Hello community, here is the log from the commit of package php5.3524 for openSUSE:13.1:Update checked in at 2015-02-19 11:11:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.1:Update/php5.3524 (Old) and /work/SRC/openSUSE:13.1:Update/.php5.3524.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "php5.3524" Changes: -------- New Changes file: --- /dev/null 2014-12-25 22:38:16.200041506 +0100 +++ /work/SRC/openSUSE:13.1:Update/.php5.3524.new/php5.changes 2015-02-19 11:11:24.000000000 +0100 @@ -0,0 +1,3083 @@ +------------------------------------------------------------------- +Tue Dec 30 15:39:08 UTC 2014 - [email protected] + +- security update: + * CVE-2014-8142 [bnc#910659] + + php-CVE-2014-8142.patch + * CVE-2015-0231 [bnc#910659] + + php-CVE-2015-0231.patch + * null ptr deref [bnc#910659] + + php-unserialize-null-ptr-deref.patch + * CVE-2014-9427 [bnc#911664] + + php-CVE-2014-9427.patch + * CVE-2015-0232 [bnc#914690] + + php-CVE-2015-0232.patch +- added added README.default_socket_timeout [bnc#907519] + +------------------------------------------------------------------- +Mon Oct 27 11:25:38 UTC 2014 - [email protected] + +- security update: + * CVE-2014-3670 [bnc#902357] + * CVE-2014-3669 [bnc#902360] + * CVE-2014-3668 [bnc#902368] +- added patches: + * php-CVE-2014-3670.patch + * php-CVE-2014-3669.patch + * php-CVE-2014-3668.patch + +------------------------------------------------------------------- +Wed Sep 10 08:51:03 UTC 2014 - [email protected] + +- security update: + * CVE-2014-5459 [bnc#893849] + * CVE-2014-3597 [bnc#893853] + * CVE-2014-5120 [bnc#893855] +- fixed suhosin crash if used with php session_set_save_handler() + [bnc#895658] +- added patches: + * php-CVE-2014-3597.patch + * php-CVE-2014-5120.patch + * php5-suhosin-crash.patch + +------------------------------------------------------------------- +Thu Jul 17 14:32:29 UTC 2014 - [email protected] + +- security update: + * php-CVE-2014-4670.patch [bnc#886059] + * php-CVE-2014-4698.patch [bnc#886060] + * php-CVE-2014-4721.patch [bnc#885961] + +------------------------------------------------------------------- +Mon Jun 30 15:27:29 UTC 2014 - [email protected] + +- security update [bnc#884986], [bnc#884987], [bnc#884989], + [bnc#884990], [bnc#884991], [bnc#884992] +- added patches: + * php-5.4.20-CVE-2014-0207.patch + * php-5.4.20-CVE-2014-3478.patch + * php-5.4.20-CVE-2014-3479.patch + * php-5.4.20-CVE-2014-3480.patch + * php-5.4.20-CVE-2014-3487.patch + * php-5.4.20-CVE-2014-3515.patch + +------------------------------------------------------------------- +Tue Jun 17 14:58:48 UTC 2014 - [email protected] + +- security update: + * php-5.4.20-CVE-2014-4049.patch [bnc#882992] + +------------------------------------------------------------------- +Tue Jun 3 08:37:20 UTC 2014 - [email protected] + +- security update + * CVE-2014-0237 [bnc#880905] + * CVE-2014-0238 [bnc#880904] + +------------------------------------------------------------------- +Fri May 9 07:28:56 UTC 2014 - [email protected] + +- security update + * CVE-2014-2497.patch [bnc#868624] + * CVE-2014-0185.patch [bnc#875826] + +------------------------------------------------------------------- +Fri Dec 13 10:32:11 UTC 2013 - [email protected] + +- security update + * CVE-2013-6420.patch [bnc#854880] + * CVE-2013-6712.patch [bnc#853045] + +------------------------------------------------------------------- +Wed Sep 25 09:30:23 UTC 2013 - [email protected] + +- updated to 5.4.20: + * About 30 bugs were fixed. + +------------------------------------------------------------------- +Thu Sep 5 12:44:11 UTC 2013 - [email protected] + +- updated to 5.4.19: + * These releases fix a bug in the patch for CVE-2013-4248 in + OpenSSL module and compile failure with ZTS enabled in PHP 5.4. + +------------------------------------------------------------------- +Tue Aug 20 10:44:04 UTC 2013 - [email protected] + +- updated to 5.4.18: + * About 30 bugs were fixed, including security issues CVE-2013-4113 + and CVE-2013-4248. + +------------------------------------------------------------------- +Thu Aug 1 21:28:15 UTC 2013 - [email protected] + +- php5-per-mod-log.patch: It turns out that requesting per-module + logging support in 2.4 will not do a thing if the expansion + of APLOG_USE_MODULE is not visible to all files of the module + so place it in the header instead. + +------------------------------------------------------------------- +Wed Jul 31 01:21:24 UTC 2013 - [email protected] + +- php5-per-mod-log.patch Support apache 2.4 per module logging +- php5-apache24-updates.patch Use proper API in apache 2.4 + to determine when the module has to be loaded. + I made this patches at least a year ago, but for some reason + they went out of my radar and were not applied to upstream + Will be submitted again soon. + +------------------------------------------------------------------- +Mon Jul 15 14:49:21 UTC 2013 - [email protected] + +- updated to 5.4.17: + Core: + Fixed bug #64988 (Class loading order affects E_STRICT warning). + Fixed bug #64966 (segfault in zend_do_fcall_common_helper_SPEC). + Fixed bug #64960 (Segfault in gc_zval_possible_root). + Fixed bug #64936 (doc comments picked up from previous scanner run). + Fixed bug #64934 (Apache2 TS crash with get_browser()). + Fixed bug #64166 (quoted-printable-encode stream filter incorrectly + discarding whitespace). + DateTime: + Fixed bug #53437 (Crash when using unserialized DatePeriod instance). + FPM: + Fixed bug #64915 (error_log ignored when daemonize=0). + Implemented FR #64764 (add support for FPM init.d script). + PDO: + Fixed bug #63176 (Segmentation fault when instantiate 2 persistent + PDO to the same db server). + PDO_DBlib: + Fixed bug #63638 (Cannot connect to SQL Server 2008 with PDO dblib). + Fixed bug #64338 (pdo_dblib can't connect to Azure SQL). + Fixed bug #64808 (FreeTDS PDO getColumnMeta on a prepared but not + executed statement crashes). + PDO_firebird: + Fixed bug #64037 (Firebird return wrong value for numeric field). + Fixed bug #62024 (Cannot insert second row with null using + parametrized query). + PDO_mysql: + Fixed bug #48724 (getColumnMeta() doesn't return native_type for BIT, + TINYINT and YEAR). + PDO_pgsql: + Fixed bug #64949 (Buffer overflow in _pdo_pgsql_error). + pgsql: + Fixed bug #64609 (pg_convert enum type support). + Readline: + Implement FR #55694 (Expose additional readline variable to prevent + default filename completion). + SPL: + Fixed bug #64997 (Segfault while using RecursiveIteratorIterator + on 64-bits systems). + +------------------------------------------------------------------- +Tue Jun 18 10:32:25 UTC 2013 - [email protected] + +- Explicitly specify cyrus-sasl build dependency + +------------------------------------------------------------------- +Thu Jun 13 09:38:54 UTC 2013 - [email protected] + +- updated to 5.4.16 +- Core: + . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode, + CVE 2013-2110). (Stas) + . Fixed bug #64853 (Use of no longer available ini directives causes crash on + TS build). (Anatol) + . Fixed bug #64729 (compilation failure on x32). (Gustavo) + . Fixed bug #64720 (SegFault on zend_deactivate). (Dmitry) + . Fixed bug #64660 (Segfault on memory exhaustion within function definition). + (Stas, reported by Juha Kylmänen) + +- Calendar: + . Fixed bug #64895 (Integer overflow in SndToJewish). (Remi) + +- Fileinfo: + . Fixed bug #64830 (mimetype detection segfaults on mp3 file). (Anatol) + +- FPM: ++++ 2886 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:13.1:Update/.php5.3524.new/php5.changes New: ---- README.SUSE-pear README.default_socket_timeout README.macros install-pear-nozlib.phar macros.php php-5.4.20-CVE-2013-6420.patch php-5.4.20-CVE-2013-6712.patch php-5.4.20-CVE-2014-0185.patch php-5.4.20-CVE-2014-0207.patch php-5.4.20-CVE-2014-0237.patch php-5.4.20-CVE-2014-0238.patch php-5.4.20-CVE-2014-2497.patch php-5.4.20-CVE-2014-3478.patch php-5.4.20-CVE-2014-3479.patch php-5.4.20-CVE-2014-3480.patch php-5.4.20-CVE-2014-3487.patch php-5.4.20-CVE-2014-3515.patch php-5.4.20-CVE-2014-4049.patch php-5.4.20.tar.bz2 php-CVE-2014-3597.patch php-CVE-2014-3668.patch php-CVE-2014-3669.patch php-CVE-2014-3670.patch php-CVE-2014-4670.patch php-CVE-2014-4698.patch php-CVE-2014-4721.patch php-CVE-2014-5120.patch php-CVE-2014-8142.patch php-CVE-2014-9427.patch php-CVE-2015-0231.patch php-CVE-2015-0232.patch php-fpm.init php-suse-addons.tar.bz2 php-unserialize-null-ptr-deref.patch php5-64-bit-post-large-files.patch php5-BNC-457056.patch php5-apache24-updates.patch php5-apache_sapi_install.patch php5-cloexec.patch php5-crypt-tests.patch php5-format-string-issues.patch php5-gcc_builtins.patch php5-ini.patch php5-mbstring-missing-return.patch php5-missing-extdeps.patch php5-no-build-date.patch php5-no-reentrant-crypt.patch php5-openssl.patch php5-per-mod-log.patch php5-php-config.patch php5-phpize.patch php5-pts.patch php5-suhosin-crash.patch php5-suhosin-php54.patch php5-systzdata-v7.patch php5-wrong-fail-stack_push.patch php5.changes php5.spec suhosin-0.9.33.tgz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ php5.spec ++++++ ++++ 2056 lines (skipped) ++++++ README.SUSE-pear ++++++ Package php5-pear does not include Pear DB support ================================================== Php5-pear package comes without Pear DB database support, which was obsoleted by MDB2. If you need Pear DB, please install it with: #pear install --onlyreqdeps DB This is the case of Squirrelmail which requires Pear DB support. More information can be found at bugzilla.novell.com, bug #178982. ++++++ README.default_socket_timeout ++++++ Scope of default_socket_timeout Directive ========================================= default_socket_timeout do not work for SSL connections. This is long standing feature request in PHP upstream bugzilla, see PHP bug #41631. To sum up, ini_set("default_socket_timeout", $time); fopen($https_url, "r"); do not work as intended in the contrast to ini_set("default_socket_timeout", $time); fopen($http_url, "r"); Socket timeout for SSL connections can be set successfully when libcurl trough curl PHP extension is used: $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $https_url); curl_setopt($ch, CURLOPT_TIMEOUT, $time); curl_exec($ch); curl_close($ch); ++++++ README.macros ++++++ README for php-macros Author: Christian Wittmer <[email protected]> %php_gen_filelist generates an rpmlint happy filelist of your installed files In most cases you only need to check the %doc part sometimes there is a "Changes" or "ChangeLog",.... Requirements for %php_gen_filelist You have to define following parts inside your spec file Example: Name: php5-pear-Date %define pear_name Date %define pear_sname date BuildRequires: php-macros Provides: php-pear-%{pear_name} pear-%{pear_name} # Fix for renaming (package convention) Provides: php5-pear-%{pear_sname} = %{version} Provides: php-pear-%{pear_sname} = %{version} Provides: pear-%{pear_sname} = %{version} Obsoletes: php5-pear-%{pear_sname} < %{version} Obsoletes: php-pear-%{pear_sname} < %{version} Obsoletes: pear-%{pear_sname} < %{version} %install %{__mv} package*.xml %{pear_name}-%{version} cd %{pear_name}-%{version} PHP_PEAR_PHP_BIN="$(which php) -d memory_limit=50m" %{__pear} -v \ -d doc_dir=/doc \ -d bin_dir=%{_bindir} \ -d data_dir=%{peardir}/data \ install --offline --nodeps -R "$RPM_BUILD_ROOT" package.xml %{__install} -D -m 0644 package.xml $RPM_BUILD_ROOT%{php_pearxmldir}/%{pear_name}.xml %{__rm} -rf $RPM_BUILD_ROOT/{doc,tmp} %{__rm} -rf "$RPM_BUILD_ROOT"/%{peardir}/.{filemap,lock,registry,channels,depdb,depdblock} %php_gen_filelist %post # on `rpm -ivh` PARAM is 1 # on `rpm -Uvh` PARAM is 2 if [ "$1" = "1" ]; then %{__pear} install --nodeps --soft --force --register-only %{php_pearxmldir}/%{pear_name}.xml fi if [ "$1" = "2" ]; then %{__pear} upgrade --offline --register-only %{php_pearxmldir}/%{pear_name}.xml fi %postun # on `rpm -e` PARAM is 0 if [ "$1" = "0" ]; then %{__pear} uninstall --nodeps --ignore-errors --register-only pear.php.net/%{pear_name} fi %clean %{__rm} -rf %{buildroot} %files -f %{name}.files %defattr(-,root,root) %doc Changes README %changelog ############################################################################# And here an Example of the generated filelist: /usr/share/php5/PEAR/Date.php %dir /usr/share/php5/PEAR/Date /usr/share/php5/PEAR/Date/Calc.php /usr/share/php5/PEAR/Date/Human.php /usr/share/php5/PEAR/Date/Span.php /usr/share/php5/PEAR/Date/TimeZone.php %dir /usr/share/php5/PEAR/test %dir /usr/share/php5/PEAR/test/Date %dir /usr/share/php5/PEAR/test/Date/tests /usr/share/php5/PEAR/test/Date/tests/test_date_methods_span.php /usr/share/php5/PEAR/test/Date/tests/testunit_date_span.php /usr/share/php5/PEAR/test/Date/tests/test_calc.php /usr/share/php5/PEAR/test/Date/tests/calc.php /usr/share/php5/PEAR/test/Date/tests/testunit_date.php /usr/share/php5/PEAR/test/Date/tests/testunit.php %dir /usr/share/php5/PEAR/test/Date/tests/bugs /usr/share/php5/PEAR/test/Date/tests/bugs/bug-727-1.phpt /usr/share/php5/PEAR/test/Date/tests/bugs/bug-727-2.phpt /usr/share/php5/PEAR/test/Date/tests/bugs/bug-727-3.phpt /usr/share/php5/PEAR/test/Date/tests/bugs/bug-727-4.phpt /usr/share/php5/PEAR/test/Date/tests/bugs/bug-674.phpt /usr/share/php5/PEAR/test/Date/tests/bugs/bug-9213.phpt /usr/share/php5/PEAR/test/Date/tests/bugs/bug-9414.phpt /usr/share/php5/PEAR/test/Date/tests/bugs/bug-8912.phpt /usr/share/php5/PEAR/test/Date/tests/bugs/bug-967.phpt /var/lib/pear/Date.xml ++++++ macros.php ++++++ # macros.php file # macros for module building. handle with care. # # Interface versions exposed by PHP: # %php_core_api @PHP_APIVER@ %php_zend_api @PHP_ZENDVER@ # Useful php macros (from Christian Wittmer <[email protected]>) # %__php /usr/bin/php %__phpize /usr/bin/phpize %__php_config /usr/bin/php-config %php_version %(%{__php_config} --version) # %__pear /usr/bin/pear %php_peardir %(%{__pear} config-get php_dir) %php_pearxmldir /var/lib/pear # macro: php_pear_gen_filelist # do the rpmlint happy filelist generation # with %dir in front of directories %php_pear_gen_filelist(n)\ FILES=%{name}.files\ # fgen_dir func\ # IN: dir\ fgen_dir(){\ %{__cat} >> $FILES << EOF\ %dir ${1}\ EOF\ }\ # fgen_file func\ # IN: file\ fgen_file(){\ %{__cat} >> $FILES << EOF\ ${1}\ EOF\ }\ # check for files in %{php_peardir}\ RES=`find ${RPM_BUILD_ROOT}%{php_peardir} -maxdepth 1 -type f`\ if [ -n "$RES" ]; then\ for file in $RES; do\ fgen_file "%{php_peardir}/$(basename ${file})"\ done\ fi\ \ # get all dirs into array\ base_dir="${RPM_BUILD_ROOT}%{php_peardir}/"\ for dir in `find ${base_dir} -type d | sort`; do\ if [ "$dir" = "${base_dir}" ]; then\ continue\ else\ el=`echo $dir | %{__awk} -F"${base_dir}" '{print $2}'`\ all_dir=(${all_dir[@]} $el)\ fi\ done\ \ # build filelist\ for i in ${all_dir[@]}; do\ if [ -d ${base_dir}/${i} ]; then\ RES=`find "${base_dir}/${i}" -maxdepth 1 -type f`\ if [ -n "$RES" ]; then\ fgen_dir "%{php_peardir}/${i}"\ for file in $RES; do\ fgen_file "%{php_peardir}/${i}/$(basename ${file})"\ done\ else\ fgen_dir "%{php_peardir}/${i}"\ fi\ fi\ done\ # add xml file\ fgen_file "%php_pearxmldir/%{pear_name}.xml"\ # ++++++ php-5.4.20-CVE-2013-6420.patch ++++++ https://bugzilla.redhat.com/attachment.cgi?id=831933&action=diff&context=patch&collapsed=&headers=1&format=raw --- ext/openssl/openssl.c 2013-11-28 13:03:15.000000000 +0100 +++ ext/openssl/openssl.c 2013-11-28 12:57:36.000000000 +0100 @@ -688,18 +688,28 @@ char * thestr; long gmadjust = 0; - if (timestr->length < 13) { + if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal ASN1 data type for timestamp"); + return (time_t)-1; + } + + if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp"); + return (time_t)-1; + } + + if (ASN1_STRING_length(timestr) < 13) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "extension author too lazy to parse %s correctly", timestr->data); return (time_t)-1; } - strbuf = estrdup((char *)timestr->data); + strbuf = estrdup((char *)ASN1_STRING_data(timestr)); memset(&thetime, 0, sizeof(thetime)); /* we work backwards so that we can use atoi more easily */ - thestr = strbuf + timestr->length - 3; + thestr = strbuf + ASN1_STRING_length(timestr) - 3; thetime.tm_sec = atoi(thestr); *thestr = '\0'; ++++++ php-5.4.20-CVE-2013-6712.patch ++++++ From: Remi Collet <[email protected]> Date: Wed, 27 Nov 2013 10:13:16 +0000 (+0100) Subject: Fixed bug #66060 (Heap buffer over-read in DateInterval) X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=commitdiff_plain;h=12fe4e90be7bfa2a763197079f68f5568a14e071 Fixed bug #66060 (Heap buffer over-read in DateInterval) --- --- ext/date/lib/parse_iso_intervals.re +++ ext/date/lib/parse_iso_intervals.re @@ -383,7 +383,7 @@ isoweek = year4 "-"? "W" weekofyear; break; } ptr++; - } while (*ptr); + } while (!s->errors->error_count && *ptr); s->have_period = 1; TIMELIB_DEINIT; return TIMELIB_PERIOD; ++++++ php-5.4.20-CVE-2014-0185.patch ++++++ >From 1875b4648f138df77abcb513149a3340ade69a4c Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev <[email protected]> Date: Tue, 15 Apr 2014 10:43:24 -0700 Subject: [PATCH] Fix bug #67060: use default mode of 660 --- sapi/fpm/fpm/fpm_unix.c | 2 +- sapi/fpm/php-fpm.conf.in | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) --- sapi/fpm/fpm/fpm_unix.c +++ sapi/fpm/fpm/fpm_unix.c @@ -35,7 +35,7 @@ int fpm_unix_resolve_socket_premissions(struct fpm_worker_pool_s *wp) /* {{{ */ /* uninitialized */ wp->socket_uid = -1; wp->socket_gid = -1; - wp->socket_mode = 0666; + wp->socket_mode = 0660; if (!c) { return 0; --- sapi/fpm/php-fpm.conf.in +++ sapi/fpm/php-fpm.conf.in @@ -166,10 +166,10 @@ listen = 127.0.0.1:9000 ; permissions must be set in order to allow connections from a web server. Many ; BSD-derived systems allow connections regardless of permissions. ; Default Values: user and group are set as the running user -; mode is set to 0666 +; mode is set to 0660 ;listen.owner = @php_fpm_user@ ;listen.group = @php_fpm_group@ -;listen.mode = 0666 +;listen.mode = 0660 ; List of ipv4 addresses of FastCGI clients which are allowed to connect. ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original -- 1.8.4 ++++++ php-5.4.20-CVE-2014-0207.patch ++++++ From: Remi Collet <[email protected]> Date: Tue, 3 Jun 2014 09:05:00 +0000 (+0200) Subject: Fix bug #67326 fileinfo: cdf_read_short_sector insufficient boundary check X-Git-Tag: php-5.4.30RC1~33 X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=commitdiff_plain;h=4fcb9a9d1b1063a65fbeb27395de4979c75bd962 Fix bug #67326 fileinfo: cdf_read_short_sector insufficient boundary check Upstream fix https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391.patch Only revelant part applied --- diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index 4712e84..16649f1 100644 --- ext/fileinfo/libmagic/cdf.c +++ ext/fileinfo/libmagic/cdf.c @@ -365,10 +365,10 @@ cdf_read_short_sector(const cdf_stream_t *sst, void *buf, size_t offs, size_t ss = CDF_SHORT_SEC_SIZE(h); size_t pos = CDF_SHORT_SEC_POS(h, id); assert(ss == len); - if (pos > CDF_SEC_SIZE(h) * sst->sst_len) { + if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) { DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %" SIZE_T_FORMAT "u\n", - pos, CDF_SEC_SIZE(h) * sst->sst_len)); + pos + len, CDF_SEC_SIZE(h) * sst->sst_len)); return -1; } (void)memcpy(((char *)buf) + offs, ++++++ php-5.4.20-CVE-2014-0237.patch ++++++ http://git.php.net/?p=php-src.git;a=commit;h=68ce2d0ea6da79b12a365e375e1c2ce882c77480 --- ext/fileinfo/libmagic/cdf.c +++ ext/fileinfo/libmagic/cdf.c @@ -942,7 +942,7 @@ int cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h, cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count) { - size_t i, maxcount; + size_t maxcount; const cdf_summary_info_header_t *si = CAST(const cdf_summary_info_header_t *, sst->sst_tab); const cdf_section_declaration_t *sd = @@ -957,21 +957,13 @@ cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h, ssi->si_os = CDF_TOLE2(si->si_os); ssi->si_class = si->si_class; cdf_swap_class(&ssi->si_class); - ssi->si_count = CDF_TOLE2(si->si_count); + ssi->si_count = CDF_TOLE4(si->si_count); *count = 0; maxcount = 0; *info = NULL; - for (i = 0; i < CDF_TOLE4(si->si_count); i++) { - if (i >= CDF_LOOP_LIMIT) { - DPRINTF(("Unpack summary info loop limit")); - errno = EFTYPE; - return -1; - } - if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), - info, count, &maxcount) == -1) { + if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info, + count, &maxcount) == -1) return -1; - } - } return 0; } ++++++ php-5.4.20-CVE-2014-0238.patch ++++++ http://git.php.net/?p=php-src.git;a=commit;h=22736b7c56d678f142d5dd21f4996e5819507a2b --- ext/fileinfo/libmagic/cdf.c +++ ext/fileinfo/libmagic/cdf.c @@ -823,6 +823,10 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, i, inp[i].pi_id, inp[i].pi_type, q - p, offs)); if (inp[i].pi_type & CDF_VECTOR) { nelements = CDF_GETUINT32(q, 1); + if (nelements == 0) { + DPRINTF(("CDF_VECTOR with nelements == 0\n")); + goto out; + } o = 2; } else { nelements = 1; @@ -897,7 +901,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, } DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", nelements)); - for (j = 0; j < nelements; j++, i++) { + for (j = 0; j < nelements && i < sh.sh_properties; + j++, i++) + { uint32_t l = CDF_GETUINT32(q, o); inp[i].pi_str.s_len = l; inp[i].pi_str.s_buf = (const char *) ++++++ php-5.4.20-CVE-2014-2497.patch ++++++ Description: Patch to fix PHP bug 66901. Author: Andres Mejia <[email protected]> Forwarded: no Index: ext/gd/libgd/gdxpm.c =================================================================== --- ext/gd/libgd/gdxpm.c.orig 2014-02-05 11:00:36.000000000 +0100 +++ ext/gd/libgd/gdxpm.c 2014-04-04 14:06:15.991206709 +0200 @@ -39,6 +39,14 @@ number = image.ncolors; colors = (int *) safe_emalloc(number, sizeof(int), 0); for (i = 0; i < number; i++) { + if (!image.colorTable[i].c_color) + { + /* unsupported color key or color key not defined */ + gdImageDestroy(im); + gdFree(colors); + im = 0; + goto done; + } switch (strlen (image.colorTable[i].c_color)) { case 4: buf[1] = '\0'; ++++++ php-5.4.20-CVE-2014-3478.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Ffileinfo%2Flibmagic%2Fsoftmagic.c;h=01e49778bf42811dcb34d8b6e9597922df69520b;hp=21fea6b72647b71fba8b6f56d83f96f612406b2b;hb=e77659a8c87272e5061738a31430d2111482c426;hpb=949cab09f24abb80b8585af744bd964dc17f7401 diff --git a/ext/fileinfo/libmagic/softmagic.c b/ext/fileinfo/libmagic/softmagic.c index 21fea6b..01e4977 100644 --- ext/fileinfo/libmagic/softmagic.c +++ ext/fileinfo/libmagic/softmagic.c @@ -881,10 +881,18 @@ mconvert(struct magic_set *ms, struct magic *m, int flip) return 1; } case FILE_PSTRING: { - char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m); + size_t sz = file_pstring_length_size(m); + char *ptr1 = p->s, *ptr2 = ptr1 + sz; size_t len = file_pstring_get_length(m, ptr1); - if (len >= sizeof(p->s)) - len = sizeof(p->s) - 1; + if (len >= sizeof(p->s)) { + /* + * The size of the pascal string length (sz) + * is 1, 2, or 4. We need at least 1 byte for NUL + * termination, but we've already truncated the + * string by p->s, so we need to deduct sz. + */ + len = sizeof(p->s) - sz; + } while (len--) *ptr1++ = *ptr2++; *ptr1 = '\0'; ++++++ php-5.4.20-CVE-2014-3479.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Ffileinfo%2Flibmagic%2Fcdf.c;h=c9a5d50a35bae973cc01801a422c94f8ff9cd86d;hp=16649f193fbce5336369f30ce23cad3fd24f87aa;hb=5c9f96799961818944d43b22c241cc56c215c2e4;hpb=d02aa440909b7a20098ccc9d3820629a36037596 diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index 16649f1..c9a5d50 100644 --- ext/fileinfo/libmagic/cdf.c +++ ext/fileinfo/libmagic/cdf.c @@ -277,13 +277,15 @@ cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h, { const char *b = (const char *)sst->sst_tab; const char *e = ((const char *)p) + tail; + size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ? + CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h); (void)&line; - if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len) + if (e >= b && (size_t)(e - b) <= ss * sst->sst_len) return 0; DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u" " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %" SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b), - CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len)); + ss * sst->sst_len, ss, sst->sst_len)); errno = EFTYPE; return -1; } ++++++ php-5.4.20-CVE-2014-3480.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Ffileinfo%2Flibmagic%2Fcdf.c;h=ee467a6671ed93b91728f9820ed643efaab736a9;hp=c9a5d50a35bae973cc01801a422c94f8ff9cd86d;hb=40ef6e07e0b2cdced57c506e08cf18f47122292d;hpb=2b33a41162a729b3b680fa2015efe11f15cc3114 diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index c9a5d50..ee467a6 100644 --- ext/fileinfo/libmagic/cdf.c +++ ext/fileinfo/libmagic/cdf.c @@ -470,7 +470,8 @@ size_t cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size) { size_t i, j; - cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size); + cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size) + / sizeof(maxsector)); DPRINTF(("Chain:")); for (j = i = 0; sid >= 0; i++, j++) { @@ -480,8 +481,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size) errno = EFTYPE; return (size_t)-1; } - if (sid > maxsector) { - DPRINTF(("Sector %d > %d\n", sid, maxsector)); + if (sid >= maxsector) { + DPRINTF(("Sector %d >= %d\n", sid, maxsector)); errno = EFTYPE; return (size_t)-1; } ++++++ php-5.4.20-CVE-2014-3487.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Ffileinfo%2Flibmagic%2Fcdf.c;h=429f3b952f68d1ef7f2ebb4925ef5b16c54b7833;hp=ee467a6671ed93b91728f9820ed643efaab736a9;hb=25b1dc917a53787dbb2532721ca22f3f36eb13c0;hpb=da5d40bae6505364c3604385a2b6ae4e27a4a5d6 diff --git a/ext/fileinfo/libmagic/cdf.c b/ext/fileinfo/libmagic/cdf.c index ee467a6..429f3b9 100644 --- ext/fileinfo/libmagic/cdf.c +++ ext/fileinfo/libmagic/cdf.c @@ -812,7 +812,11 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1) goto out; for (i = 0; i < sh.sh_properties; i++) { - size_t ofs = CDF_GETUINT32(p, (i << 1) + 1); + size_t ofs, tail = (i << 1) + 1; + if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t), + __LINE__) == -1) + goto out; + ofs = CDF_GETUINT32(p, tail); q = (const uint8_t *)(const void *) ((const char *)(const void *)p + ofs - 2 * sizeof(uint32_t)); ++++++ php-5.4.20-CVE-2014-3515.patch ++++++ From: Stanislav Malyshev <[email protected]> Date: Sun, 22 Jun 2014 02:46:16 +0000 (-0700) Subject: Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion X-Git-Tag: php-5.4.30~6 X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=commitdiff_plain;h=88223c5245e9b470e1e6362bfd96829562ffe6ab Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion --- diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 758947a..bf034ab 100644 --- ext/spl/spl_array.c +++ ext/spl/spl_array.c @@ -1808,7 +1808,7 @@ SPL_METHOD(Array, unserialize) ++p; ALLOC_INIT_ZVAL(pmembers); - if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) { + if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) { zval_ptr_dtor(&pmembers); goto outexcept; } diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c index 1a706f7..da9110b 100644 --- ext/spl/spl_observer.c +++ ext/spl/spl_observer.c @@ -898,7 +898,7 @@ SPL_METHOD(SplObjectStorage, unserialize) ++p; ALLOC_INIT_ZVAL(pmembers); - if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) { + if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) { zval_ptr_dtor(&pmembers); goto outexcept; } ++++++ php-5.4.20-CVE-2014-4049.patch ++++++ >From 4f73394fdd95d3165b4391e1b0dedd57fced8c3b Mon Sep 17 00:00:00 2001 From: Sara Golemon <[email protected]> Date: Tue, 10 Jun 2014 11:18:02 -0700 Subject: [PATCH] Fix potential segfault in dns_get_record() If the remote sends us a packet with a malformed TXT record, we could end up trying to over-consume the packet and wander off into overruns. --- ext/standard/dns.c | 4 ++++ 1 file changed, 4 insertions(+) --- ext/standard/dns.c +++ ext/standard/dns.c @@ -517,6 +517,10 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int while (ll < dlen) { n = cp[ll]; + if ((ll + n) >= dlen) { + // Invalid chunk length, truncate + n = dlen - (ll + 1); + } memcpy(tp + ll , cp + ll + 1, n); add_next_index_stringl(entries, cp + ll + 1, n, 1); ll = ll + n + 1; -- 1.9.3 ++++++ php-CVE-2014-3597.patch ++++++ >From 2fefae47716d501aec41c1102f3fd4531f070b05 Mon Sep 17 00:00:00 2001 From: Remi Collet <[email protected]> Date: Tue, 19 Aug 2014 08:33:49 +0200 Subject: [PATCH] Fixed Sec Bug #67717 segfault in dns_get_record CVE-2014-3597 Incomplete fix for CVE-2014-4049 Check possible buffer overflow - pass real buffer end to dn_expand calls - check buffer len before each read --- ext/standard/dns.c | 84 ++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 60 insertions(+), 24 deletions(-) diff --git a/ext/standard/dns.c b/ext/standard/dns.c index 214a7dc..0b5e69c 100644 --- ext/standard/dns.c +++ ext/standard/dns.c @@ -412,8 +412,14 @@ PHP_FUNCTION(dns_check_record) #if HAVE_FULL_DNS_FUNCS +#define CHECKCP(n) do { \ + if (cp + n > end) { \ + return NULL; \ + } \ +} while (0) + /* {{{ php_parserr */ -static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int store, int raw, zval **subarray) +static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_to_fetch, int store, int raw, zval **subarray) { u_short type, class, dlen; u_long ttl; @@ -425,16 +431,18 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int *subarray = NULL; - n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, sizeof(name) - 2); + n = dn_expand(answer->qb2, end, cp, name, sizeof(name) - 2); if (n < 0) { return NULL; } cp += n; + CHECKCP(10); GETSHORT(type, cp); GETSHORT(class, cp); GETLONG(ttl, cp); GETSHORT(dlen, cp); + CHECKCP(dlen); if (type_to_fetch != T_ANY && type != type_to_fetch) { cp += dlen; return cp; @@ -461,12 +469,14 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int switch (type) { case DNS_T_A: + CHECKCP(4); add_assoc_string(*subarray, "type", "A", 1); snprintf(name, sizeof(name), "%d.%d.%d.%d", cp[0], cp[1], cp[2], cp[3]); add_assoc_string(*subarray, "ip", name, 1); cp += dlen; break; case DNS_T_MX: + CHECKCP(2); add_assoc_string(*subarray, "type", "MX", 1); GETSHORT(n, cp); add_assoc_long(*subarray, "pri", n); @@ -485,7 +495,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int if (type == DNS_T_PTR) { add_assoc_string(*subarray, "type", "PTR", 1); } - n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2); + n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2); if (n < 0) { return NULL; } @@ -495,18 +505,22 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int case DNS_T_HINFO: /* See RFC 1010 for values */ add_assoc_string(*subarray, "type", "HINFO", 1); + CHECKCP(1); n = *cp & 0xFF; cp++; + CHECKCP(n); add_assoc_stringl(*subarray, "cpu", (char*)cp, n, 1); cp += n; + CHECKCP(1); n = *cp & 0xFF; cp++; + CHECKCP(n); add_assoc_stringl(*subarray, "os", (char*)cp, n, 1); cp += n; break; case DNS_T_TXT: { - int ll = 0; + int l1 = 0, l2 = 0; zval *entries = NULL; add_assoc_string(*subarray, "type", "TXT", 1); @@ -515,37 +529,41 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int MAKE_STD_ZVAL(entries); array_init(entries); - while (ll < dlen) { - n = cp[ll]; - if ((ll + n) >= dlen) { + while (l1 < dlen) { + n = cp[l1]; + if ((l1 + n) >= dlen) { // Invalid chunk length, truncate - n = dlen - (ll + 1); + n = dlen - (l1 + 1); + } + if (n) { + memcpy(tp + l2 , cp + l1 + 1, n); + add_next_index_stringl(entries, cp + l1 + 1, n, 1); } - memcpy(tp + ll , cp + ll + 1, n); - add_next_index_stringl(entries, cp + ll + 1, n, 1); - ll = ll + n + 1; + l1 = l1 + n + 1; + l2 = l2 + n; } - tp[dlen] = '\0'; + tp[l2] = '\0'; cp += dlen; - add_assoc_stringl(*subarray, "txt", tp, (dlen>0)?dlen - 1:0, 0); + add_assoc_stringl(*subarray, "txt", tp, l2, 0); add_assoc_zval(*subarray, "entries", entries); } break; case DNS_T_SOA: add_assoc_string(*subarray, "type", "SOA", 1); - n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) -2); + n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2); if (n < 0) { return NULL; } cp += n; add_assoc_string(*subarray, "mname", name, 1); - n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) -2); + n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2); if (n < 0) { return NULL; } cp += n; add_assoc_string(*subarray, "rname", name, 1); + CHECKCP(5*4); GETLONG(n, cp); add_assoc_long(*subarray, "serial", n); GETLONG(n, cp); @@ -559,6 +577,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int break; case DNS_T_AAAA: tp = (u_char*)name; + CHECKCP(8*2); for(i=0; i < 8; i++) { GETSHORT(s, cp); if (s != 0) { @@ -593,6 +612,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int case DNS_T_A6: p = cp; add_assoc_string(*subarray, "type", "A6", 1); + CHECKCP(1); n = ((int)cp[0]) & 0xFF; cp++; add_assoc_long(*subarray, "masklen", n); @@ -628,6 +648,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int cp++; } for (i = (n + 8) / 16; i < 8; i++) { + CHECKCP(2); GETSHORT(s, cp); if (s != 0) { if (tp > (u_char *)name) { @@ -657,7 +678,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int tp[0] = '\0'; add_assoc_string(*subarray, "ipv6", name, 1); if (cp < p + dlen) { - n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2); + n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2); if (n < 0) { return NULL; } @@ -666,6 +687,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int } break; case DNS_T_SRV: + CHECKCP(3*2); add_assoc_string(*subarray, "type", "SRV", 1); GETSHORT(n, cp); add_assoc_long(*subarray, "pri", n); @@ -673,7 +695,7 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int add_assoc_long(*subarray, "weight", n); GETSHORT(n, cp); add_assoc_long(*subarray, "port", n); - n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2); + n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2); if (n < 0) { return NULL; } @@ -681,21 +703,35 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int add_assoc_string(*subarray, "target", name, 1); break; case DNS_T_NAPTR: + CHECKCP(2*2); add_assoc_string(*subarray, "type", "NAPTR", 1); GETSHORT(n, cp); add_assoc_long(*subarray, "order", n); GETSHORT(n, cp); add_assoc_long(*subarray, "pref", n); + + CHECKCP(1); n = (cp[0] & 0xFF); - add_assoc_stringl(*subarray, "flags", (char*)++cp, n, 1); + cp++; + CHECKCP(n); + add_assoc_stringl(*subarray, "flags", (char*)cp, n, 1); cp += n; + + CHECKCP(1); n = (cp[0] & 0xFF); - add_assoc_stringl(*subarray, "services", (char*)++cp, n, 1); + cp++; + CHECKCP(n); + add_assoc_stringl(*subarray, "services", (char*)cp, n, 1); cp += n; + + CHECKCP(1); n = (cp[0] & 0xFF); - add_assoc_stringl(*subarray, "regex", (char*)++cp, n, 1); + cp++; + CHECKCP(n); + add_assoc_stringl(*subarray, "regex", (char*)cp, n, 1); cp += n; - n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2); + + n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2); if (n < 0) { return NULL; } @@ -888,7 +924,7 @@ PHP_FUNCTION(dns_get_record) while (an-- && cp && cp < end) { zval *retval; - cp = php_parserr(cp, &answer, type_to_fetch, store_results, raw, &retval); + cp = php_parserr(cp, end, &answer, type_to_fetch, store_results, raw, &retval); if (retval != NULL && store_results) { add_next_index_zval(return_value, retval); } @@ -901,7 +937,7 @@ PHP_FUNCTION(dns_get_record) while (ns-- > 0 && cp && cp < end) { zval *retval = NULL; - cp = php_parserr(cp, &answer, DNS_T_ANY, authns != NULL, raw, &retval); + cp = php_parserr(cp, end, &answer, DNS_T_ANY, authns != NULL, raw, &retval); if (retval != NULL) { add_next_index_zval(authns, retval); } @@ -913,7 +949,7 @@ PHP_FUNCTION(dns_get_record) while (ar-- > 0 && cp && cp < end) { zval *retval = NULL; - cp = php_parserr(cp, &answer, DNS_T_ANY, 1, raw, &retval); + cp = php_parserr(cp, end, &answer, DNS_T_ANY, 1, raw, &retval); if (retval != NULL) { add_next_index_zval(addtl, retval); } ++++++ php-CVE-2014-3668.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fxmlrpc%2Flibxmlrpc%2Fxmlrpc.c;h=b766a5495a41b3ecd5eecdcfae901c9068937da0;hp=ce70c2afd909b748f3ddc4560a1c3f882a498014;hb=88412772d295ebf7dd34409534507dc9bcac726e;hpb=82b07b62c06e9e55ab3590f20bd80a84ce73a801 diff --git a/ext/xmlrpc/libxmlrpc/xmlrpc.c b/ext/xmlrpc/libxmlrpc/xmlrpc.c index ce70c2a..b766a54 100644 --- ext/xmlrpc/libxmlrpc/xmlrpc.c +++ ext/xmlrpc/libxmlrpc/xmlrpc.c @@ -219,16 +219,19 @@ static int date_from_ISO8601 (const char *text, time_t * value) { n = 10; tm.tm_mon = 0; for(i = 0; i < 2; i++) { - XMLRPC_IS_NUMBER(text[i]) + XMLRPC_IS_NUMBER(text[i+4]) tm.tm_mon += (text[i+4]-'0')*n; n /= 10; } tm.tm_mon --; + if(tm.tm_mon < 0 || tm.tm_mon > 11) { + return -1; + } n = 10; tm.tm_mday = 0; for(i = 0; i < 2; i++) { - XMLRPC_IS_NUMBER(text[i]) + XMLRPC_IS_NUMBER(text[i+6]) tm.tm_mday += (text[i+6]-'0')*n; n /= 10; } @@ -236,7 +239,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) { n = 10; tm.tm_hour = 0; for(i = 0; i < 2; i++) { - XMLRPC_IS_NUMBER(text[i]) + XMLRPC_IS_NUMBER(text[i+9]) tm.tm_hour += (text[i+9]-'0')*n; n /= 10; } @@ -244,7 +247,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) { n = 10; tm.tm_min = 0; for(i = 0; i < 2; i++) { - XMLRPC_IS_NUMBER(text[i]) + XMLRPC_IS_NUMBER(text[i+12]) tm.tm_min += (text[i+12]-'0')*n; n /= 10; } @@ -252,7 +255,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) { n = 10; tm.tm_sec = 0; for(i = 0; i < 2; i++) { - XMLRPC_IS_NUMBER(text[i]) + XMLRPC_IS_NUMBER(text[i+15]) tm.tm_sec += (text[i+15]-'0')*n; n /= 10; } ++++++ php-CVE-2014-3669.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fstandard%2Fvar_unserializer.re;h=6de158392e116823eaba710dbf221e722e351250;hp=130750805f462a4a79cddf5a96e95bf2e63bf432;hb=56754a7f9eba0e4f559b6ca081d9f2a447b3f159;hpb=88412772d295ebf7dd34409534507dc9bcac726e diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re index 1307508..6de1583 100644 --- ext/standard/var_unserializer.re +++ ext/standard/var_unserializer.re @@ -376,7 +376,7 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce) (*p) += 2; - if (datalen < 0 || (*p) + datalen >= max) { + if (datalen < 0 || (max - (*p)) <= datalen) { zend_error(E_WARNING, "Insufficient data for unserializing - %ld required, %ld present", datalen, (long)(max - (*p))); return 0; } ++++++ php-CVE-2014-3670.patch ++++++ -Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fexif%2Fexif.c;h=637ebf9289b40d157fdf8edcdddeb3d907b28d9b;hp=38907b4d942a8d2419060a688aa3c5e5dedcb118;hb=ddb207e7fa2e9adeba021a1303c3781efda5409b;hpb=d1e030db02f402efebfe2976482dd7e7ebe2956f diff --git a/ext/exif/exif.c b/ext/exif/exif.c index 38907b4..637ebf9 100644 --- ext/exif/exif.c +++ ext/exif/exif.c @@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel data_ptr += 8; break; case TAG_FMT_SINGLE: - memmove(data_ptr, &info_data->value.f, byte_count); + memmove(data_ptr, &info_value->f, 4); data_ptr += 4; break; case TAG_FMT_DOUBLE: - memmove(data_ptr, &info_data->value.d, byte_count); + memmove(data_ptr, &info_value->d, 8); data_ptr += 8; break; } ++++++ php-CVE-2014-4670.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fspl%2Fspl_dllist.c;h=0b44d414d82378bf2741fcd568dff20f407380a6;hp=39a0733b9ac78901cc7eaf9eba080ff060517771;hb=df78c48354f376cf419d7a97f88ca07d572f00fb;hpb=131e60ce569631b5b7c61b8392f545dde936df3e --- ext/spl/spl_dllist.c +++ ext/spl/spl_dllist.c @@ -43,12 +43,10 @@ PHPAPI zend_class_entry *spl_ce_SplStack; #define SPL_LLIST_DELREF(elem) if(!--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_CHECK_DELREF(elem) if((elem) && !--(elem)->rc) { \ efree(elem); \ - elem = NULL; \ } #define SPL_LLIST_ADDREF(elem) (elem)->rc++ @@ -916,6 +914,11 @@ SPL_METHOD(SplDoublyLinkedList, offsetUnset) llist->dtor(element TSRMLS_CC); } + if (intern->traverse_pointer == element) { + SPL_LLIST_DELREF(element); + intern->traverse_pointer = NULL; + } + zval_ptr_dtor((zval **)&element->data); element->data = NULL; ++++++ php-CVE-2014-4698.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fspl%2Fspl_array.c;h=0fe47b651c13f80c35e612de5cf69ea306095fe6;hp=8392e72714b80483641b1a0d2b6e6389e3c22959;hb=22882a9d89712ff2b6ebc20a689a89452bba4dcd;hpb=df78c48354f376cf419d7a97f88ca07d572f00fb Index: ext/spl/spl_array.c =================================================================== --- ext/spl/spl_array.c.orig 2014-07-17 15:55:19.213412193 +0200 +++ ext/spl/spl_array.c 2014-07-17 15:55:19.229412192 +0200 @@ -1738,6 +1738,7 @@ const unsigned char *p, *s; php_unserialize_data_t var_hash; zval *pmembers, *pflags = NULL; + HashTable *aht; long flags; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) { @@ -1749,6 +1750,12 @@ return; } + aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + if (aht->nApplyCount > 0) { + zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); + return; + } + /* storage */ s = p = (const unsigned char*)buf; PHP_VAR_UNSERIALIZE_INIT(var_hash); ++++++ php-CVE-2014-4721.patch ++++++ https://bugs.php.net/patch-display.php?bug_id=67498&patch=bug67948-patch&revision=latest --- ext/standard/info.c +++ ext/standard/info.c @@ -875,16 +875,16 @@ PHPAPI void php_print_info(int flag TSRMLS_DC) php_info_print_table_start(); php_info_print_table_header(2, "Variable", "Value"); - if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE) { + if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) { php_info_print_table_row(2, "PHP_SELF", Z_STRVAL_PP(data)); } - if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE) { + if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) { php_info_print_table_row(2, "PHP_AUTH_TYPE", Z_STRVAL_PP(data)); } - if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE) { + if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) { php_info_print_table_row(2, "PHP_AUTH_USER", Z_STRVAL_PP(data)); } - if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE) { + if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) { php_info_print_table_row(2, "PHP_AUTH_PW", Z_STRVAL_PP(data)); } php_print_gpcse_array(ZEND_STRL("_REQUEST") TSRMLS_CC); ++++++ php-CVE-2014-5120.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fgd%2Fgd_ctx.c;h=253b6648f35e19aeec2bcd06edc7bfb2c8eb4c8d;hp=59eff80443685ffc99516423f47beb1ace4910eb;hb=1daa4c0090b7cd8178dcaa96287234c69ac6ca18;hpb=fbceec5861e08b10e75af36a097da35d9f808ef6 diff --git a/ext/gd/gd_ctx.c b/ext/gd/gd_ctx.c index 59eff80..253b664 100644 --- ext/gd/gd_ctx.c +++ ext/gd/gd_ctx.c @@ -124,6 +124,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type, RETURN_FALSE; } } else if (Z_TYPE_P(to_zval) == IS_STRING) { + if (CHECK_ZVAL_NULL_PATH(to_zval)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes"); + RETURN_FALSE; + } + stream = php_stream_open_wrapper(Z_STRVAL_P(to_zval), "wb", REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL); if (stream == NULL) { RETURN_FALSE; ++++++ php-CVE-2014-8142.patch ++++++ http://git.php.net/?p=php-src.git;a=commitdiff;h=630f9c33c23639de85c3fd306b209b538b73b4c9 index 7afef6a..4cf1d10 100644 --- ext/standard/var_unserializer.re +++ ext/standard/var_unserializer.re @@ -347,6 +347,9 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long } else { /* object properties should include no integers */ convert_to_string(key); + if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) { + var_push_dtor(var_hash, old_data); + } zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof data, NULL); } ++++++ php-CVE-2014-9427.patch ++++++ http://git.php.net/?p=php-src.git;a=commit;h=f9ad3086693fce680fbe246e4a45aa92edd2ac35 Index: sapi/cgi/cgi_main.c =================================================================== --- sapi/cgi/cgi_main.c.orig 2015-01-05 17:05:35.584546329 +0100 +++ sapi/cgi/cgi_main.c 2015-01-05 17:06:02.786896356 +0100 @@ -2435,14 +2435,17 @@ int i = 1; c = file_handle.handle.stream.mmap.buf[i++]; - while (c != '\n' && c != '\r' && c != EOF) { + while (c != '\n' && c != '\r' && i < file_handle.handle.stream.mmap.len) { c = file_handle.handle.stream.mmap.buf[i++]; } if (c == '\r') { - if (file_handle.handle.stream.mmap.buf[i] == '\n') { + if (i < file_handle.handle.stream.mmap.len && file_handle.handle.stream.mmap.buf[i] == '\n') { i++; } } + if(i > file_handle.handle.stream.mmap.len) { + i = file_handle.handle.stream.mmap.len; + } file_handle.handle.stream.mmap.buf += i; file_handle.handle.stream.mmap.len -= i; } ++++++ php-CVE-2015-0231.patch ++++++ http://git.php.net/?p=php-src.git;a=commitdiff;h=e63f7b47e1937821e75e9862284c3150e1b1d524;hp=fc6aa939f59c9be0febe0fa141629e49541bab8c --- ext/standard/var_unserializer.re +++ ext/standard/var_unserializer.re @@ -347,7 +347,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long } else { /* object properties should include no integers */ convert_to_string(key); - if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) { + if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) { var_push_dtor(var_hash, old_data); } zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, ++++++ php-CVE-2015-0232.patch ++++++ X-Git-Url: http://72.52.91.13:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fexif%2Fexif.c;h=7f95ff43ea7cc9a2c41a912863ed70069c0e34c5;hp=637ebf9289b40d157fdf8edcdddeb3d907b28d9b;hb=2fc178cf448d8e1b95d1314e47eeef610729e0df;hpb=f9ad3086693fce680fbe246e4a45aa92edd2ac35 index 637ebf9..7f95ff4 100644 Index: ext/exif/exif.c =================================================================== --- ext/exif/exif.c.orig 2015-01-26 13:09:34.856131108 +0100 +++ ext/exif/exif.c 2015-01-26 13:09:56.748392976 +0100 @@ -2701,6 +2701,7 @@ { xp_field->tag = tag; + xp_field->value = NULL; /* Copy the comment */ if (zend_multibyte_encoding_converter( (unsigned char**)&xp_field->value, ++++++ php-fpm.init ++++++ #!/bin/sh # # Template SUSE system startup script for example service/daemon php-fpm # Copyright (C) 1995--2005 Kurt Garloff, SUSE / Novell Inc. # # This library is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or (at # your option) any later version. # # This library is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, # USA. # # /etc/init.d/php-fpm # and its symbolic link # /(usr/)sbin/rcphp-fpm # # Template system startup script for some example service/daemon php-fpm # # LSB compatible service control script; see http://www.linuxbase.org/spec/ # # Note: This template uses functions rc_XXX defined in /etc/rc.status on # UnitedLinux/SUSE/Novell based Linux distributions. If you want to base your # script on this template and ensure that it works on non UL based LSB # compliant Linux distributions, you either have to provide the rc.status # functions from UL or change the script to work without them. # See skeleton.compat for a template that works with other distros as well. # ### BEGIN INIT INFO # Provides: php-fpm # Required-Start: $remote_fs $network # Should-Start: nginx lighttpd httpd # Required-Stop: $network $remote_fs # Should-Stop: nginx lighttpd httpd # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Short-Description: php-fpm daemon # Description: Start php-fpm to # continued on second line by '#<TAB>' # should contain enough info for the runlevel editor # to give admin some idea what this service does and # what it's needed for ... # (The Short-Description should already be a good hint.) ### END INIT INFO # # Any extensions to the keywords given above should be preceeded by # X-VendorTag- (X-UnitedLinux- X-SuSE- for us) according to LSB. # # Notes on Required-Start/Should-Start: # * There are two different issues that are solved by Required-Start # and Should-Start # (a) Hard dependencies: This is used by the runlevel editor to determine # which services absolutely need to be started to make the start of # this service make sense. Example: nfsserver should have # Required-Start: $portmap # Also, required services are started before the dependent ones. # The runlevel editor will warn about such missing hard dependencies # and suggest enabling. During system startup, you may expect an error, # if the dependency is not fulfilled. # (b) Specifying the init script ordering, not real (hard) dependencies. # This is needed by insserv to determine which service should be # started first (and at a later stage what services can be started # in parallel). The tag Should-Start: is used for this. # It tells, that if a service is available, it should be started # before. If not, never mind. # * When specifying hard dependencies or ordering requirements, you can # use names of services (contents of their Provides: section) # or pseudo names starting with a $. The following ones are available # according to LSB (1.1): # $local_fs all local file systems are mounted # (most services should need this!) # $remote_fs all remote file systems are mounted # (note that /usr may be remote, so # many services should Require this!) # $syslog system logging facility up # $network low level networking (eth card, ...) # $named hostname resolution available # $netdaemons all network daemons are running # The $netdaemons pseudo service has been removed in LSB 1.2. # For now, we still offer it for backward compatibility. # These are new (LSB 1.2): # $time the system time has been set correctly # $portmap SunRPC portmapping service available # UnitedLinux extensions: # $ALL indicates that a script should be inserted # at the end # * The services specified in the stop tags # (Required-Stop/Should-Stop) # specify which services need to be still running when this service # is shut down. Often the entries there are just copies or a subset # from the respective start tag. # * Should-Start/Stop are now part of LSB as of 2.0, # formerly SUSE/Unitedlinux used X-UnitedLinux-Should-Start/-Stop. # insserv does support both variants. # * X-UnitedLinux-Default-Enabled: yes/no is used at installation time # (%fillup_and_insserv macro in %post of many RPMs) to specify whether # a startup script should default to be enabled after installation. # It's not used by insserv. # # Note on runlevels: # 0 - halt/poweroff 6 - reboot # 1 - single user 2 - multiuser without network exported # 3 - multiuser w/ network (text mode) 5 - multiuser w/ network and X11 (xdm) # # Note on script names: # http://www.linuxbase.org/spec/refspecs/LSB_1.3.0/gLSB/gLSB/scrptnames.html # A registry has been set up to manage the init script namespace. # http://www.lanana.org/ # Please use the names already registered or register one or use a # vendor prefix. # Check for missing binaries (stale symlinks should not happen) # Note: Special treatment of stop for LSB conformance PHPFPM_BIN=/usr/sbin/php-fpm test -x $PHPFPM_BIN || { echo "$PHPFPM_BIN not installed"; if [ "$1" = "stop" ]; then exit 0; else exit 5; fi; } FPM_CONFIG="--fpm-config /etc/php5/fpm/php-fpm.conf" # Source LSB init functions # providing start_daemon, killproc, pidofproc, # log_success_msg, log_failure_msg and log_warning_msg. # This is currently not used by UnitedLinux based distributions and # not needed for init scripts for UnitedLinux only. If it is used, # the functions from rc.status should not be sourced or used. #. /lib/lsb/init-functions # Shell functions sourced from /etc/rc.status: # rc_check check and set local and overall rc status # rc_status check and set local and overall rc status # rc_status -v be verbose in local rc status and clear it afterwards # rc_status -v -r ditto and clear both the local and overall rc status # rc_status -s display "skipped" and exit with status 3 # rc_status -u display "unused" and exit with status 3 # rc_failed set local and overall rc status to failed # rc_failed <num> set local and overall rc status to <num> # rc_reset clear both the local and overall rc status # rc_exit exit appropriate to overall rc status # rc_active checks whether a service is activated by symlinks . /etc/rc.status # Reset status of this service rc_reset # Return values acc. to LSB for all commands but status: # 0 - success # 1 - generic or unspecified error # 2 - invalid or excess argument(s) # 3 - unimplemented feature (e.g. "reload") # 4 - user had insufficient privileges # 5 - program is not installed # 6 - program is not configured # 7 - program is not running # 8--199 - reserved (8--99 LSB, 100--149 distrib, 150--199 appl) # # Note that starting an already running service, stopping # or restarting a not-running service as well as the restart # with force-reload (in case signaling is not supported) are # considered a success. case "$1" in start) echo -n "Starting php-fpm" ## Start daemon with startproc(8). If this fails ## the return value is set appropriately by startproc. /sbin/startproc $PHPFPM_BIN $FPM_CONFIG # Remember status and be verbose rc_status -v ;; stop) echo -n "Shutting down php-fpm " ## Stop daemon with killproc(8) and if this fails ## killproc sets the return value according to LSB. /sbin/killproc -QUIT $PHPFPM_BIN # Remember status and be verbose rc_status -v ;; try-restart|condrestart) ## Do a restart only if the service was active before. ## Note: try-restart is now part of LSB (as of 1.9). ## RH has a similar command named condrestart. if test "$1" = "condrestart"; then echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}" fi $0 status if test $? = 0; then $0 restart else rc_reset # Not running is not a failure. fi # Remember status and be quiet rc_status ;; restart) ## Stop the service and regardless of whether it was ## running or not, start it again. $0 stop $0 start # Remember status and be quiet rc_status ;; force-reload) ## Signal the daemon to reload its config. Most daemons ## do this on signal 1 (SIGHUP). ## If it does not support it, restart the service if it ## is running. echo -n "Reload service php-fpm" ## if it supports it: /sbin/killproc -USR2 $PHPFPM_BIN rc_status -v ## Otherwise: #$0 try-restart #rc_status ;; reload) ## Like force-reload, but if daemon does not support ## signaling, do nothing (!) # If it supports signaling: echo -n "Reload service php-fpm " /sbin/killproc -USR2 $PHPFPM_BIN rc_status -v ## Otherwise if it does not support reload: #rc_failed 3 #rc_status -v ;; status) echo -n "Checking for service php-fpm " ## Check status with checkproc(8), if process is running ## checkproc will return with exit status 0. # Return value is slightly different for the status command: # 0 - service up and running # 1 - service dead, but /var/run/ pid file exists # 2 - service dead, but /var/lock/ lock file exists # 3 - service not running (unused) # 4 - service status unknown :-( # 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.) # NOTE: checkproc returns LSB compliant status values. /sbin/checkproc $PHPFPM_BIN # NOTE: rc_status knows that we called this init script with # "status" option and adapts its messages accordingly. rc_status -v ;; *) echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload}" exit 1 ;; esac rc_exit ++++++ php-unserialize-null-ptr-deref.patch ++++++ http://git.php.net/?p=php-src.git;a=commitdiff;h=13f1c276ab72cf1a8a400fd013b9289d0018a340 Index: ext/standard/var_unserializer.re =================================================================== --- ext/standard/var_unserializer.re.orig 2014-12-30 09:31:06.509843894 +0100 +++ ext/standard/var_unserializer.re 2014-12-30 09:32:36.810979870 +0100 @@ -58,7 +58,13 @@ PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval) { - var_entries *var_hash = (*var_hashx)->last_dtor; + var_entries *var_hash; + + if (!var_hashx || !*var_hashx) { + return; + } + + var_hash = (*var_hashx)->last_dtor; #if VAR_ENTRIES_DBG fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval)); #endif ++++++ php5-64-bit-post-large-files.patch ++++++ https://bugs.php.net/bug.php?id=44522 Index: php-5.4.13/main/rfc1867.c =================================================================== --- php-5.4.13.orig/main/rfc1867.c +++ php-5.4.13/main/rfc1867.c @@ -676,7 +676,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_ { char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL; char *temp_filename = NULL, *lbuf = NULL, *abuf = NULL; - int boundary_len = 0, total_bytes = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0; + long total_bytes = 0; int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0; int max_file_size = 0, skip_upload = 0, anonindex = 0, is_anonymous; zval *http_post_files = NULL; HashTable *uploaded_files = NULL; Index: php-5.4.13/main/SAPI.h =================================================================== --- php-5.4.13.orig/main/SAPI.h +++ php-5.4.13/main/SAPI.h @@ -82,7 +82,7 @@ typedef struct { char *post_data, *raw_post_data; char *cookie_data; long content_length; - uint post_data_length, raw_post_data_length; + uint IGNORE_post_data_length, IGNORE_raw_post_data_length; char *path_translated; char *request_uri; @@ -112,6 +112,7 @@ typedef struct { int argc; char **argv; int proto_num; + long post_data_length, raw_post_data_length; } sapi_request_info; @@ -119,7 +120,7 @@ typedef struct _sapi_globals_struct { void *server_context; sapi_request_info request_info; sapi_headers_struct sapi_headers; - int read_post_bytes; + long read_post_bytes; unsigned char headers_sent; struct stat global_stat; char *default_mimetype; Index: php-5.4.13/sapi/cgi/cgi_main.c =================================================================== --- php-5.4.13.orig/sapi/cgi/cgi_main.c +++ php-5.4.13/sapi/cgi/cgi_main.c @@ -508,7 +508,7 @@ static int sapi_cgi_read_post(char *buff uint read_bytes = 0; int tmp_read_bytes; - count_bytes = MIN(count_bytes, (uint) SG(request_info).content_length - SG(read_post_bytes)); + count_bytes = MIN(count_bytes, SG(request_info).content_length - SG(read_post_bytes)); while (read_bytes < count_bytes) { tmp_read_bytes = read(STDIN_FILENO, buffer + read_bytes, count_bytes - read_bytes); if (tmp_read_bytes <= 0) { Index: php-5.4.13/ext/suhosin/rfc1867.c =================================================================== --- php-5.4.13.orig/ext/suhosin/rfc1867.c +++ php-5.4.13/ext/suhosin/rfc1867.c @@ -779,7 +779,7 @@ SAPI_POST_HANDLER_FUNC(suhosin_rfc1867_p { char *boundary, *s=NULL, *boundary_end = NULL, *start_arr=NULL, *array_index=NULL; char *temp_filename=NULL, *lbuf=NULL, *abuf=NULL; - int boundary_len=0, total_bytes=0, cancel_upload=0, is_arr_upload=0, array_len=0; + long boundary_len=0, total_bytes=0, cancel_upload=0, is_arr_upload=0, array_len=0; int max_file_size=0, skip_upload=0, anonindex=0, is_anonymous; zval *http_post_files=NULL; HashTable *uploaded_files=NULL; #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING) ++++++ php5-BNC-457056.patch ++++++ Index: ext/xml/compat.c =================================================================== --- ext/xml/compat.c.orig 2009-01-12 15:30:21.000000000 +0100 +++ ext/xml/compat.c 2009-03-14 18:32:40.000000000 +0100 @@ -482,9 +482,7 @@ XML_ParserCreate_MM(const XML_Char *enco parser->parser->charset = XML_CHAR_ENCODING_NONE; #endif -#if LIBXML_VERSION >= 20703 xmlCtxtUseOptions(parser->parser, XML_PARSE_OLDSAX); -#endif parser->parser->replaceEntities = 1; parser->parser->wellFormed = 0; ++++++ php5-apache24-updates.patch ++++++ commit 918a01f55b5e0a82c1a2e886143a56eddffe6649 Author: Cristian Rodríguez <[email protected]> Date: Wed Aug 8 19:30:04 2012 +0200 sapi/apache2*: Use ap_state_query where possible instead of old method of creating a pool userdata entry. diff --git a/sapi/apache2filter/sapi_apache2.c b/sapi/apache2filter/sapi_apache2.c index a8fec5c..21f2fa3 100644 --- a/sapi/apache2filter/sapi_apache2.c +++ b/sapi/apache2filter/sapi_apache2.c @@ -606,11 +606,17 @@ static int php_apache_server_startup(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s) { + +#if AP_MODULE_MAGIC_AT_LEAST(20110203,1) + /* Apache will load, unload and then reload a DSO module. This + * prevents us from starting PHP until the second load. */ + if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) { + return OK; + } +#else void *data = NULL; const char *userdata_key = "apache2filter_post_config"; - /* Apache will load, unload and then reload a DSO module. This - * prevents us from starting PHP until the second load. */ apr_pool_userdata_get(&data, userdata_key, s->process->pool); if (data == NULL) { /* We must use set() here and *not* setn(), otherwise the @@ -622,6 +628,7 @@ php_apache_server_startup(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_cleanup_null, s->process->pool); return OK; } +#endif /* Set up our overridden path. */ if (apache2_php_ini_path_override) { diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c index 900a3a4..a578740 100644 --- a/sapi/apache2handler/sapi_apache2.c +++ b/sapi/apache2handler/sapi_apache2.c @@ -430,12 +430,19 @@ static int php_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp static int php_apache_server_startup(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s) { - void *data = NULL; - const char *userdata_key = "apache2hook_post_config"; +#if AP_MODULE_MAGIC_AT_LEAST(20110203,1) /* Apache will load, unload and then reload a DSO module. This * prevents us from starting PHP until the second load. */ + if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) { + return OK; + } +#else + void *data = NULL; + const char *userdata_key = "apache2hook_post_config"; + apr_pool_userdata_get(&data, userdata_key, s->process->pool); + if (data == NULL) { /* We must use set() here and *not* setn(), otherwise the * static string pointed to by userdata_key will be mapped @@ -445,6 +452,7 @@ php_apache_server_startup(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp apr_pool_userdata_set((const void *)1, userdata_key, apr_pool_cleanup_null, s->process->pool); return OK; } +#endif /* Set up our overridden path. */ if (apache2_php_ini_path_override) { ++++++ php5-apache_sapi_install.patch ++++++ # Do not attempt to modify apache configuration on module install ================================================================================ --- sapi/apache2handler/config.m4 | 9 --------- 1 file changed, 9 deletions(-) Index: sapi/apache2handler/config.m4 =================================================================== --- sapi/apache2handler/config.m4.orig 2008-03-11 23:47:39.000000000 +0100 +++ sapi/apache2handler/config.m4 2010-08-03 06:31:18.512616000 +0200 @@ -68,18 +68,9 @@ if test "$PHP_APXS2" != "no"; then fi APXS_LIBEXECDIR='$(INSTALL_ROOT)'`$APXS -q LIBEXECDIR` - if test -z `$APXS -q SYSCONFDIR`; then INSTALL_IT="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \ $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \ -i -n php5" - else - APXS_SYSCONFDIR='$(INSTALL_ROOT)'`$APXS -q SYSCONFDIR` - INSTALL_IT="\$(mkinstalldirs) '$APXS_LIBEXECDIR' && \ - \$(mkinstalldirs) '$APXS_SYSCONFDIR' && \ - $APXS -S LIBEXECDIR='$APXS_LIBEXECDIR' \ - -S SYSCONFDIR='$APXS_SYSCONFDIR' \ - -i -a -n php5" - fi case $host_alias in *aix*) ++++++ php5-cloexec.patch ++++++ Index: ext/standard/exec.c =================================================================== --- ext/standard/exec.c.orig +++ ext/standard/exec.c @@ -76,7 +76,11 @@ PHPAPI int php_exec(int type, char *cmd, #ifdef PHP_WIN32 fp = VCWD_POPEN(cmd, "rb"); #else + #if defined(__linux__) && __GLIBC_PREREQ(2, 9) + fp = VCWD_POPEN(cmd, "re"); + #else fp = VCWD_POPEN(cmd, "r"); + #endif #endif if (!fp) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to fork [%s]", cmd); Index: ext/standard/file.c =================================================================== --- ext/standard/file.c.orig +++ ext/standard/file.c @@ -926,6 +926,12 @@ PHP_FUNCTION(popen) } } #endif +#if defined(__linux__) && __GLIBC_PREREQ(2, 9) + char *e = memchr(posix_mode, 'e', mode_len); + if (e) { + memmove(e, e + 1, mode_len - (e - posix_mode)); + } +#endif fp = VCWD_POPEN(command, posix_mode); if (!fp) { Index: ext/standard/mail.c =================================================================== --- ext/standard/mail.c.orig +++ ext/standard/mail.c @@ -321,8 +321,12 @@ PHPAPI int php_mail(char *to, char *subj * (e.g. the shell can't be executed) we explicitly set it to 0 to be * sure we don't catch any older errno value. */ errno = 0; +#if defined(__linux__) && __GLIBC_PREREQ(2, 9) + sendmail = popen(sendmail_cmd, "we"); +#else sendmail = popen(sendmail_cmd, "w"); #endif +#endif if (extra_cmd != NULL) { efree (sendmail_cmd); } ++++++ php5-crypt-tests.patch ++++++ Index: ext/standard/config.m4 =================================================================== --- ext/standard/config.m4.orig +++ ext/standard/config.m4 @@ -60,7 +60,14 @@ if test "$ac_cv_func_crypt" = "no"; then AC_DEFINE(HAVE_CRYPT, 1, [ ]) ]) fi - + +if test "$ac_cv_func_crypt" = "no"; then + AC_CHECK_LIB(crypt, crypt_r, [ + LIBS="-lcrypt $LIBS -lcrypt" + AC_DEFINE(HAVE_CRYPT_R, 1, [ ]) + ]) +fi + AC_CACHE_CHECK(for standard DES crypt, ac_cv_crypt_des,[ AC_TRY_RUN([ #if HAVE_UNISTD_H @@ -172,7 +179,7 @@ main() { ac_cv_crypt_blowfish=no ])]) -AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_SHA512,[ +AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_sha512,[ AC_TRY_RUN([ #if HAVE_UNISTD_H #include <unistd.h> @@ -184,24 +191,22 @@ AC_TRY_RUN([ main() { #if HAVE_CRYPT - char salt[30], answer[80]; + char salt[120]; - salt[0]='$'; salt[1]='6'; salt[2]='$'; salt[3]='$'; salt[4]='b'; salt[5]='a'; salt[6]='r'; salt[7]='\0'; - strcpy(answer, salt); - strcpy(&answer[29],"$6$$QMXjqd7rHQZPQ1yHsXkQqC1FBzDiVfTHXL.LaeDAeVV.IzMaV9VU4MQ8kPuZa2SOP1A0RPm772EaFYjpEJtdu."); - exit (strcmp((char *)crypt("foo",salt),answer)); + strcpy(salt, "\$6\$rounds=5000\$usesomesillystri\$D4IrlXatmP7rx3P3InaxBeoomnAihCKRVQP22JZ6EY47Wc6BkroIuUUBOov1i.S5KPgErtP/EN5mcO.ChWQW21"); + exit (strcmp((char *)crypt("rasmuslerdorf",salt),salt)); #else exit(0); #endif }],[ - ac_cv_crypt_SHA512=yes + ac_cv_crypt_sha512=yes ],[ - ac_cv_crypt_SHA512=no + ac_cv_crypt_sha512=no ],[ - ac_cv_crypt_SHA512=no + ac_cv_crypt_sha512=no ])]) -AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_SHA256,[ +AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_sha256,[ AC_TRY_RUN([ #if HAVE_UNISTD_H #include <unistd.h> @@ -213,28 +218,31 @@ AC_TRY_RUN([ main() { #if HAVE_CRYPT - char salt[30], answer[80]; - salt[0]='$'; salt[1]='5'; salt[2]='$'; salt[3]='$'; salt[4]='s'; salt[5]='a'; salt[6]='l'; salt[7]='t'; salt[8]='s'; salt[9]='t'; salt[10]='r'; salt[11]='i'; salt[12]='n'; salt[13]='g'; salt[14]='\0'; - strcat(salt,""); - strcpy(answer, salt); - strcpy(&answer[29], "$5$saltstring$5B8vYYiY.CVt1RlTTf8KbXBH3hsxY/GNooZaBBGWEc5"); - exit (strcmp((char *)crypt("foo",salt),answer)); + char salt[80]; + strcpy(salt, "\$5\$rounds=5000\$usesomesillystri\$KqJWpanXZHKq2BOB43TSaYhEWsQ1Lr5QNyPCDH/Tp.6"); + exit (strcmp((char *)crypt("rasmuslerdorf",salt),salt)); #else exit(0); #endif }],[ - ac_cv_crypt_SHA256=yes + ac_cv_crypt_sha256=yes ],[ - ac_cv_crypt_SHA256=no + ac_cv_crypt_sha256=no ],[ - ac_cv_crypt_SHA256=no + ac_cv_crypt_sha256=no ])]) dnl -dnl If one of them is missing, use our own implementation, portable code is then possible +dnl If one of them or crypt_r() is missing, use our own implementation, portable code is then possible dnl -if test "$ac_cv_crypt_blowfish" = "no" || test "$ac_cv_crypt_des" = "no" || test "$ac_cv_crypt_ext_des" = "no" || test "x$php_crypt_r" = "x0"; then +if test "$ac_cv_crypt_des" = "no" || + /* test "$ac_cv_crypt_ext_des" = "no" ||*/ + test "$ac_cv_crypt_md5" = "no" || + test "$ac_cv_crypt_blowfish" = "no" || + test "$ac_cv_crypt_sha512" = "no" || + test "$ac_cv_crypt_sha256" = "no" || + test "$ac_cv_lib_crypt_crypt_r" = "no"; then dnl dnl Check for __alignof__ support in the compiler ++++++ php5-format-string-issues.patch ++++++ --- main/snprintf.h.orig +++ main/snprintf.h @@ -83,7 +83,7 @@ PHPAPI int ap_php_vslprintf(char *buf, s PHPAPI int ap_php_snprintf(char *, size_t, const char *, ...); PHPAPI int ap_php_vsnprintf(char *, size_t, const char *, va_list ap); PHPAPI int ap_php_vasprintf(char **buf, const char *format, va_list ap); -PHPAPI int ap_php_asprintf(char **buf, const char *format, ...); +PHPAPI int ap_php_asprintf(char **buf, const char *format, ...) PHP_ATTRIBUTE_FORMAT(printf, 2, 3); PHPAPI int php_sprintf (char* s, const char* format, ...) PHP_ATTRIBUTE_FORMAT(printf, 2, 3); PHPAPI char * php_gcvt(double value, int ndigit, char dec_point, char exponent, char *buf); PHPAPI char * php_conv_fp(register char format, register double num, --- main/main.c.orig +++ main/main.c @@ -898,7 +898,7 @@ PHPAPI void php_html_puts(const char *st /* {{{ php_error_cb extended error handling function */ -static void php_error_cb(int type, const char *error_filename, const uint error_lineno, const char *format, va_list args) +static PHP_ATTRIBUTE_FORMAT(printf, 4, 0) void php_error_cb(int type, const char *error_filename, const uint error_lineno, const char *format, va_list args) { char *buffer; int buffer_len, display; --- Zend/zend.h.orig +++ Zend/zend.h @@ -146,6 +146,14 @@ char *alloca (); # define ZEND_ATTRIBUTE_MALLOC #endif +#if ZEND_GCC_VERSION >= 4003 +#define ZEND_ATTR_ALLOC_SIZE(x) __attribute__((__alloc_size__(x))) +#define ZEND_ATTR_ALLOC_SIZE2(x,y) __attribute__((__alloc_size__(x,y))) +#else +#define ZEND_ATTR_ALLOC_SIZE(x) +#define ZEND_ATTR_ALLOC_SIZE2(x,y) +#endif + #if ZEND_GCC_VERSION >= 2007 # define ZEND_ATTRIBUTE_FORMAT(type, idx, first) __attribute__ ((format(type, idx, first))) #else --- Zend/zend_alloc.h.orig +++ Zend/zend_alloc.h @@ -54,14 +54,14 @@ BEGIN_EXTERN_C() ZEND_API char *zend_strndup(const char *s, unsigned int length) ZEND_ATTRIBUTE_MALLOC; -ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC; -ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC; -ZEND_API void *_safe_malloc(size_t nmemb, size_t size, size_t offset) ZEND_ATTRIBUTE_MALLOC; +ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTR_ALLOC_SIZE(1); +ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTR_ALLOC_SIZE2(1,2); +ZEND_API void *_safe_malloc(size_t nmemb, size_t size, size_t offset) ZEND_ATTRIBUTE_MALLOC ZEND_ATTR_ALLOC_SIZE2(1,2); ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC); -ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC; -ZEND_API void *_erealloc(void *ptr, size_t size, int allow_failure ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC); -ZEND_API void *_safe_erealloc(void *ptr, size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC); -ZEND_API void *_safe_realloc(void *ptr, size_t nmemb, size_t size, size_t offset); +ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTR_ALLOC_SIZE2(1,2); +ZEND_API void *_erealloc(void *ptr, size_t size, int allow_failure ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTR_ALLOC_SIZE(2); +ZEND_API void *_safe_erealloc(void *ptr, size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTR_ALLOC_SIZE2(2,3); +ZEND_API void *_safe_realloc(void *ptr, size_t nmemb, size_t size, size_t offset) ZEND_ATTR_ALLOC_SIZE2(2,3); ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC; ZEND_API char *_estrndup(const char *s, unsigned int length ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC; ZEND_API size_t _zend_mem_block_size(void *ptr TSRMLS_DC ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC); @@ -90,7 +90,7 @@ ZEND_API size_t _zend_mem_block_size(voi #define estrndup_rel(s, length) _estrndup((s), (length) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_CC) #define zend_mem_block_size_rel(ptr) _zend_mem_block_size((ptr) TSRMLS_CC ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_CC) -inline static void * __zend_malloc(size_t len) +inline static ZEND_ATTR_ALLOC_SIZE(1) void * __zend_malloc(size_t len) { void *tmp = malloc(len); if (tmp) { @@ -100,14 +100,14 @@ inline static void * __zend_malloc(size_ exit(1); } -inline static void * __zend_calloc(size_t nmemb, size_t len) +inline static ZEND_ATTR_ALLOC_SIZE2(1,2) void * __zend_calloc(size_t nmemb, size_t len) { void *tmp = _safe_malloc(nmemb, len, 0); memset(tmp, 0, nmemb * len); return tmp; } -inline static void * __zend_realloc(void *p, size_t len) +inline static ZEND_ATTR_ALLOC_SIZE(2) void * __zend_realloc(void *p, size_t len) { p = realloc(p, len); if (p) { ++++++ php5-gcc_builtins.patch ++++++ --- Zend/zend_alloc.c.orig +++ Zend/zend_alloc.c @@ -36,7 +36,7 @@ # include <wincrypt.h> # include <process.h> #endif - +#include <x86intrin.h> #ifndef ZEND_MM_HEAP_PROTECTION # define ZEND_MM_HEAP_PROTECTION ZEND_DEBUG #endif @@ -665,10 +665,7 @@ static inline unsigned int zend_mm_high_ __asm__("bsrl %1,%0\n\t" : "=r" (n) : "rm" (_size)); return n; #elif defined(__GNUC__) && defined(__x86_64__) - unsigned long n; - - __asm__("bsrq %1,%0\n\t" : "=r" (n) : "rm" (_size)); - return (unsigned int)n; + return __bsrq(_size); #elif defined(_MSC_VER) && defined(_M_IX86) __asm { bsr eax, _size @@ -691,10 +688,7 @@ static inline unsigned int zend_mm_low_b __asm__("bsfl %1,%0\n\t" : "=r" (n) : "rm" (_size)); return n; #elif defined(__GNUC__) && defined(__x86_64__) - unsigned long n; - - __asm__("bsfq %1,%0\n\t" : "=r" (n) : "rm" (_size)); - return (unsigned int)n; + return __bsfq(_size); #elif defined(_MSC_VER) && defined(_M_IX86) __asm { bsf eax, _size ++++++ php5-ini.patch ++++++ Index: php.ini-production =================================================================== --- php.ini-production.orig +++ php.ini-production @@ -702,7 +702,7 @@ default_mimetype = "text/html" ;;;;;;;;;;;;;;;;;;;;;;;;; ; UNIX: "/path1:/path2" -;include_path = ".:/php/includes" +include_path = ".:/usr/share/php5:/usr/share/php5/PEAR" ; ; Windows: "\path1;\path2" ;include_path = ".;c:\php\includes" @@ -916,7 +916,7 @@ cli_server.color = On [Date] ; Defines the default timezone used by the date functions ; http://php.net/date.timezone -;date.timezone = +date.timezone = 'UTC' ; http://php.net/date.default-latitude ;date.default_latitude = 31.7667 @@ -1106,7 +1106,7 @@ mysql.allow_local_infile = On ; Allow or prevent persistent links. ; http://php.net/mysql.allow-persistent -mysql.allow_persistent = On +mysql.allow_persistent = Off ; If mysqlnd is used: Number of cache slots for the internal result set cache ; http://php.net/mysql.cache_size @@ -1169,7 +1169,7 @@ mysqli.max_persistent = -1 ; Allow or prevent persistent links. ; http://php.net/mysqli.allow-persistent -mysqli.allow_persistent = On +mysqli.allow_persistent = Off ; Maximum number of links. -1 means no limit. ; http://php.net/mysqli.max-links @@ -1391,7 +1391,7 @@ session.save_handler = files ; where MODE is the octal representation of the mode. Note that this ; does not overwrite the process's umask. ; http://php.net/session.save-path -;session.save_path = "/tmp" +session.save_path = "/var/lib/php5" ; Whether to use cookies. ; http://php.net/session.use-cookies @@ -1507,7 +1507,7 @@ session.referer_check = ; How many bytes to read from the file. ; http://php.net/session.entropy-length -;session.entropy_length = 32 +session.entropy_length = 32 ; Specified here to create the session id. ; http://php.net/session.entropy-file @@ -1516,7 +1516,7 @@ session.referer_check = ; If neither are found at compile time, the default is no entropy file. ; On windows, setting the entropy_length setting will activate the ; Windows random source (using the CryptoAPI) -;session.entropy_file = /dev/urandom +session.entropy_file = /dev/urandom ; Set to {nocache,private,public,} to determine HTTP caching aspects ; or leave this empty to avoid sending anti-caching headers. @@ -1547,7 +1547,7 @@ session.use_trans_sid = 0 ; the hash extension. A list of available hashes is returned by the hash_algos() ; function. ; http://php.net/session.hash-function -session.hash_function = 0 +session.hash_function = sha256 ; Define how many bits are stored in each character when converting ; the binary hash data to something readable. ++++++ php5-mbstring-missing-return.patch ++++++ Index: ext/mbstring/libmbfl/filters/mbfilter_sjis_2004.c =================================================================== --- ext/mbstring/libmbfl/filters/mbfilter_sjis_2004.c.orig 2013-09-18 07:48:57.000000000 +0200 +++ ext/mbstring/libmbfl/filters/mbfilter_sjis_2004.c 2013-09-25 11:59:19.925758346 +0200 @@ -672,6 +672,8 @@ CK(mbfl_filt_conv_illegal_output(c, filter)); } } + + return c; } int Index: ext/mbstring/libmbfl/filters/mbfilter_utf8.c =================================================================== --- ext/mbstring/libmbfl/filters/mbfilter_utf8.c.orig 2013-09-18 07:48:57.000000000 +0200 +++ ext/mbstring/libmbfl/filters/mbfilter_utf8.c 2013-09-25 12:22:04.061030824 +0200 @@ -101,6 +101,7 @@ filter->status = 0; filter->cache = 0; CK((*filter->output_function)(w, filter->data)); + return 0; } ++++++ php5-missing-extdeps.patch ++++++ Index: ext/soap/soap.c =================================================================== --- ext/soap/soap.c.orig +++ ext/soap/soap.c @@ -442,10 +442,18 @@ static const zend_function_entry soap_he PHP_FE_END }; -zend_module_entry soap_module_entry = { -#ifdef STANDARD_MODULE_HEADER - STANDARD_MODULE_HEADER, +/* {{{ soap dependencies */ +static const zend_module_dep soap_module_deps[] = { + ZEND_MOD_REQUIRED("standard") +#if HAVE_PHP_SESSION && !defined(COMPILE_DL_SESSION) + ZEND_MOD_REQUIRED("session") #endif + {NULL, NULL, NULL} +}; + +zend_module_entry soap_module_entry = { + STANDARD_MODULE_HEADER_EX, NULL, + soap_module_deps, "soap", soap_functions, PHP_MINIT(soap), Index: ext/wddx/wddx.c =================================================================== --- ext/wddx/wddx.c.orig +++ ext/wddx/wddx.c @@ -154,10 +154,21 @@ ZEND_GET_MODULE(wddx) #endif /* COMPILE_DL_WDDX */ /* }}} */ +/* {{{ wddx dependencies */ +static const zend_module_dep wddx_module_deps[] = { + ZEND_MOD_REQUIRED("standard") + ZEND_MOD_REQUIRED("xml") + ZEND_MOD_REQUIRED("date") +#if HAVE_PHP_SESSION && !defined(COMPILE_DL_SESSION) + ZEND_MOD_REQUIRED("session") +#endif + {NULL, NULL, NULL} +}; /* {{{ wddx_module_entry */ zend_module_entry wddx_module_entry = { - STANDARD_MODULE_HEADER, + STANDARD_MODULE_HEADER_EX, NULL, + wddx_module_deps, "wddx", wddx_functions, PHP_MINIT(wddx), Index: ext/filter/filter.c =================================================================== --- ext/filter/filter.c.orig +++ ext/filter/filter.c @@ -132,12 +132,17 @@ static const zend_function_entry filter_ }; /* }}} */ +/* {{{ filter dependencies */ +static const zend_module_dep filter_module_deps[] = { + ZEND_MOD_REQUIRED("standard") + ZEND_MOD_REQUIRED("pcre") + {NULL, NULL, NULL} +}; /* {{{ filter_module_entry */ zend_module_entry filter_module_entry = { -#if ZEND_MODULE_API_NO >= 20010901 - STANDARD_MODULE_HEADER, -#endif + STANDARD_MODULE_HEADER_EX, NULL, + filter_module_deps, "filter", filter_functions, PHP_MINIT(filter), Index: ext/mbstring/mbstring.c =================================================================== --- ext/mbstring/mbstring.c.orig +++ ext/mbstring/mbstring.c @@ -570,9 +570,19 @@ const zend_function_entry mbstring_funct }; /* }}} */ +/* {{{ mbstring dependencies */ +static const zend_module_dep mbstring_module_deps[] = { + ZEND_MOD_REQUIRED("standard") +#if (HAVE_PCRE || HAVE_BUNDLED_PCRE) && !HAVE_ONIG + ZEND_MOD_REQUIRED("pcre") +#endif + {NULL, NULL, NULL} +}; + /* {{{ zend_module_entry mbstring_module_entry */ zend_module_entry mbstring_module_entry = { - STANDARD_MODULE_HEADER, + STANDARD_MODULE_HEADER_EX, NULL, + mbstring_module_deps, "mbstring", mbstring_functions, PHP_MINIT(mbstring), ++++++ php5-no-build-date.patch ++++++ Index: ext/standard/info.c =================================================================== --- ext/standard/info.c.orig +++ ext/standard/info.c @@ -697,7 +697,7 @@ PHPAPI void php_print_info(int flag TSRM php_info_print_box_end(); php_info_print_table_start(); php_info_print_table_row(2, "System", php_uname ); - php_info_print_table_row(2, "Build Date", __DATE__ " " __TIME__ ); + /* php_info_print_table_row(2, "Build Date", __DATE__ " " __TIME__ ); */ #ifdef COMPILER php_info_print_table_row(2, "Compiler", COMPILER); #endif @@ -705,7 +705,7 @@ PHPAPI void php_print_info(int flag TSRM php_info_print_table_row(2, "Architecture", ARCHITECTURE); #endif #ifdef CONFIGURE_COMMAND - php_info_print_table_row(2, "Configure Command", CONFIGURE_COMMAND ); + /* php_info_print_table_row(2, "Configure Command", CONFIGURE_COMMAND ); */ #endif if (sapi_module.pretty_name) { Index: sapi/fpm/fpm/fpm_main.c =================================================================== --- sapi/fpm/fpm/fpm_main.c.orig +++ sapi/fpm/fpm/fpm_main.c @@ -1710,7 +1710,7 @@ int main(int argc, char *argv[]) #if ZEND_DEBUG php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); #else - php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); + php_printf("PHP %s (%s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, get_zend_version()); #endif php_request_shutdown((void *) 0); fcgi_shutdown(); Index: configure.in =================================================================== --- configure.in.orig +++ configure.in @@ -1257,8 +1257,8 @@ fi EXTRA_LDFLAGS="$EXTRA_LDFLAGS $PHP_LDFLAGS" EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $PHP_LDFLAGS" - -PHP_BUILD_DATE=`date '+%Y-%m-%d'` +#totally fake, not used anywhere in userspace +PHP_BUILD_DATE="1970-01-01" AC_DEFINE_UNQUOTED(PHP_BUILD_DATE,"$PHP_BUILD_DATE",[PHP build date]) case $host_alias in @@ -1269,7 +1269,8 @@ case $host_alias in AC_DEFINE_UNQUOTED(PHP_UNAME,"$PHP_UNAME",[hardcode for each of the cross compiler host]) ;; *) - PHP_UNAME=`uname -a | xargs` +dnl Totally fake, it wasnt and will never be reliable anyway. + PHP_UNAME="Linux suse 2.6.36 #1 SMP 2011-02-21 10:34:10 +0100 x86_64 x86_64 x86_64 GNU/Linux" AC_DEFINE_UNQUOTED(PHP_UNAME,"$PHP_UNAME",[uname -a output]) PHP_OS=`uname | xargs` AC_DEFINE_UNQUOTED(PHP_OS,"$PHP_OS",[uname output]) Index: sapi/cli/php_cli.c =================================================================== --- sapi/cli/php_cli.c.orig +++ sapi/cli/php_cli.c @@ -687,8 +687,8 @@ static int do_cli(int argc, char **argv goto out; case 'v': /* show php version & quit */ - php_printf("PHP %s (%s) (built: %s %s) %s\nCopyright (c) 1997-2013 The PHP Group\n%s", - PHP_VERSION, cli_sapi_module.name, __DATE__, __TIME__, + php_printf("PHP %s (%s) %s\nCopyright (c) 1997-2013 The PHP Group\n%s", + PHP_VERSION, cli_sapi_module.name, #if ZEND_DEBUG && defined(HAVE_GCOV) "(DEBUG GCOV)", #elif ZEND_DEBUG Index: sapi/cgi/cgi_main.c =================================================================== --- sapi/cgi/cgi_main.c.orig +++ sapi/cgi/cgi_main.c @@ -2218,7 +2218,7 @@ consult the installation file that came #if ZEND_DEBUG php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); #else - php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version()); + php_printf("PHP %s (%s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, get_zend_version()); #endif php_request_shutdown((void *) 0); fcgi_shutdown(); ++++++ php5-no-reentrant-crypt.patch ++++++ Index: ext/standard/crypt.c =================================================================== --- ext/standard/crypt.c +++ ext/standard/crypt.c @@ -302,6 +302,8 @@ PHP_FUNCTION(crypt) RETURN_STRING(crypt_res, 1); } } +# else + RETURN_STRING(crypt(str, salt), 1); # endif #endif } ++++++ php5-openssl.patch ++++++ Index: ext/openssl/openssl.c =================================================================== --- ext/openssl/openssl.c.orig +++ ext/openssl/openssl.c @@ -51,6 +51,7 @@ #include <openssl/rand.h> #include <openssl/ssl.h> #include <openssl/pkcs12.h> +#include <openssl/engine.h> /* Common */ #include <time.h> @@ -1015,10 +1016,16 @@ PHP_MINIT_FUNCTION(openssl) le_x509 = zend_register_list_destructors_ex(php_x509_free, NULL, "OpenSSL X.509", module_number); le_csr = zend_register_list_destructors_ex(php_csr_free, NULL, "OpenSSL X.509 CSR", module_number); + OPENSSL_config(NULL); SSL_library_init(); OpenSSL_add_all_ciphers(); OpenSSL_add_all_digests(); OpenSSL_add_all_algorithms(); +/* Load all bundled ENGINEs into memory and make them visible */ + ENGINE_load_builtin_engines(); + /* Register all of them for every algorithm they collectively implement */ + ENGINE_register_all_complete(); + SSL_load_error_strings(); Index: ext/openssl/xp_ssl.c =================================================================== --- ext/openssl/xp_ssl.c.orig +++ ext/openssl/xp_ssl.c @@ -378,6 +378,10 @@ static inline int php_openssl_setup_cryp return -1; } +#ifdef SSL_MODE_RELEASE_BUFFERS + SSL_CTX_set_mode(sslsock->ctx, SSL_MODE_RELEASE_BUFFERS); +#endif + #if OPENSSL_VERSION_NUMBER >= 0x0090605fL ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; #endif ++++++ php5-per-mod-log.patch ++++++ commit 59dfd98677886d418bda90ac5291ba8dea638dc7 Author: Cristian Rodríguez <[email protected]> Date: Wed Aug 8 21:12:57 2012 +0200 Fix per-module logging in apache 2.4 --- php-5.4.17.orig/sapi/apache2handler/php_apache.h +++ php-5.4.17/sapi/apache2handler/php_apache.h @@ -24,7 +24,11 @@ #include "httpd.h" #include "http_config.h" #include "http_core.h" +#include "http_log.h" +#ifdef APLOG_USE_MODULE +APLOG_USE_MODULE(php5); +#endif /* Declare this so we can get to it from outside the sapi_apache2.c file */ extern module AP_MODULE_DECLARE_DATA php5_module; ++++++ php5-php-config.patch ++++++ --- scripts/php-config.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: scripts/php-config.in =================================================================== --- scripts/php-config.in.orig 2007-08-24 13:44:10.000000000 +0200 +++ scripts/php-config.in 2010-08-03 06:31:18.786529000 +0200 @@ -5,7 +5,7 @@ prefix="@prefix@" exec_prefix="@exec_prefix@" version="@PHP_VERSION@" vernum="@PHP_VERSION_ID@" -include_dir="@includedir@/php" +include_dir="@includedir@/php5" includes="-I$include_dir -I$include_dir/main -I$include_dir/TSRM -I$include_dir/Zend -I$include_dir/ext -I$include_dir/ext/date/lib" ldflags="@PHP_LDFLAGS@" libs="@EXTRA_LIBS@" ++++++ php5-phpize.patch ++++++ --- scripts/Makefile.frag | 4 ++-- scripts/phpize.in | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) Index: scripts/Makefile.frag =================================================================== --- scripts/Makefile.frag.orig +++ scripts/Makefile.frag @@ -3,8 +3,8 @@ # Build environment install # -phpincludedir = $(includedir)/php -phpbuilddir = $(libdir)/build +phpincludedir = $(includedir)/php5 +phpbuilddir = $(datadir)/build BUILD_FILES = \ scripts/phpize.m4 \ Index: scripts/phpize.in =================================================================== --- scripts/phpize.in.orig +++ scripts/phpize.in @@ -4,8 +4,8 @@ prefix='@prefix@' datarootdir='@datarootdir@' exec_prefix="`eval echo @exec_prefix@`" -phpdir="`eval echo @libdir@`/build" -includedir="`eval echo @includedir@`/php" +phpdir="`eval echo @datadir@`/build" +includedir="`eval echo @includedir@`/php5" builddir="`pwd`" SED="@SED@" ++++++ php5-pts.patch ++++++ --- ext/standard/proc_open.c.orig +++ ext/standard/proc_open.c @@ -62,7 +62,7 @@ * */ #ifdef PHP_CAN_SUPPORT_PROC_OPEN -#if 0 && HAVE_PTSNAME && HAVE_GRANTPT && HAVE_UNLOCKPT && HAVE_SYS_IOCTL_H && HAVE_TERMIOS_H +#if HAVE_PTSNAME && HAVE_GRANTPT && HAVE_UNLOCKPT && HAVE_SYS_IOCTL_H && HAVE_TERMIOS_H # include <sys/ioctl.h> # include <termios.h> # define PHP_CAN_DO_PTS 1 ++++++ php5-suhosin-crash.patch ++++++ >From 117b6aa6efec61afaa1431c698dad8eb553b55f5 Mon Sep 17 00:00:00 2001 From: Olivier Blin <[email protected]> Date: Sun, 31 Mar 2013 01:15:48 +0100 Subject: [PATCH] Fix saving sessions in PHP 5.4 with user session handlers (fix #12) When session storage functions are set with session_set_save_handler() (this is the "mod_user" mode), mod_data will be NULL in PHP 5.4, and suhosin session hooks will bail out. PHP 5.4 allows to check this with mod_user_implemented instead. --- session.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/session.c b/session.c index 1045a93..513c195 100644 --- ext/suhosin/session.c +++ ext/suhosin/session.c @@ -728,7 +728,12 @@ static int suhosin_hook_s_read(void **mod_data, const char *key, char **val, int }*/ /* protect dumb session handlers */ - if (key == NULL || !key[0] || *mod_data == NULL) { + if (key == NULL || !key[0] || + (*mod_data == NULL +#if PHP_VERSION_ID >= 50400 + && !SESSION_G(mod_user_implemented) +#endif + )) { regenerate: SDEBUG("regenerating key is %s", key); KEY = SESSION_G(id) = SESSION_G(mod)->s_create_sid(&SESSION_G(mod_data), NULL TSRMLS_CC); @@ -777,7 +782,12 @@ static int suhosin_hook_s_write(void **mod_data, const char *key, const char *va char *v = (char *)val; /* protect dumb session handlers */ - if (key == NULL || !key[0] || val == NULL || strlen(key) > SUHOSIN_G(session_max_id_length) || *mod_data == NULL) { + if (key == NULL || !key[0] || val == NULL || strlen(key) > SUHOSIN_G(session_max_id_length) || + (*mod_data == NULL +#if PHP_VERSION_ID >= 50400 + && !SESSION_G(mod_user_implemented) +#endif + )) { r = FAILURE; goto return_write; } @@ -820,7 +830,12 @@ static int suhosin_hook_s_destroy(void **mod_data, const char *key TSRMLS_DC) int r; /* protect dumb session handlers */ - if (key == NULL || !key[0] || strlen(key) > SUHOSIN_G(session_max_id_length) || *mod_data == NULL) { + if (key == NULL || !key[0] || strlen(key) > SUHOSIN_G(session_max_id_length) || + (*mod_data == NULL +#if PHP_VERSION_ID >= 50400 + && !SESSION_G(mod_user_implemented) +#endif + )) { return FAILURE; } ++++++ php5-suhosin-php54.patch ++++++ ++++ 714 lines (skipped) ++++++ php5-systzdata-v7.patch ++++++ ++++ 619 lines (skipped) ++++++ php5-wrong-fail-stack_push.patch ++++++ Index: Zend/zend_stack.c =================================================================== --- Zend/zend_stack.c.orig 2014-12-17 10:39:40.000000000 +0100 +++ Zend/zend_stack.c 2015-01-07 15:13:38.258091022 +0100 @@ -34,10 +34,11 @@ { if (stack->top >= stack->max) { /* we need to allocate more memory */ stack->elements = (void **) erealloc(stack->elements, - (sizeof(void **) * (stack->max += STACK_BLOCK_SIZE))); + (sizeof(void **) * (stack->max + STACK_BLOCK_SIZE))); if (!stack->elements) { return FAILURE; } + stack->max += STACK_BLOCK_SIZE; } stack->elements[stack->top] = (void *) emalloc(size); memcpy(stack->elements[stack->top], element, size); -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
