Hello community, here is the log from the commit of package php5 for openSUSE:Factory checked in at 2012-10-26 17:28:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/php5 (Old) and /work/SRC/openSUSE:Factory/.php5.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "php5", Maintainer is "[email protected]" Changes: -------- --- /work/SRC/openSUSE:Factory/php5/php5.changes 2012-10-13 19:59:06.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.php5.new/php5.changes 2012-10-26 17:28:23.000000000 +0200 @@ -1,0 +2,11 @@ +Thu Oct 18 10:18:41 UTC 2012 - [email protected] + +- fix CVE-2011-4153 CVE-2011-4153 [bnc#741859] + +------------------------------------------------------------------- +Tue Oct 16 12:37:36 UTC 2012 - [email protected] + +- add explicit buildrequire on libbz2-devel + (having to patch old .changes file to avoid "double entry") + +------------------------------------------------------------------- @@ -1447 +1458 @@ -Fri Mar 3 14:13:13 CET 2006 - [email protected] +Fri Mar 3 14:13:14 CET 2006 - [email protected] New: ---- php-5.3.8-CVE-2011-4153.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ php5.spec ++++++ --- /var/tmp/diff_new_pack.jM69cK/_old 2012-10-26 17:28:25.000000000 +0200 +++ /var/tmp/diff_new_pack.jM69cK/_new 2012-10-26 17:28:25.000000000 +0200 @@ -36,6 +36,7 @@ BuildRequires: gmp-devel BuildRequires: imap-devel BuildRequires: krb5-devel +BuildRequires: libbz2-devel BuildRequires: libevent-devel BuildRequires: libicu-devel BuildRequires: libmcrypt-devel @@ -179,6 +180,7 @@ Patch36: php-5.3.8-crypt-tests.patch # related to previous patch; !(defined(_REENTRANT) || defined(_THREAD_SAFE)) Patch37: php-5.3.8-no-reentrant-crypt.patch +Patch38: php-5.3.8-CVE-2011-4153.patch Url: http://www.php.net BuildRoot: %{_tmppath}/%{name}-%{version}-build Summary: PHP5 Core Files @@ -1281,6 +1283,7 @@ %endif %patch36 %patch37 +%patch38 # Safety check for API version change. vapi=`sed -n '/#define PHP_API_VERSION/{s/.* //;p}' main/php.h` if test "x${vapi}" != "x%{apiver}"; then @@ -1808,6 +1811,7 @@ %defattr(644,root,root,755) %{extension_dir}/mssql.so %config(noreplace) %{php_sysconf}/conf.d/mssql.ini + %endif %files mysql ++++++ php-5.3.8-CVE-2011-4153.patch ++++++ http://svn.php.net/viewvc?view=revision&revision=319442 http://svn.php.net/viewvc?view=revision&revision=319453 #-0- Zend/zend_builtin_functions.c #-1- ext/soap/php_sdl.c #-2- ext/standard/syslog.c #-3- N/A for 5.3.8 #-4- N/A #-5- N/A #-6- ext/session/mod_files.c ext/standard/file.c Index: Zend/zend_builtin_functions.c =================================================================== --- Zend/zend_builtin_functions.c.orig +++ Zend/zend_builtin_functions.c @@ -683,6 +683,9 @@ repeat: } c.flags = case_sensitive; /* non persistent */ c.name = zend_strndup(name, name_len); + if(c.name == NULL) { + RETURN_FALSE; + } c.name_len = name_len+1; c.module_number = PHP_USER_CONSTANT; if (zend_register_constant(&c TSRMLS_CC) == SUCCESS) { Index: ext/standard/syslog.c =================================================================== --- ext/standard/syslog.c.orig +++ ext/standard/syslog.c @@ -234,6 +234,9 @@ PHP_FUNCTION(openlog) free(BG(syslog_device)); } BG(syslog_device) = zend_strndup(ident, ident_len); + if(BG(syslog_device) == NULL) { + RETURN_FALSE; + } openlog(BG(syslog_device), option, facility); RETURN_TRUE; } Index: ext/soap/php_sdl.c =================================================================== --- ext/soap/php_sdl.c.orig +++ ext/soap/php_sdl.c @@ -147,6 +147,10 @@ encodePtr get_encoder(sdlPtr sdl, const memcpy(new_enc, enc, sizeof(encode)); if (sdl->is_persistent) { new_enc->details.ns = zend_strndup(ns, ns_len); + if (new_enc->details.ns == NULL) { + efree(nscat); + return NULL; + } new_enc->details.type_str = strdup(new_enc->details.type_str); } else { new_enc->details.ns = estrndup(ns, ns_len); Index: ext/standard/file.c =================================================================== --- ext/standard/file.c.orig +++ ext/standard/file.c @@ -2612,10 +2612,15 @@ PHP_FUNCTION(fnmatch) Returns directory path used for temporary files */ PHP_FUNCTION(sys_get_temp_dir) { + char *tmp_dir; if (zend_parse_parameters_none() == FAILURE) { return; } - RETURN_STRING((char *)php_get_temporary_directory(), 1); + tmp_dir = (char *)php_get_temporary_directory(); + if (tmp_dir == NULL) { + return; + } + RETURN_STRING(tmp_dir, 1); } /* }}} */ Index: ext/session/mod_files.c =================================================================== --- ext/session/mod_files.c.orig +++ ext/session/mod_files.c @@ -273,6 +273,9 @@ PS_OPEN_FUNC(files) if (*save_path == '\0') { /* if save path is an empty string, determine the temporary dir */ save_path = php_get_temporary_directory(); + if (save_path == NULL) { + return FAILURE; + } if (PG(safe_mode) && (!php_checkuid(save_path, NULL, CHECKUID_CHECK_FILE_AND_DIR))) { return FAILURE; -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
