@ -4838,12 +4841,16 @@ onig_search_with_param(regex_t* reg, con
+            Backward search is used. */
+       }
+       else {
+-        if ((OnigLen )(min_semi_end - range) > reg->anchor_dmax) {
++        if (min_semi_end - range > reg->anchor_dmax) {
+           range = min_semi_end - reg->anchor_dmax;
+         }
+-        if ((OnigLen )(max_semi_end - start) < reg->anchor_dmin) {
+-          start = max_semi_end - reg->anchor_dmin;
+-          start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, start);
++        if (max_semi_end - start < reg->anchor_dmin) {
++          if (max_semi_end - str < reg->anchor_dmin)
++            goto mismatch_no_msa;
++          else {
++            start = max_semi_end - reg->anchor_dmin;
++            start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, start);
++          }
+         }
+         if (range > start) goto mismatch_no_msa;
+       }

oniguruma-CVE-2019-19203.patch

@@ -0,0 +1,126 @@
+From aa0188eaedc056dca8374ac03d0177429b495515 Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Thu, 7 Nov 2019 14:13:55 +0900
+Subject: [PATCH] fix #163: heap-buffer-overflow in gb18030_mbc_enc_len
+
+---
+ src/gb18030.c  | 16 +++++++++++++++-
+ src/regparse.c | 32 ++++++++++++++++++++++----------
+ 2 files changed, 37 insertions(+), 11 deletions(-)
+
+diff --git a/src/gb18030.c b/src/gb18030.c
+index ad5bf96..da6cfab 100644
+--- a/src/gb18030.c
++++ b/src/gb18030.c
+@@ -75,6 +75,20 @@ gb18030_mbc_enc_len(const UChar* p)
+   return 2;
+ }
+ 
++static int
++gb18030_code_to_mbclen(OnigCodePoint code)
++{
++       if ((code & 0xff000000) != 0) return 4;
++  else if ((code &   0xff0000) != 0) return ONIGERR_INVALID_CODE_POINT_VALUE;
++  else if ((code &     0xff00) != 0) return 2;
++  else {
++    if (GB18030_MAP[(int )(code & 0xff)] == CM)
++      return ONIGERR_INVALID_CODE_POINT_VALUE;
++
++    return 1;
++  }
++}
++
+ static int
+ is_valid_mbc_string(const UChar* p, const UChar* end)
+ {
+@@ -513,7 +527,7 @@ OnigEncodingType OnigEncodingGB18030 = {
+   1,          /* min enc length */
+   onigenc_is_mbc_newline_0x0a,
+   gb18030_mbc_to_code,
+-  onigenc_mb4_code_to_mbclen,
++  gb18030_code_to_mbclen,
+   gb18030_code_to_mbc,
+   gb18030_mbc_case_fold,
+   onigenc_ascii_apply_all_case_fold,
+diff --git a/src/regparse.c b/src/regparse.c
+index 70c36d5..5bf25e8 100644
+--- a/src/regparse.c
++++ b/src/regparse.c
+@@ -5885,6 +5885,7 @@ add_ctype_to_cc(CClassNode* cc, int ctype, int not, ScanEnv* env)
+ 
+   int c, r;
+   int ascii_mode;
++  int is_single;
+   const OnigCodePoint *ranges;
+   OnigCodePoint limit;
+   OnigCodePoint sb_out;
+@@ -5906,6 +5907,7 @@ add_ctype_to_cc(CClassNode* cc, int ctype, int not, ScanEnv* env)
+   }
+ 
+   r = 0;
++  is_single = ONIGENC_IS_SINGLEBYTE(enc);
+   limit = ascii_mode ? ASCII_LIMIT : SINGLE_BYTE_SIZE;
+ 
+   switch (ctype) {
+@@ -5922,19 +5924,25 @@ add_ctype_to_cc(CClassNode* cc, int ctype, int not, ScanEnv* env)
+   case ONIGENC_CTYPE_ALNUM:
+     if (not != 0) {
+       for (c = 0; c < (int )limit; c++) {
+-        if (! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
+-          BITSET_SET_BIT(cc->bs, c);
++        if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) {
++          if (! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
++            BITSET_SET_BIT(cc->bs, c);
++        }
+       }
+       for (c = limit; c < SINGLE_BYTE_SIZE; c++) {
+-        BITSET_SET_BIT(cc->bs, c);
++        if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1)
++          BITSET_SET_BIT(cc->bs, c);
+       }
+ 
+-      ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf);
++      if (is_single == 0)
++        ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf);
+     }
+     else {
+       for (c = 0; c < (int )limit; c++) {
+-        if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
+-          BITSET_SET_BIT(cc->bs, c);
++        if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) {
++          if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
++            BITSET_SET_BIT(cc->bs, c);
++        }
+       }
+     }
+     break;
+@@ -5944,21 +5952,25 @@ add_ctype_to_cc(CClassNode* cc, int ctype, int not, ScanEnv* env)
+   case ONIGENC_CTYPE_WORD:
+     if (not != 0) {
+       for (c = 0; c < (int )limit; c++) {
+-        if (ONIGENC_CODE_TO_MBCLEN(enc, c) > 0 /* check invalid code point */
++        /* check invalid code point */
++        if ((is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1)
+             && ! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
+           BITSET_SET_BIT(cc->bs, c);
+       }
+       for (c = limit; c < SINGLE_BYTE_SIZE; c++) {
+-        if (ONIGENC_CODE_TO_MBCLEN(enc, c) > 0)
++        if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1)
+           BITSET_SET_BIT(cc->bs, c);
+       }
++      if (ascii_mode != 0 && is_single == 0)
++        ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf);
+     }
+     else {
+       for (c = 0; c < (int )limit; c++) {
+-        if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
++        if ((is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1)
++            && ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype))
+           BITSET_SET_BIT(cc->bs, c);
+       }
+-      if (ascii_mode == 0)
++      if (ascii_mode == 0 && is_single == 0)
+         ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf);
+     }
+     break;

oniguruma-CVE-2019-19204.patch

@@ -0,0 +1,23 @@
+From 6eb4aca6a7f2f60f473580576d86686ed6a6ebec Mon Sep 17 00:00:00 2001
+From: "K.Kosako" <kosako@sofnec.co.jp>
+Date: Wed, 6 Nov 2019 17:32:29 +0900
+Subject: [PATCH] fix #162: heap-buffer-overflow in fetch_interval_quantifier
+ due to double PFETCH
+
+---
+ src/regparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/regparse.c b/src/regparse.c
+index 324c414..70c36d5 100644
+--- a/src/regparse.c
++++ b/src/regparse.c
+@@ -4178,7 +4178,7 @@ fetch_interval_quantifier(UChar** src, UChar* end, PToken* tok, ScanEnv* env)
+   if (PEND) goto invalid;
+   PFETCH(c);
+   if (IS_SYNTAX_OP(env->syntax, ONIG_SYN_OP_ESC_BRACE_INTERVAL)) {
+-    if (c != MC_ESC(env->syntax)) goto invalid;
++    if (c != MC_ESC(env->syntax) || PEND) goto invalid;
+     PFETCH(c);
+   }
+   if (c != '}') goto invalid;

oniguruma-d3e4029-bz1755880.patch

@@ -0,0 +1,18 @@
+commit d3e402928b6eb3327f8f7d59a9edfa622fec557b
+Author: K.Kosako <kosako@sofnec.co.jp>
+Date:   Tue Aug 13 13:37:30 2019 +0900
+
+    fix heap-buffer-overflow
+
+diff --git a/src/regexec.c b/src/regexec.c
+index 0753b07..634ee42 100644
+--- a/src/regexec.c
++++ b/src/regexec.c
+@@ -4196,6 +4196,7 @@ str_lower_case_match(OnigEncoding enc, int case_fold_flag,
+     lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf);
+     q = lowbuf;
+     while (lowlen > 0) {
++      if (t >= tend)    return 0;
+       if (*t++ != *q++) return 0;
+       lowlen--;
+     }

oniguruma.spec

@@ -3,7 +3,7 @@
 %global	mainver	6.9.2
 #%%global	betaver	rc3
 
-%global	fedorarel	2
+%global	fedorarel	4
 
 Name:		oniguruma
 Version:	%{mainver}
@@ -14,7 +14,30 @@ License:	BSD
 URL:		https://github.com/kkos/oniguruma/
 Source0:	https://github.com/kkos/oniguruma/releases/download/v%{mainver}%{?betaver:_%betaver}/onig-%{mainver}%{?betaver:-%betaver}.tar.gz
 # upstream patches
+# #1728966 CVE-2019-13225
 Patch10:	0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch
+# #1768997 CVE-2019-16163
+Patch12:	oniguruma-CVE-2019-16163.patch
+# #1755880 d3e402928b6eb3327f8f7d59a9edfa622fec557b
+# #1777537 This one is assigned as CVE-2019-19246
+Patch13:	oniguruma-d3e4029-bz1755880.patch
+# #1755880 15c4228aa2ffa02140a99912dd3177df0b1841c6
+Patch14:	oniguruma-15c4228-bz1755880_2.patch
+# https://github.com/kkos/oniguruma/issues/162
+Patch15:	oniguruma-CVE-2019-19204.patch
+# https://github.com/kkos/oniguruma/issues/163
+Patch16:	oniguruma-CVE-2019-19203.patch
+# https://github.com/kkos/oniguruma/issues/164
+# Modified, the upstream commit does not apply cleanly
+# because variable name, etc changed.
+# Patch21:	oniguruma-CVE-2019-19012-1.patch
+# Patch21: not needed, no correspoinding code in 6.9.2,
+# note that the similar lines appears in Patch24
+Patch22:	oniguruma-CVE-2019-19012-2-backport.patch
+Patch23:	oniguruma-CVE-2019-19012-3-backport.patch
+Patch24:	oniguruma-CVE-2019-19012-4-backport.patch
+Patch25:	oniguruma-CVE-2019-19012-5-backport.patch
+# #1728971 CVE-2019-13224
 #Patch11:	0011-Fix-CVE-2019-13224-don-t-allow-different-encodings-f.patch
 # Not use Patch11 for F-30 and below, this is almost API change (deprecation of API) in 
 # onig_new_deluxe() and this change should be avoided (if possible) in stable
@@ -22,6 +45,10 @@ Patch10:	0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch
 # Instead use another fix
 Patch101:	0101-onig_new_deluxe-don-t-free-new-pattern-if-success.patch
 
+# Just note
+# #1769042 CVE-2019-16161 - This is for onigumo, and oniguruma is not affected
+# (I guess - mtasaka)
+
 BuildRequires:	gcc
 
 %description
@@ -60,6 +87,16 @@ done
 %patch10 -p1 -b .CVE-2019-13225
 #%%patch11 -p1 -b .CVE-2019-13224
 %patch101 -p1 -b .CVE-2019-13224
+%patch12 -p1 -b .CVE-2019-16163
+%patch13 -p1 -b .bz1755880_1.CVE-2019-19246
+%patch14 -p1 -b .bz1755880_2
+%patch15 -p1 -b .CVE-2019-19204
+%patch16 -p1 -b .CVE-2019-19203
+#%patch21 -p1 -b .CVE-2019-19012-1 # Not needed
+%patch22 -p1 -b .CVE-2019-19012-2
+%patch23 -p1 -b .CVE-2019-19012-3
+%patch24 -p1 -b .CVE-2019-19012-4
+%patch25 -p1 -b .CVE-2019-19012-5
 
 %build
 %configure \
@@ -116,6 +153,14 @@ find $RPM_BUILD_ROOT -name '*.la' \
 %{_libdir}/pkgconfig/%{name}.pc	
 
 %changelog
+* Fri Nov 29 2019 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.2-4
+- Address CVE-2019-19204 CVE-2019-19203 CVE-2019-19012
+
+* Mon Nov 11 2019 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.2-3
+- Upstream patch for CVE-2019-16163 (#1768997)
+- Another fix backports out of request from PHP maintainer (#1728971)
+  (One of them is now assigned as CVE-2019-19246)
+
 * Fri Jul 12 2019 Mamoru TASAKA <mtasaka@fedoraproject.org> - 6.9.2-2
 - Upstream patch for CVE-2019-13225 (#1728966)
 - NON-upstream patch for CVE-2019-13224 (#1728971)