Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package php7.17250 for 
openSUSE:Leap:15.2:Update checked in at 2021-12-10 18:06:21
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Leap:15.2:Update/php7.17250 (Old)
 and      /work/SRC/openSUSE:Leap:15.2:Update/.php7.17250.new.2520 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "php7.17250"

Fri Dec 10 18:06:21 2021 rev:1 rq:936274 version:7.4.6

Changes:
--------
New Changes file:

--- /dev/null   2021-12-09 00:52:20.582305468 +0100
+++ /work/SRC/openSUSE:Leap:15.2:Update/.php7.17250.new.2520/php7.changes       
2021-12-10 18:06:22.804790852 +0100
@@ -0,0 +1,4662 @@
+-------------------------------------------------------------------
+Fri Nov 26 10:50:27 UTC 2021 - pgaj...@suse.com
+
+- security update
+- added patches
+  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml 
parsing
+  + php7-CVE-2021-21707.patch
+
+-------------------------------------------------------------------
+Fri Oct 29 09:07:08 UTC 2021 - pgaj...@suse.com
+
+- security update
+- added patches
+  fix CVE-2021-21703 [bsc#1192050], Local privilege escalation via PHP-FPM
+  + php7-CVE-2021-21703.patch
+
+-------------------------------------------------------------------
+Mon Oct  4 10:59:24 UTC 2021 - pgaj...@suse.com
+
+- added patches [bsc#1175508]
+  fix https://github.com/php/php-src/pull/7428
+  + php7-bsc1175508.patch
+
+-------------------------------------------------------------------
+Mon Aug  2 13:01:48 UTC 2021 - pgaj...@suse.com
+
+- security update
+- added patches
+  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
+  + php7-CVE-2021-21704.patch
+
+-------------------------------------------------------------------
+Fri Jul  9 14:40:47 UTC 2021 - pgaj...@suse.com
+
+- security update
+- added patches
+  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
+  + php7-CVE-2021-21705.patch
+
+-------------------------------------------------------------------
+Thu Feb 11 10:52:26 UTC 2021 - pgaj...@suse.com
+
+- security update
+- added patches
+  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
+  + php7-CVE-2021-21702.patch
+
+-------------------------------------------------------------------
+Mon Jan 11 12:02:58 UTC 2021 - pgaj...@suse.com
+
+- security update
+- added patches
+  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with 
invalid userinfo
+  + php7-CVE-2020-7071.patch
+
+-------------------------------------------------------------------
+Fri Oct  9 11:07:42 UTC 2020 - pgaj...@suse.com
+
+- security update
+- added patches
+  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with 
openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is 
used
+  + php7-CVE-2020-7069.patch
+  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to 
overwrite existing prefixed cookie names
+  + php7-CVE-2020-7070.patch
+
+-------------------------------------------------------------------
+Thu Aug 13 14:01:39 UTC 2020 - pgaj...@suse.com
+
+- security update
+- added patches
+  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the 
phar_parse_zipfile function
+  + php7-CVE-2020-7068.patch
+
+-------------------------------------------------------------------
+Thu Jul  9 13:13:48 UTC 2020 - pgaj...@suse.com
+
+- Use /run/php-fpm instead of /run/php
+- modified sources
+  % php-fpm.tmpfiles.d
+
+-------------------------------------------------------------------
+Thu Jul  9 12:23:52 UTC 2020 - pgaj...@suse.com
+
+- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
+  test favour
+
+-------------------------------------------------------------------
+Mon Jul  6 21:21:45 UTC 2020 - Daniel Molkentin <daniel.molken...@suse.com>
+
+- added tmpfiles.d for php-fpm to provide a base base for a socket
+  (boo#1173786)
+
+-------------------------------------------------------------------
+Thu May 14 09:05:51 UTC 2020 - Arjen de Korte <suse+bu...@de-korte.org>
+
+- updated to 7.4.6: This is a security release which also contains
+  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6
+
+-------------------------------------------------------------------
+Wed May 13 11:42:01 UTC 2020 - pgaj...@suse.com
+
+- added patches
+  build fixes in SLE12
+  + php7-arm-build-fixes.patch
+
+-------------------------------------------------------------------
+Tue May 12 13:28:05 UTC 2020 - pgaj...@suse.com
+
+- added to SLE-12 [jsc#SLE-12474]
+
+-------------------------------------------------------------------
+Tue May 12 13:11:31 UTC 2020 - pgaj...@suse.com
+
+- spec file usable under SLE12 again and better prepared for
+  phpM -> phpMN transition
+
+-------------------------------------------------------------------
+Mon May 11 09:59:41 UTC 2020 - pgaj...@suse.com
+
+- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
+  CVE-2020-7063 [bsc#1165289]
+  CVE-2020-7062 [bsc#1165280]
+  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045
+
+-------------------------------------------------------------------
+Tue Apr 14 14:40:32 UTC 2020 - Arjen de Korte <suse+bu...@de-korte.org>
+
+- updated to 7.4.5: This is a security release which also contains
+  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5
+
+-------------------------------------------------------------------
+Thu Apr  2 11:14:13 UTC 2020 - pgaj...@suse.com
+
+- remove Berkeley DB Database support [jsc#SLE-12210]
+
+-------------------------------------------------------------------
+Fri Mar 20 07:39:34 UTC 2020 - pgaj...@suse.com
+
+- build firebird extension in any case
+
+-------------------------------------------------------------------
+Tue Mar 17 19:48:01 UTC 2020 - Arjen de Korte <suse+bu...@de-korte.org>
+
+- updated to 7.4.4: This is a security release which also contains
+  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4
+
+-------------------------------------------------------------------
+Thu Mar 12 08:47:27 UTC 2020 - Martin Li??ka <mli...@suse.cz>
+
+- Enable LTO as it works now (boo#1133275).
+
+-------------------------------------------------------------------
+Wed Feb 19 09:11:21 UTC 2020 - Arjen de Korte <suse+bu...@de-korte.org>
+
+- updated to 7.4.3: This is a security release which also contains
+  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3
+
+-------------------------------------------------------------------
+Mon Feb 10 16:25:11 UTC 2020 - pgaj...@suse.com
+
+- add %apache_rex_deps
+
+-------------------------------------------------------------------
+Thu Jan 23 11:08:54 UTC 2020 - Arjen de Korte <suse+bu...@de-korte.org>
+
+- updated to 7.4.2: This is a security release which also contains
+  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.2
+
+-------------------------------------------------------------------
+Wed Dec 18 13:35:41 UTC 2019 - Arjen de Korte <suse+bu...@de-korte.org>
+
+- updated to 7.4.1: This is a security release which also contains
+  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.1
+- deleted patches
+  - php-fix-mysqlnd-compression-library.patch
+  - php-fpm-service-fails-to-start.patch
+
+-------------------------------------------------------------------
+Tue Dec 10 13:24:53 UTC 2019 - pgaj...@suse.com
+
+- php7-devel requires glibc-devel, libxml2-devel, pcre2-devel
+  again
+
+-------------------------------------------------------------------
+Thu Dec  5 09:27:35 UTC 2019 - Arjen de Korte <suse+bu...@de-korte.org>
+
+- relax systemd restrictions for FPM as they were too strict in
+  some applications
+- change leftover Requires php7-<extension> to php-<extension>
+- remove external libraries from -devel subpackage
+- added patches
+  + php-fpm-service-fails-to-start.patch
+
+-------------------------------------------------------------------
+Thu Nov 28 10:16:27 UTC 2019 - Arjen de Korte <suse+bu...@de-korte.org>
+
+- update to 7.4.0:
++++ 4465 more lines (skipped)
++++ between /dev/null
++++ and /work/SRC/openSUSE:Leap:15.2:Update/.php7.17250.new.2520/php7.changes

New:
----
  README.macros
  _multibuild
  build-test.sh
  macros.php
  mod_php7.conf
  php-7.4.6.tar.xz
  php-7.4.6.tar.xz.asc
  php-crypt-tests.patch
  php-date-regenerate-lexers.patch
  php-embed.patch
  php-fix_net-snmp_disable_MD5.patch
  php-fpm.tmpfiles.d
  php-ini.patch
  php-no-build-date.patch
  php-odbc-cmp-int-cast.patch
  php-openssl.patch
  php-php-config.patch
  php-phpize.patch
  php-pts.patch
  php-systemd-unit.patch
  php-systzdata-v19.patch
  php7-CVE-2020-7068.patch
  php7-CVE-2020-7069.patch
  php7-CVE-2020-7070.patch
  php7-CVE-2020-7071.patch
  php7-CVE-2021-21702.patch
  php7-CVE-2021-21703.patch
  php7-CVE-2021-21704.patch
  php7-CVE-2021-21705.patch
  php7-CVE-2021-21707.patch
  php7-arm-build-fixes.patch
  php7-bsc1175508.patch
  php7.changes
  php7.keyring
  php7.rpmlintrc
  php7.spec

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ php7.spec ++++++
++++ 1650 lines (skipped)

++++++ README.macros ++++++
README for php-macros

Author: Christian Wittmer <ch...@computersalat.de>
Author: Johannes Weberhofer <jweberho...@weberhofer.at>


%php_pear_gen_filelist generates an rpmlint happy filelist of your installed 
files

In most cases you only need to check the %doc part
sometimes there is a "Changes" or "ChangeLog",....

Requirements for %php_pear_gen_filelist
You have to define following parts inside your spec file

Example:

#
# spec file for package php7-pear-Auth_SASL
#
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via http://bugs.opensuse.org/
#


%define php_name php7
%define pear_name  Auth_SASL
Name:           php7-pear-Auth_SASL
Version:        1.1.0
Release:        0
Summary:        Abstraction of various SASL mechanism responses
License:        BSD-3-Clause
Group:          Productivity/Networking/Web/Servers
Url:            http://pear.php.net/package/%{pear_name}
Source:         http://pear.php.net/get/%{pear_name}-%{version}.tgz
BuildRequires:  %{php_name}-devel
BuildRequires:  %{php_name}-pear >= 1.10.1
Requires:       %{php_name}-pear >= 1.10.1
Provides:       php-pear-%{pear_name} = %{version}
Provides:       php-pear(%{pear_name}) = %{version}
Obsoletes:      php5-pear-Auth_SASL
BuildArch:      noarch
%if 0%{?suse_version} < 1330
BuildRequires:  %{php_name}-macros
BuildRequires:  %{php_name}-pear-Archive_Tar
Requires:       %{php_name}-pear-Archive_Tar
%endif

%description
Provides code to generate responses to common SASL mechanisms, including:
  - Digest-MD5
  - CramMD5
  - Plain
  - Anonymous
  - Login (Pseudo mechanism)

%prep
%setup -q %setup -q -n %{pear_name}-%{version}
mv ../package.xml .

%build

%install
%{__pear} install --nodeps --offline --packagingroot %{buildroot} package.xml
install -D -m 0644 package.xml %{buildroot}%{pear_xmldir}/%{pear_name}.xml

rm -rf %{buildroot}/{doc,tmp}
rm -rf 
%{buildroot}/%{php_peardir}/.{filemap,lock,registry,channels,depdb,depdblock}

%php_pear_gen_filelist

%post
if [ "$1" = "1" ]; then
  # on "rpm -ivh"
  %{__pear} install --nodeps --soft --force --register-only 
%{pear_xmldir}/%{pear_name}.xml
fi
if [ "$1" = "2" ]; then
  # on "rpm -Uvh"
  %{__pear} upgrade --offline --register-only %{pear_xmldir}/%{pear_name}.xml
fi

%postun
if [ "$1" = "0" ]; then
  # on "rpm -e"
  %{__pear} uninstall --nodeps --ignore-errors --register-only 
pear.php.net/%{pear_name}
fi

%files -f %{name}.files

%changelog

#############################################################################

And here an Example of the generated filelist (does not match above package):

/usr/share/php5/PEAR/Date.php
%dir /usr/share/php5/PEAR/Date
/usr/share/php5/PEAR/Date/Calc.php
/usr/share/php5/PEAR/Date/Human.php
/usr/share/php5/PEAR/Date/Span.php
/usr/share/php5/PEAR/Date/TimeZone.php
%dir /usr/share/php5/PEAR/test
%dir /usr/share/php5/PEAR/test/Date
%dir /usr/share/php5/PEAR/test/Date/tests
/usr/share/php5/PEAR/test/Date/tests/test_date_methods_span.php
/usr/share/php5/PEAR/test/Date/tests/testunit_date_span.php
/usr/share/php5/PEAR/test/Date/tests/test_calc.php
/usr/share/php5/PEAR/test/Date/tests/calc.php
/usr/share/php5/PEAR/test/Date/tests/testunit_date.php
/usr/share/php5/PEAR/test/Date/tests/testunit.php
%dir /usr/share/php5/PEAR/test/Date/tests/bugs
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-727-1.phpt
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-727-2.phpt
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-727-3.phpt
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-727-4.phpt
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-674.phpt
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-9213.phpt
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-9414.phpt
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-8912.phpt
/usr/share/php5/PEAR/test/Date/tests/bugs/bug-967.phpt
/var/lib/pear/Date.xml

++++++ _multibuild ++++++
<multibuild>
  <package>test</package>
</multibuild>
++++++ build-test.sh ++++++
#!/bin/bash
TEST_RESULT_FILE_BEFORE='test_results.before'
TEST_RESULT_FILE_AFTER='test_results.after'

function usage
{
  echo "usage: $0 buildroot [osc ARGUMENTS]"
  echo "       1. Run first time to create ${TEST_RESULT_FILE_BEFORE}."
  echo "       2. Make source changes."
  echo "       3. Run second time to create ${TEST_RESULT_FILE_AFTER}"
  echo "          and see changes in test results."
}

if [ -z $1 ]; then
  echo 'ERROR: missing a parameter: buildroot'
  usage
  exit 1
fi

if [ "$1" == "-h" ]; then
  usage
  exit 0
fi

export OSC_BUILD_ROOT=$1
shift
apiurl=`cat .osc/_apiurl 2>/dev/null`
if [ ! -z "$apiurl" ]; then
  apiurl="-A $apiurl"
fi
osc $apiurl build $@ --no-verify --with make_test -x valgrind *.spec 
if [ $? -ne 0 ]; then 
  echo "ERROR: build failed. See $OSC_BUILD_ROOT/.build.log for details."
  exit 1
fi
cat $OSC_BUILD_ROOT/.build.log \
      | sed 's:^\[[ 0-9]\+s\] ::' \
      | egrep 'TEST [0-9]+\/[0-9]+|SKIP.*reason' \
      | sed 's:.*\r::' \
      | sort \
    > ${TEST_RESULT_FILE_AFTER}
if [ ! -e ${TEST_RESULT_FILE_BEFORE} ]; then
  echo "Creating ${TEST_RESULT_FILE_BEFORE}"
  echo "Run $0 again AFTER source changes, to create ${TEST_RESULT_FILE_AFTER}."
  echo "Differences will be checked then."
  mv ${TEST_RESULT_FILE_AFTER} ${TEST_RESULT_FILE_BEFORE}
else
  echo --- DIFFERENCES -------------------------------------------
  diff -up $TEST_RESULT_FILE_BEFORE ${TEST_RESULT_FILE_AFTER}
  echo -----------------------------------------------------------
  echo "Do not forgot to "
  echo "rm ${TEST_RESULT_FILE_BEFORE} ${TEST_RESULT_FILE_AFTER}"
  echo
fi

++++++ macros.php ++++++
# macros.php file
# macros for module building. handle with care.

#
# Interface versions exposed by PHP:
#
%php_core_api @PHP_APIVER@
%php_zend_api @PHP_ZENDVER@

# Useful php macros (from Christian Wittmer <ch...@computersalat.de>)
#
%__php          /usr/bin/php
%__phpize       /usr/bin/phpize
%__php_config   /usr/bin/php-config
%php_version    %(%{__php_config} --version)

# pear related macros
%__pear         /usr/bin/pear
%php_peardir    %(%{__pear} config-get php_dir)

# %pear_xmldir should be replaced by %php_pearxmldir
%pear_xmldir /var/lib/pear

%php_pearxmldir /var/lib/pear
%pear_phpdir  %(%{__pear} config-get php_dir  2> /dev/null || echo undefined)
%pear_docdir  %(%{__pear} config-get doc_dir  2> /dev/null || echo undefined)
%pear_testdir %(%{__pear} config-get test_dir 2> /dev/null || echo undefined)
%pear_datadir %(%{__pear} config-get data_dir 2> /dev/null || echo undefined)
%pear_cfgdir  %(%{__pear} config-get cfg_dir  2> /dev/null || echo undefined)
%pear_wwwdir  %(%{__pear} config-get www_dir  2> /dev/null || echo undefined)
%pear_metadir %(%{__pear} config-get metadata_dir 2> /dev/null || echo 
undefined)

# pecl related macros
%__pecl       /usr/bin/pecl
%pecl_phpdir  %(%{__pecl} config-get php_dir  2> /dev/null || echo undefined)
%pecl_docdir  %(%{__pecl} config-get doc_dir  2> /dev/null || echo undefined)
%pecl_testdir %(%{__pecl} config-get test_dir 2> /dev/null || echo undefined)
%pecl_datadir %(%{__pecl} config-get data_dir 2> /dev/null || echo undefined)

# macro: php_pear_gen_filelist
# do the rpmlint happy filelist generation
# with %dir in front of directories
%php_pear_gen_filelist(n)\
FILES=%{name}.files\
# fgen_dir func\
# IN: dir\
fgen_dir(){\
%{__cat} >> $FILES << EOF\
%dir ${1}\
EOF\
}\
# fgen_file func\
# IN: file\
fgen_file(){\
%{__cat} >> $FILES << EOF\
${1}\
EOF\
}\
# check for files in %{php_peardir}\
RES=`find ${RPM_BUILD_ROOT}%{php_peardir} -maxdepth 1 -type f`\
if [ -n "$RES" ]; then\
  for file in $RES; do\
    fgen_file "%{php_peardir}/$(basename ${file})"\
  done\
fi\
\
# get all dirs into array\
base_dir="${RPM_BUILD_ROOT}%{php_peardir}/"\
for dir in `find ${base_dir} -type d | sort`; do\
  if [ "$dir" = "${base_dir}" ]; then\
    continue\
  else\
    el=`echo $dir | %{__awk} -F"${base_dir}" '{print $2}'`\
    all_dir=(${all_dir[@]} $el)\
  fi\
done\
\
# build filelist\
for i in ${all_dir[@]}; do\
  if [ -d ${base_dir}/${i} ]; then\
    RES=`find "${base_dir}/${i}" -maxdepth 1 -type f`\
    if [ -n "$RES" ]; then\
      fgen_dir "%{php_peardir}/${i}"\
      for file in $RES; do\
        fgen_file "%{php_peardir}/${i}/$(basename ${file})"\
      done\
    else\
      fgen_dir "%{php_peardir}/${i}"\
    fi\
  fi\
done\
# add xml file\
fgen_file "%php_pearxmldir/%{pear_name}.xml"\
#
++++++ mod_php7.conf ++++++
<IfModule mod_php7.c>
       <FilesMatch "\.ph(p[3457]?|tml)$">
           SetHandler application/x-httpd-php
       </FilesMatch>
       <FilesMatch "\.php[3457]?s$">
           SetHandler application/x-httpd-php-source
       </FilesMatch>
        DirectoryIndex index.php4
        DirectoryIndex index.php5
        DirectoryIndex index.php7
        DirectoryIndex index.php
</IfModule>

++++++ php-crypt-tests.patch ++++++
Index: php-7.2.12/ext/standard/config.m4
===================================================================
--- php-7.2.12.orig/ext/standard/config.m4      2018-11-06 11:48:33.000000000 
+0100
+++ php-7.2.12/ext/standard/config.m4   2018-11-09 16:35:10.505160977 +0100
@@ -242,7 +242,7 @@ int main() {
 dnl
 dnl If one of them is missing, use our own implementation, portable code is 
then possible
 dnl
-if test "$ac_cv_crypt_blowfish" = "no" || test "$ac_cv_crypt_des" = "no" || 
test "$ac_cv_crypt_ext_des" = "no" || test "$ac_cv_crypt_md5" = "no" || test 
"$ac_cv_crypt_sha512" = "no" || test "$ac_cv_crypt_sha256" = "no" || test 
"x$php_crypt_r" = "x0"; then
+if test "$ac_cv_crypt_blowfish" = "no" || test "$ac_cv_crypt_des" = "no" || 
test "$ac_cv_crypt_md5" = "no" || test "$ac_cv_crypt_sha512" = "no" || test 
"$ac_cv_crypt_sha256" = "no" || test "x$ac_cv_lib_crypt_crypt_r" = "x0"; then
 
   dnl
   dnl Check for __alignof__ support in the compiler
++++++ php-date-regenerate-lexers.patch ++++++
Index: php-7.1.7/ext/date/config0.m4
===================================================================
--- php-7.1.7.orig/ext/date/config0.m4  2017-07-06 11:30:06.000000000 +0200
+++ php-7.1.7/ext/date/config0.m4       2017-07-21 13:56:15.183675982 +0200
@@ -10,6 +10,8 @@ timelib_sources="lib/astro.c lib/dow.c l
 
 PHP_NEW_EXTENSION(date, php_date.c $timelib_sources, no,, $PHP_DATE_CFLAGS)
 
+PHP_ADD_MAKEFILE_FRAGMENT()
+
 PHP_ADD_BUILD_DIR([$ext_builddir/lib], 1)
 PHP_ADD_INCLUDE([$ext_builddir/lib])
 PHP_ADD_INCLUDE([$ext_srcdir/lib])
Index: php-7.1.7/ext/date/Makefile.frag
===================================================================
--- /dev/null   1970-01-01 00:00:00.000000000 +0000
+++ php-7.1.7/ext/date/Makefile.frag    2017-07-21 13:58:51.986357906 +0200
@@ -0,0 +1,6 @@
+$(srcdir)/lib/parse_date.c: $(srcdir)/lib/parse_date.re
+       @(cd $(top_srcdir); $(RE2C) $(RE2C_FLAGS) -b --no-generation-date -o 
ext/date/lib/parse_date.c ext/date/lib/parse_date.re)
+
+$(srcdir)/lib/parse_iso_intervals.c: $(srcdir)/lib/parse_iso_intervals.re
+       @(cd $(top_srcdir); $(RE2C) $(RE2C_FLAGS) -b --no-generation-date -o 
ext/date/lib/parse_iso_intervals.c    ext/date/lib/parse_iso_intervals.re)
+
++++++ php-embed.patch ++++++
--- php-7.1.10/sapi/embed/config.m4.embed
+++ php-7.1.10/sapi/embed/config.m4
@@ -12,7 +12,7 @@ if test "$PHP_EMBED" != "no"; then
   case "$PHP_EMBED" in
     yes|shared)
       PHP_EMBED_TYPE=shared
-      INSTALL_IT="\$(mkinstalldirs) \$(INSTALL_ROOT)\$(prefix)/lib; 
\$(INSTALL) -m 0755 $SAPI_SHARED \$(INSTALL_ROOT)\$(prefix)/lib"
+      INSTALL_IT="\$(mkinstalldirs) \$(INSTALL_ROOT)\$(libdir); \$(LIBTOOL) 
--mode=install \$(INSTALL) -m 0755 \$(OVERALL_TARGET) 
\$(INSTALL_ROOT)\$(libdir)"
       ;;
     static)
       PHP_EMBED_TYPE=static
++++++ php-fix_net-snmp_disable_MD5.patch ++++++
Index: ext/snmp/snmp.c
===================================================================
--- ext/snmp/snmp.c.orig        2015-09-08 12:33:18.057282498 +0200
+++ ext/snmp/snmp.c     2015-09-08 12:35:01.717693824 +0200
@@ -1256,14 +1256,17 @@
    Set the authentication protocol in the snmpv3 session */
 static int netsnmp_session_set_auth_protocol(struct snmp_session *s, char 
*prot)
 {
+#ifndef DISABLE_MD5
        if (!strcasecmp(prot, "MD5")) {
                s->securityAuthProto = usmHMACMD5AuthProtocol;
                s->securityAuthProtoLen = USM_AUTH_PROTO_MD5_LEN;
-       } else if (!strcasecmp(prot, "SHA")) {
+       } else
+#endif
+       if (!strcasecmp(prot, "SHA")) {
                s->securityAuthProto = usmHMACSHA1AuthProtocol;
                s->securityAuthProtoLen = USM_AUTH_PROTO_SHA_LEN;
        } else {
-               php_error_docref(NULL, E_WARNING, "Unknown authentication 
protocol '%s'", prot);
+               php_error_docref(NULL, E_WARNING, "Unknown or unsupported 
authentication protocol '%s'", prot);
                return (-1);
        }
        return (0);
++++++ php-fpm.tmpfiles.d ++++++
# Type Path                    Mode UID        GID     Age Argument
d      /run/php-fpm            0711 root       root    -   -
++++++ php-ini.patch ++++++
Index: php-7.3.1/php.ini-production
===================================================================
--- php-7.3.1.orig/php.ini-production   2019-01-08 14:55:52.000000000 +0100
+++ php-7.3.1/php.ini-production        2019-02-07 09:28:59.154542260 +0100
@@ -729,7 +729,7 @@ default_charset = "UTF-8"
 ;;;;;;;;;;;;;;;;;;;;;;;;;
 
 ; UNIX: "/path1:/path2"
-;include_path = ".:/php/includes"
+include_path = ".:/usr/share/php7:/usr/share/php7/PEAR"
 ;
 ; Windows: "\path1;\path2"
 ;include_path = ".;c:\php\includes"
@@ -954,7 +954,7 @@ cli_server.color = On
 [Date]
 ; Defines the default timezone used by the date functions
 ; http://php.net/date.timezone
-;date.timezone =
+date.timezone = 'UTC'
 
 ; http://php.net/date.default-latitude
 ;date.default_latitude = 31.7667
@@ -1161,7 +1162,7 @@ mysqli.max_persistent = -1
 
 ; Allow or prevent persistent links.
 ; http://php.net/mysqli.allow-persistent
-mysqli.allow_persistent = On
+mysqli.allow_persistent = Off
 
 ; Maximum number of links.  -1 means no limit.
 ; http://php.net/mysqli.max-links
@@ -1354,7 +1355,7 @@ session.save_handler = files
 ; where MODE is the octal representation of the mode. Note that this
 ; does not overwrite the process's umask.
 ; http://php.net/session.save-path
-;session.save_path = "/tmp"
+session.save_path = "/var/lib/php7"
 
 ; Whether to use strict session mode.
 ; Strict session mode does not accept an uninitialized session ID, and
++++++ php-no-build-date.patch ++++++
Index: php-7.4.0RC6/ext/standard/info.c
===================================================================
--- php-7.4.0RC6.orig/ext/standard/info.c       2019-11-11 00:33:36.000000000 
+0100
+++ php-7.4.0RC6/ext/standard/info.c    2019-11-19 11:29:46.254681309 +0100
@@ -802,7 +802,7 @@ PHPAPI ZEND_COLD void php_print_info(int
                php_info_print_box_end();
                php_info_print_table_start();
                php_info_print_table_row(2, "System", ZSTR_VAL(php_uname));
-               php_info_print_table_row(2, "Build Date", __DATE__ " " 
__TIME__);
+               /*php_info_print_table_row(2, "Build Date", __DATE__ " " 
__TIME__);*/
 #ifdef COMPILER
                php_info_print_table_row(2, "Compiler", COMPILER);
 #endif
@@ -810,7 +810,7 @@ PHPAPI ZEND_COLD void php_print_info(int
                php_info_print_table_row(2, "Architecture", ARCHITECTURE);
 #endif
 #ifdef CONFIGURE_COMMAND
-               php_info_print_table_row(2, "Configure Command", 
CONFIGURE_COMMAND );
+               /* php_info_print_table_row(2, "Configure Command", 
CONFIGURE_COMMAND ); */
 #endif
 
                if (sapi_module.pretty_name) {
Index: php-7.4.0RC6/sapi/cli/php_cli.c
===================================================================
--- php-7.4.0RC6.orig/sapi/cli/php_cli.c        2019-11-19 11:29:46.254681309 
+0100
+++ php-7.4.0RC6/sapi/cli/php_cli.c     2019-11-19 11:30:06.350793571 +0100
@@ -645,8 +645,8 @@ static int do_cli(int argc, char **argv)
                                goto out;
 
                        case 'v': /* show php version & quit */
-                               php_printf("PHP %s (%s) (built: %s %s) ( 
%s)\nCopyright (c) The PHP Group\n%s",
-                                       PHP_VERSION, cli_sapi_module.name, 
__DATE__, __TIME__,
+                               php_printf("PHP %s (%s) ( %s)\nCopyright (c) 
The PHP Group\n%s",
+                                       PHP_VERSION, cli_sapi_module.name,
 #if ZTS
                                        "ZTS "
 #else
Index: php-7.4.0RC6/sapi/cgi/cgi_main.c
===================================================================
--- php-7.4.0RC6.orig/sapi/cgi/cgi_main.c       2019-11-19 11:29:46.254681309 
+0100
+++ php-7.4.0RC6/sapi/cgi/cgi_main.c    2019-11-19 11:30:26.346905278 +0100
@@ -2392,9 +2392,9 @@ parent_loop_end:
                                                        SG(headers_sent) = 1;
                                                        
SG(request_info).no_headers = 1;
 #if ZEND_DEBUG
-                                                       php_printf("PHP %s (%s) 
(built: %s %s) (DEBUG)\nCopyright (c) The PHP Group\n%s", PHP_VERSION, 
sapi_module.name, __DATE__, __TIME__, get_zend_version());
+                                                       php_printf("PHP %s (%s) 
(DEBUG)\nCopyright (c) The PHP Group\n%s", PHP_VERSION, sapi_module.name, 
get_zend_version());
 #else
-                                                       php_printf("PHP %s (%s) 
(built: %s %s)\nCopyright (c) The PHP Group\n%s", PHP_VERSION, 
sapi_module.name, __DATE__, __TIME__, get_zend_version());
+                                                       php_printf("PHP %s (%s) 
\nCopyright (c) The PHP Group\n%s", PHP_VERSION, sapi_module.name, 
get_zend_version());
 #endif
                                                        
php_request_shutdown((void *) 0);
                                                        fcgi_shutdown();
Index: php-7.4.0RC6/configure.ac
===================================================================
--- php-7.4.0RC6.orig/configure.ac      2019-11-19 11:29:46.258681331 +0100
+++ php-7.4.0RC6/configure.ac   2019-11-19 11:31:37.507302813 +0100
@@ -1295,13 +1295,12 @@ EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PR
 
 dnl SOURCE_DATE_EPOCH for reproducible builds
 dnl https://reproducible-builds.org/specs/source-date-epoch/
-PHP_BUILD_DATE=`date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" 
+%Y-%m-%d 2>/dev/null`
-if test $? -ne 0 ; then
-PHP_BUILD_DATE=`date -u +%Y-%m-%d`
-fi
+#totally fake, not used anywhere in userspace
+PHP_BUILD_DATE="1970-01-01"
 AC_DEFINE_UNQUOTED(PHP_BUILD_DATE,"$PHP_BUILD_DATE",[PHP build date])
 
-PHP_UNAME=`uname -a | xargs`
+dnl Totally fake, it wasnt and will never be reliable anyway.
+PHP_UNAME="Linux suse 2.6.36 #1 SMP 2011-02-21 10:34:10 +0100 x86_64 x86_64 
x86_64 GNU/Linux"
 AC_DEFINE_UNQUOTED(PHP_UNAME,"$PHP_UNAME",[uname -a output])
 PHP_OS=`uname | xargs`
 AC_DEFINE_UNQUOTED(PHP_OS,"$PHP_OS",[uname output])
Index: php-7.4.0RC6/sapi/fpm/fpm/fpm_main.c
===================================================================
--- php-7.4.0RC6.orig/sapi/fpm/fpm/fpm_main.c   2019-11-19 11:29:46.258681331 
+0100
+++ php-7.4.0RC6/sapi/fpm/fpm/fpm_main.c        2019-11-19 11:32:27.627582756 
+0100
@@ -1722,9 +1722,9 @@ int main(int argc, char *argv[])
                                SG(request_info).no_headers = 1;
 
 #if ZEND_DEBUG
-                               php_printf("PHP %s (%s) (built: %s %s) 
(DEBUG)\nCopyright (c) The PHP Group\n%s", PHP_VERSION, sapi_module.name, 
__DATE__,        __TIME__, get_zend_version());
+                               php_printf("PHP %s (%s) (DEBUG)\nCopyright (c) 
The PHP Group\n%s", PHP_VERSION, sapi_module.name, get_zend_version());
 #else
-                               php_printf("PHP %s (%s) (built: %s 
%s)\nCopyright (c) The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, 
__TIME__,      get_zend_version());
+                               php_printf("PHP %s (%s) \nCopyright (c) The PHP 
Group\n%s", PHP_VERSION, sapi_module.name, get_zend_version());
 #endif
                                php_request_shutdown((void *) 0);
                                fcgi_shutdown();
++++++ php-odbc-cmp-int-cast.patch ++++++
https://bugs.php.net/bug.php?id=53007
Index: php-7.3.0/ext/odbc/php_odbc.c
===================================================================
--- php-7.3.0.orig/ext/odbc/php_odbc.c  2018-12-04 17:12:22.000000000 +0100
+++ php-7.3.0/ext/odbc/php_odbc.c       2018-12-10 10:19:02.668378553 +0100
@@ -1804,7 +1804,7 @@ static void php_odbc_fetch_hash(INTERNAL
 
                                if (rc == SQL_SUCCESS_WITH_INFO) {
                                        ZVAL_STRINGL(&tmp, buf, 
result->longreadlen);
-                               } else if (result->values[i].vallen == 
SQL_NULL_DATA) {
+                               } else if ((int)result->values[i].vallen == 
(int)SQL_NULL_DATA) {
                                        ZVAL_NULL(&tmp);
                                        break;
                                } else {
@@ -1813,7 +1813,7 @@ static void php_odbc_fetch_hash(INTERNAL
                                break;
 
                        default:
-                               if (result->values[i].vallen == SQL_NULL_DATA) {
+                               if ((int)result->values[i].vallen == 
(int)SQL_NULL_DATA) {
                                        ZVAL_NULL(&tmp);
                                        break;
                                }
@@ -1956,7 +1956,7 @@ PHP_FUNCTION(odbc_fetch_into)
                                }
                                if (rc == SQL_SUCCESS_WITH_INFO) {
                                        ZVAL_STRINGL(&tmp, buf, 
result->longreadlen);
-                               } else if (result->values[i].vallen == 
SQL_NULL_DATA) {
+                               } else if ((int)result->values[i].vallen == 
(int)SQL_NULL_DATA) {
                                        ZVAL_NULL(&tmp);
                                        break;
                                } else {
@@ -1965,7 +1965,7 @@ PHP_FUNCTION(odbc_fetch_into)
                                break;
 
                        default:
-                               if (result->values[i].vallen == SQL_NULL_DATA) {
+                               if ((int)result->values[i].vallen == 
(int)SQL_NULL_DATA) {
                                        ZVAL_NULL(&tmp);
                                        break;
                                }
@@ -2193,7 +2193,7 @@ PHP_FUNCTION(odbc_result)
                                RETURN_FALSE;
                        }
 
-                       if (result->values[field_ind].vallen == SQL_NULL_DATA) {
+                       if ((int)result->values[field_ind].vallen == 
(int)SQL_NULL_DATA) {
                                zend_string_efree(field_str);
                                RETURN_NULL();
                        } else if (rc == SQL_NO_DATA_FOUND) {
@@ -2202,7 +2202,7 @@ PHP_FUNCTION(odbc_result)
                        }
                        /* Reduce fieldlen by 1 if we have char data. One day 
we might
                           have binary strings... */
-                       if ((result->values[field_ind].coltype == 
SQL_LONGVARCHAR)
+                       if (((int)result->values[field_ind].coltype == 
(int)SQL_LONGVARCHAR)
 #if defined(ODBCVER) && (ODBCVER >= 0x0300)
                            || (result->values[field_ind].coltype == 
SQL_WLONGVARCHAR)
 #endif
@@ -2219,7 +2219,7 @@ PHP_FUNCTION(odbc_result)
                        break;
 
                default:
-                       if (result->values[field_ind].vallen == SQL_NULL_DATA) {
+                       if ((int)result->values[field_ind].vallen == 
(int)SQL_NULL_DATA) {
                                RETURN_NULL();
                        } else {
                                RETURN_STRINGL(result->values[field_ind].value, 
result->values[field_ind].vallen);
@@ -2352,7 +2352,7 @@ PHP_FUNCTION(odbc_result_all)
                                        }
                                        if (rc == SQL_SUCCESS_WITH_INFO) {
                                                PHPWRITE(buf, 
result->longreadlen);
-                                       } else if (result->values[i].vallen == 
SQL_NULL_DATA) {
+                                       } else if 
((int)result->values[i].vallen == (int)SQL_NULL_DATA) {
                                                php_printf("<td>NULL</td>");
                                                break;
                                        } else {
@@ -2361,7 +2361,7 @@ PHP_FUNCTION(odbc_result_all)
                                        php_printf("</td>");
                                        break;
                                default:
-                                       if (result->values[i].vallen == 
SQL_NULL_DATA) {
+                                       if ((int)result->values[i].vallen == 
(int)SQL_NULL_DATA) {
                                                php_printf("<td>NULL</td>");
                                        } else {
                                                php_printf("<td>%s</td>", 
result->values[i].value);
++++++ php-openssl.patch ++++++
Index: ext/openssl/openssl.c
===================================================================
--- ext/openssl/openssl.c       2017-01-17 21:44:41.000000000 +0100
+++ ext/openssl/openssl.c       2017-02-13 15:25:42.219789317 +0100
@@ -1388,6 +1388,7 @@ PHP_MINIT_FUNCTION(openssl)
        OpenSSL_add_all_ciphers();
        OpenSSL_add_all_digests();
        OpenSSL_add_all_algorithms();
+       OPENSSL_config(NULL);
 
 #if !defined(OPENSSL_NO_AES) && defined(EVP_CIPH_CCM_MODE) && 
OPENSSL_VERSION_NUMBER < 0x100020000
        EVP_add_cipher(EVP_aes_128_ccm());
Index: ext/openssl/xp_ssl.c
===================================================================
--- ext/openssl/xp_ssl.c        2017-02-13 15:25:42.219789317 +0100
+++ ext/openssl/xp_ssl.c        2017-02-13 15:33:47.520365579 +0100
@@ -1518,6 +1518,10 @@ int php_openssl_setup_crypto(php_stream
                return FAILURE;
        }
 
+#ifdef SSL_MODE_RELEASE_BUFFERS
+       SSL_CTX_set_mode(sslsock->ctx, SSL_MODE_RELEASE_BUFFERS);
+#endif
+
        if (GET_VER_OPT("no_ticket") && zend_is_true(val)) {
                ssl_ctx_options |= SSL_OP_NO_TICKET;
        }
++++++ php-php-config.patch ++++++
---
 scripts/php-config.in |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: scripts/php-config.in
===================================================================
--- scripts/php-config.in.orig
+++ scripts/php-config.in
@@ -6,7 +6,7 @@ datarootdir="@datarootdir@"
 exec_prefix="@exec_prefix@"
 version="@PHP_VERSION@"
 vernum="@PHP_VERSION_ID@"
-include_dir="@includedir@/php"
+include_dir="@includedir@/php7"
 includes="-I$include_dir -I$include_dir/main -I$include_dir/TSRM 
-I$include_dir/Zend -I$include_dir/ext -I$include_dir/ext/date/lib"
 ldflags="@PHP_LDFLAGS@"
 libs="@EXTRA_LIBS@"
++++++ php-phpize.patch ++++++
---
 scripts/Makefile.frag |    4 ++--
 scripts/phpize.in     |    4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

Index: scripts/Makefile.frag
===================================================================
--- scripts/Makefile.frag.orig
+++ scripts/Makefile.frag
@@ -3,8 +3,8 @@
 # Build environment install
 #
 
-phpincludedir = $(includedir)/php
-phpbuilddir = $(libdir)/build
+phpincludedir = $(includedir)/php7
+phpbuilddir = $(datadir)/build
 
 BUILD_FILES = \
        scripts/phpize.m4 \
Index: scripts/phpize.in
===================================================================
--- scripts/phpize.in.orig
+++ scripts/phpize.in
@@ -4,8 +4,8 @@
 prefix='@prefix@'
 datarootdir='@datarootdir@'
 exec_prefix="`eval echo @exec_prefix@`"
-phpdir="`eval echo @libdir@`/build"
-includedir="`eval echo @includedir@`/php"
+phpdir="`eval echo @datadir@`/build"
+includedir="`eval echo @includedir@`/php7"
 builddir="`pwd`"
 SED="@SED@"
 
++++++ php-pts.patch ++++++
Index: ext/standard/proc_open.c
===================================================================
--- ext/standard/proc_open.c.orig
+++ ext/standard/proc_open.c
@@ -56,7 +56,7 @@
  * */
 #ifdef PHP_CAN_SUPPORT_PROC_OPEN
 
-#if 0 && HAVE_PTSNAME && HAVE_GRANTPT && HAVE_UNLOCKPT && HAVE_SYS_IOCTL_H && 
HAVE_TERMIOS_H
+#if HAVE_PTSNAME && HAVE_GRANTPT && HAVE_UNLOCKPT && HAVE_SYS_IOCTL_H && 
HAVE_TERMIOS_H
 # include <sys/ioctl.h>
 # include <termios.h>
 # define PHP_CAN_DO_PTS        1
@@ -636,14 +636,18 @@ PHP_FUNCTION(proc_open)
 #if PHP_CAN_DO_PTS
                                if (dev_ptmx == -1) {
                                        /* open things up */
-                                       dev_ptmx = open("/dev/ptmx", O_RDWR);
+                                       dev_ptmx = open("/dev/ptmx", 
O_RDWR|O_NOCTTY);
                                        if (dev_ptmx == -1) {
                                                php_error_docref(NULL, 
E_WARNING, "failed to open /dev/ptmx, errno %d", errno);
                                                goto exit_fail;
                                        }
                                        grantpt(dev_ptmx);
                                        unlockpt(dev_ptmx);
+#ifdef TIOCGPTPEER
+                                       slave_pty = ioctl(dev_ptmx, 
TIOCGPTPEER, O_RDWR);
+#else
                                        slave_pty = open(ptsname(dev_ptmx), 
O_RDWR);
+#endif
 
                                        if (slave_pty == -1) {
                                                php_error_docref(NULL, 
E_WARNING, "failed to open slave pty, errno %d", errno);
++++++ php-systemd-unit.patch ++++++
Index: php-7.4.0RC6/sapi/fpm/php-fpm.service.in
===================================================================
--- php-7.4.0RC6.orig/sapi/fpm/php-fpm.service.in       2019-11-19 
11:33:35.195960137 +0100
+++ php-7.4.0RC6/sapi/fpm/php-fpm.service.in    2019-11-19 11:35:45.588688471 
+0100
@@ -5,10 +5,10 @@
 [Unit]
 Description=The PHP FastCGI Process Manager
 After=network.target
+Before=apache2.service nginx.service lighttpd.service
 
 [Service]
 Type=@php_fpm_systemd@
-PIDFile=@EXPANDED_LOCALSTATEDIR@/run/php-fpm.pid
 ExecStart=@EXPANDED_SBINDIR@/php-fpm --nodaemonize --fpm-config 
@EXPANDED_SYSCONFDIR@/php-fpm.conf
 ExecReload=/bin/kill -USR2 $MAINPID
 
++++++ php-systzdata-v19.patch ++++++
++++ 657 lines (skipped)

++++++ php7-CVE-2020-7068.patch ++++++
X-Git-Url: 
http://208.43.231.11:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fphar%2Fzip.c;h=50c5d69e9bebb6ab9397b4a924181f9e31a6f665;hp=d615e8addaf8cf8415a994e32e8ca3007cc0fc2a;hb=7355ab81763a3d6a04ac11660e6a16d58838d187;hpb=c68d48de9e1b6b6657d11da308f8b4059ad486dd

diff --git a/ext/phar/zip.c b/ext/phar/zip.c
index d615e8addaf..50c5d69e9be 100644
--- a/ext/phar/zip.c
+++ b/ext/phar/zip.c
@@ -703,7 +703,7 @@ foundit:
                        efree(actual_alias);
                }
 
-               zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), actual_alias, 
mydata->alias_len, mydata);
+               zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), mydata->alias, 
mydata->alias_len, mydata);
        } else {
                phar_archive_data *fd_ptr;
 

++++++ php7-CVE-2020-7069.patch ++++++
Index: php-7.4.6/ext/openssl/openssl.c
===================================================================
--- php-7.4.6.orig/ext/openssl/openssl.c        2020-10-09 11:20:13.026340926 
+0200
+++ php-7.4.6/ext/openssl/openssl.c     2020-10-09 11:21:59.122963252 +0200
@@ -6522,11 +6522,6 @@ static int php_openssl_validate_iv(char
 {
        char *iv_new;
 
-       /* Best case scenario, user behaved */
-       if (*piv_len == iv_required_len) {
-               return SUCCESS;
-       }
-
        if (mode->is_aead) {
                if (EVP_CIPHER_CTX_ctrl(cipher_ctx, mode->aead_ivlen_flag, 
*piv_len, NULL) != 1) {
                        php_error_docref(NULL, E_WARNING, "Setting of IV length 
for AEAD mode failed");
@@ -6535,6 +6530,11 @@ static int php_openssl_validate_iv(char
                return SUCCESS;
        }
 
+       /* Best case scenario, user behaved */
+       if (*piv_len == iv_required_len) {
+               return SUCCESS;
+       }
+
        iv_new = ecalloc(1, iv_required_len + 1);
 
        if (*piv_len == 0) {
++++++ php7-CVE-2020-7070.patch ++++++
Index: php-7.4.6/main/php_variables.c
===================================================================
--- php-7.4.6.orig/main/php_variables.c 2020-10-09 10:18:38.836809981 +0200
+++ php-7.4.6/main/php_variables.c      2020-10-09 10:19:30.105107183 +0200
@@ -514,7 +514,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_defaul
                }
 
                val = estrndup(val, val_len);
-               php_url_decode(var, strlen(var));
+               if (arg != PARSE_COOKIE) {
+                       php_url_decode(var, strlen(var));
+               }
                if (sapi_module.input_filter(arg, var, &val, val_len, 
&new_val_len)) {
                        php_register_variable_safe(var, val, new_val_len, 
&array);
                }
++++++ php7-CVE-2020-7071.patch ++++++
X-Git-Url: 
http://208.43.231.11:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fstandard%2Furl.c;h=113e0100243a4391a15e8fe1727867239201af7a;hp=a33091a86b75191c469a0c1dd076f0bf911af376;hb=b7f837381ef642d7fb369bfd0069e7525d4c22ea;hpb=b4b4a75afccde07724c39f8e8eb6217bab1db8bd

Index: php-7.4.6/ext/standard/url.c
===================================================================
--- php-7.4.6.orig/ext/standard/url.c   2020-05-12 10:09:27.000000000 +0200
+++ php-7.4.6/ext/standard/url.c        2021-01-11 12:10:00.876716443 +0100
@@ -87,6 +87,22 @@ PHPAPI php_url *php_url_parse(char const
        return php_url_parse_ex(str, strlen(str));
 }
 
+static int is_userinfo_valid(const char *str, size_t len)
+{
+       const char *valid = "-._~!$&'()*+,;=:";
+       const char *p = str;
+       while (p - str < len) {
+               if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
+                       p++;
+               } else if (*p == '%' && p - str <= len - 3 && isdigit(*(p+1)) 
&& isxdigit(*(p+2))) {
+                       p += 3;
+               } else {
+                       return 0;
+               }
+       }
+       return 1;
+}
+
 /* {{{ php_url_parse
  */
 PHPAPI php_url *php_url_parse_ex(char const *str, size_t length)
@@ -228,13 +244,17 @@ PHPAPI php_url *php_url_parse_ex(char co
                        ret->pass = zend_string_init(pp, (p-pp), 0);
                        php_replace_controlchars_ex(ZSTR_VAL(ret->pass), 
ZSTR_LEN(ret->pass));
                } else {
-                       ret->user = zend_string_init(s, (p-s), 0);
-                       php_replace_controlchars_ex(ZSTR_VAL(ret->user), 
ZSTR_LEN(ret->user));
+                       if (!is_userinfo_valid(s, p-s)) {
+                               goto check_port;
+                       }
+            ret->user = zend_string_init(s, (p-s), 0);
+            php_replace_controlchars_ex(ZSTR_VAL(ret->user), 
ZSTR_LEN(ret->user));
                }
 
                s = p + 1;
        }
 
+check_port:
        /* check for port */
        if (s < ue && *s == '[' && *(e-1) == ']') {
                /* Short circuit portscan,
++++++ php7-CVE-2021-21702.patch ++++++
Index: php-7.4.6/ext/soap/php_sdl.c
===================================================================
--- php-7.4.6.orig/ext/soap/php_sdl.c   2020-05-12 10:09:18.000000000 +0200
+++ php-7.4.6/ext/soap/php_sdl.c        2021-02-11 10:54:25.238409016 +0100
@@ -315,6 +315,8 @@ void sdl_restore_uri_credentials(sdlCtx
        ctx->context = NULL;
 }
 
+#define SAFE_STR(a) ((a)?a:"")
+
 static void load_wsdl_ex(zval *this_ptr, char *struri, sdlCtx *ctx, int 
include)
 {
        sdlPtr tmpsdl = ctx->sdl;
@@ -376,7 +378,7 @@ static void load_wsdl_ex(zval *this_ptr,
                                if (node_is_equal_ex(trav2, "schema", 
XSD_NAMESPACE)) {
                                        load_schema(ctx, trav2);
                                } else if (is_wsdl_element(trav2) && 
!node_is_equal(trav2,"documentation")) {
-                                       soap_error1(E_ERROR, "Parsing WSDL: 
Unexpected WSDL element <%s>", trav2->name);
+                                       soap_error1(E_ERROR, "Parsing WSDL: 
Unexpected WSDL element <%s>", SAFE_STR(trav2->name));
                                }
                                trav2 = trav2->next;
                        }
@@ -437,7 +439,7 @@ static void load_wsdl_ex(zval *this_ptr,
                                soap_error0(E_ERROR, "Parsing WSDL: <service> 
has no name attribute");
                        }
                } else if (!node_is_equal(trav,"documentation")) {
-                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL 
element <%s>", trav->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL 
element <%s>",  SAFE_STR(trav->name));
                }
                trav = trav->next;
        }
@@ -547,7 +549,7 @@ static sdlSoapBindingFunctionHeaderPtr w
                                }
                                smart_str_free(&key);
                        } else if (is_wsdl_element(trav) && 
!node_is_equal(trav,"documentation")) {
-                               soap_error1(E_ERROR, "Parsing WSDL: Unexpected 
WSDL element <%s>", trav->name);
+                               soap_error1(E_ERROR, "Parsing WSDL: Unexpected 
WSDL element <%s>",  SAFE_STR(trav->name));
                        }
                        trav = trav->next;
                }
@@ -649,7 +651,7 @@ static void wsdl_soap_binding_body(sdlCt
                        }
                        smart_str_free(&key);
                } else if (is_wsdl_element(trav) && 
!node_is_equal(trav,"documentation")) {
-                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL 
element <%s>", trav->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL 
element <%s>",  SAFE_STR(trav->name));
                }
                trav = trav->next;
        }
@@ -681,14 +683,14 @@ static HashTable* wsdl_message(sdlCtx *c
                sdlParamPtr param;
 
                if (trav->ns != NULL && strcmp((char*)trav->ns->href, 
WSDL_NAMESPACE) != 0) {
-                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected 
extensibility element <%s>", trav->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected 
extensibility element <%s>",  SAFE_STR(trav->name));
                }
                if (node_is_equal(trav,"documentation")) {
                        trav = trav->next;
                        continue;
                }
                if (!node_is_equal(trav,"part")) {
-                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL 
element <%s>", trav->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL 
element <%s>",  SAFE_STR(trav->name));
                }
                part = trav;
                param = emalloc(sizeof(sdlParam));
@@ -697,7 +699,7 @@ static HashTable* wsdl_message(sdlCtx *c
 
                name = get_attribute(part->properties, "name");
                if (name == NULL) {
-                       soap_error1(E_ERROR, "Parsing WSDL: No name associated 
with <part> '%s'", message->name);
+                       soap_error1(E_ERROR, "Parsing WSDL: No name associated 
with <part> '%s'",  SAFE_STR(message->name));
                }
 
                param->paramName = estrdup((char*)name->children->content);
@@ -768,7 +770,7 @@ static sdlPtr load_wsdl(zval *this_ptr,
                                        continue;
                                }
                                if (!node_is_equal(trav,"port")) {
-                                       soap_error1(E_ERROR, "Parsing WSDL: 
Unexpected WSDL element <%s>", trav->name);
+                                       soap_error1(E_ERROR, "Parsing WSDL: 
Unexpected WSDL element <%s>",  SAFE_STR(trav->name));
                                }
 
                                port = trav;
@@ -807,7 +809,7 @@ static sdlPtr load_wsdl(zval *this_ptr,
                                                }
                                        }
                                        if (trav2 != address && 
is_wsdl_element(trav2) && !node_is_equal(trav2,"documentation")) {
-                                               soap_error1(E_ERROR, "Parsing 
WSDL: Unexpected WSDL element <%s>", trav2->name);
+                                               soap_error1(E_ERROR, "Parsing 
WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav2->name));
                                        }
                                  trav2 = trav2->next;
                                }
@@ -909,7 +911,7 @@ static sdlPtr load_wsdl(zval *this_ptr,
                                                continue;
                                        }
                                        if (!node_is_equal(trav2,"operation")) {
-                                               soap_error1(E_ERROR, "Parsing 
WSDL: Unexpected WSDL element <%s>", trav2->name);
+                                               soap_error1(E_ERROR, "Parsing 
WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav2->name));
                                        }
 
                                        operation = trav2;
@@ -928,7 +930,7 @@ static sdlPtr load_wsdl(zval *this_ptr,
                                                           
!node_is_equal(trav3,"output") &&
                                                           
!node_is_equal(trav3,"fault") &&
                                                           
!node_is_equal(trav3,"documentation")) {
-                                                       soap_error1(E_ERROR, 
"Parsing WSDL: Unexpected WSDL element <%s>", trav3->name);
+                                                       soap_error1(E_ERROR, 
"Parsing WSDL: Unexpected WSDL element <%s>",  SAFE_STR(trav3->name));
                                                }
                                                trav3 = trav3->next;
                                        }
@@ -1106,7 +1108,7 @@ static sdlPtr load_wsdl(zval *this_ptr,
                                                                                
                }
                                                                                
        }
                                                                                
} else if (is_wsdl_element(trav) && !node_is_equal(trav,"documentation")) {
-                                                                               
        soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>", 
trav->name);
+                                                                               
        soap_error1(E_ERROR, "Parsing WSDL: Unexpected WSDL element <%s>",  
SAFE_STR(trav->name));
                                                                                
}
                                                                                
trav = trav->next;
                                                                        }
Index: php-7.4.6/ext/soap/php_xml.c
===================================================================
--- php-7.4.6.orig/ext/soap/php_xml.c   2020-05-12 10:09:18.000000000 +0200
+++ php-7.4.6/ext/soap/php_xml.c        2021-02-11 10:54:25.238409016 +0100
@@ -199,7 +199,7 @@ xmlNsPtr node_find_ns(xmlNodePtr node)
 
 int attr_is_equal_ex(xmlAttrPtr node, char *name, char *ns)
 {
-       if (name == NULL || strcmp((char*)node->name, name) == 0) {
+       if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 
0)) {
                if (ns) {
                        xmlNsPtr nsPtr = attr_find_ns(node);
                        if (nsPtr) {
@@ -215,7 +215,7 @@ int attr_is_equal_ex(xmlAttrPtr node, ch
 
 int node_is_equal_ex(xmlNodePtr node, char *name, char *ns)
 {
-       if (name == NULL || strcmp((char*)node->name, name) == 0) {
+       if (name == NULL || ((node->name) && strcmp((char*)node->name, name) == 
0)) {
                if (ns) {
                        xmlNsPtr nsPtr = node_find_ns(node);
                        if (nsPtr) {
++++++ php7-CVE-2021-21703.patch ++++++
diff --git a/sapi/fpm/fpm/fpm_children.c b/sapi/fpm/fpm/fpm_children.c
index fd121372f37c..912f77c11aa7 100644
--- a/sapi/fpm/fpm/fpm_children.c
+++ b/sapi/fpm/fpm/fpm_children.c
@@ -246,7 +246,7 @@ void fpm_children_bury() /* {{{ */
 
                        fpm_child_unlink(child);
 
-                       fpm_scoreboard_proc_free(wp->scoreboard, 
child->scoreboard_i);
+                       fpm_scoreboard_proc_free(child);
 
                        fpm_clock_get(&tv1);
 
@@ -256,9 +256,9 @@ void fpm_children_bury() /* {{{ */
                                if (!fpm_pctl_can_spawn_children()) {
                                        severity = ZLOG_DEBUG;
                                }
-                               zlog(severity, "[pool %s] child %d exited %s 
after %ld.%06d seconds from start", child->wp->config->name, (int) pid, buf, 
tv2.tv_sec, (int) tv2.tv_usec);
+                               zlog(severity, "[pool %s] child %d exited %s 
after %ld.%06d seconds from start", wp->config->name, (int) pid, buf, 
tv2.tv_sec, (int) tv2.tv_usec);
                        } else {
-                               zlog(ZLOG_DEBUG, "[pool %s] child %d has been 
killed by the process management after %ld.%06d seconds from start", 
child->wp->config->name, (int) pid, tv2.tv_sec, (int) tv2.tv_usec);
+                               zlog(ZLOG_DEBUG, "[pool %s] child %d has been 
killed by the process management after %ld.%06d seconds from start", 
wp->config->name, (int) pid, tv2.tv_sec, (int) tv2.tv_usec);
                        }
 
                        fpm_child_close(child, 1 /* in event_loop */);
@@ -324,7 +324,7 @@ static struct fpm_child_s *fpm_resources_prepare(struct 
fpm_worker_pool_s *wp) /
                return 0;
        }
 
-       if (0 > fpm_scoreboard_proc_alloc(wp->scoreboard, &c->scoreboard_i)) {
+       if (0 > fpm_scoreboard_proc_alloc(c)) {
                fpm_stdio_discard_pipes(c);
                fpm_child_free(c);
                return 0;
@@ -336,7 +336,7 @@ static struct fpm_child_s *fpm_resources_prepare(struct 
fpm_worker_pool_s *wp) /
 
 static void fpm_resources_discard(struct fpm_child_s *child) /* {{{ */
 {
-       fpm_scoreboard_proc_free(child->wp->scoreboard, child->scoreboard_i);
+       fpm_scoreboard_proc_free(child);
        fpm_stdio_discard_pipes(child);
        fpm_child_free(child);
 }
@@ -349,10 +349,10 @@ static void fpm_child_resources_use(struct fpm_child_s 
*child) /* {{{ */
                if (wp == child->wp) {
                        continue;
                }
-               fpm_scoreboard_free(wp->scoreboard);
+               fpm_scoreboard_free(wp);
        }
 
-       fpm_scoreboard_child_use(child->wp->scoreboard, child->scoreboard_i, 
getpid());
+       fpm_scoreboard_child_use(child, getpid());
        fpm_stdio_child_use_pipes(child);
        fpm_child_free(child);
 }
diff --git a/sapi/fpm/fpm/fpm_request.c b/sapi/fpm/fpm/fpm_request.c
index c80aa144628f..0a6f6a7cfbf0 100644
--- a/sapi/fpm/fpm/fpm_request.c
+++ b/sapi/fpm/fpm/fpm_request.c
@@ -285,7 +285,7 @@ int fpm_request_is_idle(struct fpm_child_s *child) /* {{{ */
        struct fpm_scoreboard_proc_s *proc;
 
        /* no need in atomicity here */
-       proc = fpm_scoreboard_proc_get(child->wp->scoreboard, 
child->scoreboard_i);
+       proc = fpm_scoreboard_proc_get_from_child(child);
        if (!proc) {
                return 0;
        }
@@ -300,7 +300,7 @@ int fpm_request_last_activity(struct fpm_child_s *child, 
struct timeval *tv) /*
 
        if (!tv) return -1;
 
-       proc = fpm_scoreboard_proc_get(child->wp->scoreboard, 
child->scoreboard_i);
+       proc = fpm_scoreboard_proc_get_from_child(child);
        if (!proc) {
                return -1;
        }
diff --git a/sapi/fpm/fpm/fpm_scoreboard.c b/sapi/fpm/fpm/fpm_scoreboard.c
index 328f999f0c9b..7e9da4d6848a 100644
--- a/sapi/fpm/fpm/fpm_scoreboard.c
+++ b/sapi/fpm/fpm/fpm_scoreboard.c
@@ -6,6 +6,7 @@
 #include <time.h>
 
 #include "fpm_config.h"
+#include "fpm_children.h"
 #include "fpm_scoreboard.h"
 #include "fpm_shm.h"
 #include "fpm_sockets.h"
@@ -23,7 +24,6 @@ static float fpm_scoreboard_tick;
 int fpm_scoreboard_init_main() /* {{{ */
 {
        struct fpm_worker_pool_s *wp;
-       unsigned int i;
 
 #ifdef HAVE_TIMES
 #if (defined(HAVE_SYSCONF) && defined(_SC_CLK_TCK))
@@ -40,7 +40,7 @@ int fpm_scoreboard_init_main() /* {{{ */
 
 
        for (wp = fpm_worker_all_pools; wp; wp = wp->next) {
-               size_t scoreboard_size, scoreboard_nprocs_size;
+               size_t scoreboard_procs_size;
                void *shm_mem;
 
                if (wp->config->pm_max_children < 1) {
@@ -53,22 +53,15 @@ int fpm_scoreboard_init_main() /* {{{ */
                        return -1;
                }
 
-               scoreboard_size        = sizeof(struct fpm_scoreboard_s) + 
(wp->config->pm_max_children) * sizeof(struct fpm_scoreboard_proc_s *);
-               scoreboard_nprocs_size = sizeof(struct fpm_scoreboard_proc_s) * 
wp->config->pm_max_children;
-               shm_mem                = fpm_shm_alloc(scoreboard_size + 
scoreboard_nprocs_size);
+               scoreboard_procs_size = sizeof(struct fpm_scoreboard_proc_s) * 
wp->config->pm_max_children;
+               shm_mem = fpm_shm_alloc(sizeof(struct fpm_scoreboard_s) + 
scoreboard_procs_size);
 
                if (!shm_mem) {
                        return -1;
                }
-               wp->scoreboard         = shm_mem;
+               wp->scoreboard = shm_mem;
+               wp->scoreboard->pm = wp->config->pm;
                wp->scoreboard->nprocs = wp->config->pm_max_children;
-               shm_mem               += scoreboard_size;
-
-               for (i = 0; i < wp->scoreboard->nprocs; i++, shm_mem += 
sizeof(struct fpm_scoreboard_proc_s)) {
-                       wp->scoreboard->procs[i] = shm_mem;
-               }
-
-               wp->scoreboard->pm          = wp->config->pm;
                wp->scoreboard->start_epoch = time(NULL);
                strlcpy(wp->scoreboard->pool, wp->config->name, 
sizeof(wp->scoreboard->pool));
        }
@@ -162,28 +155,48 @@ struct fpm_scoreboard_s *fpm_scoreboard_get() /* {{{*/
 }
 /* }}} */
 
-struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get(struct fpm_scoreboard_s 
*scoreboard, int child_index) /* {{{*/
+static inline struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get_ex(
+               struct fpm_scoreboard_s *scoreboard, int child_index, unsigned 
int nprocs) /* {{{*/
 {
        if (!scoreboard) {
-               scoreboard = fpm_scoreboard;
+               return NULL;
        }
 
-       if (!scoreboard) {
+       if (child_index < 0 || (unsigned int)child_index >= nprocs) {
                return NULL;
        }
 
+       return &scoreboard->procs[child_index];
+}
+/* }}} */
+
+struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get(
+               struct fpm_scoreboard_s *scoreboard, int child_index) /* {{{*/
+{
+       if (!scoreboard) {
+               scoreboard = fpm_scoreboard;
+       }
+
        if (child_index < 0) {
                child_index = fpm_scoreboard_i;
        }
 
-       if (child_index < 0 || (unsigned int)child_index >= scoreboard->nprocs) 
{
-               return NULL;
-       }
+       return fpm_scoreboard_proc_get_ex(scoreboard, child_index, 
scoreboard->nprocs);
+}
+/* }}} */
 
-       return scoreboard->procs[child_index];
+struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get_from_child(struct 
fpm_child_s *child) /* {{{*/
+{
+       struct fpm_worker_pool_s *wp = child->wp;
+       unsigned int nprocs = wp->config->pm_max_children;
+       struct fpm_scoreboard_s *scoreboard = wp->scoreboard;
+       int child_index = child->scoreboard_i;
+
+       return fpm_scoreboard_proc_get_ex(scoreboard, child_index, nprocs);
 }
 /* }}} */
 
+
 struct fpm_scoreboard_s *fpm_scoreboard_acquire(struct fpm_scoreboard_s 
*scoreboard, int nohang) /* {{{ */
 {
        struct fpm_scoreboard_s *s;
@@ -234,28 +247,28 @@ void fpm_scoreboard_proc_release(struct 
fpm_scoreboard_proc_s *proc) /* {{{ */
        proc->lock = 0;
 }
 
-void fpm_scoreboard_free(struct fpm_scoreboard_s *scoreboard) /* {{{ */
+void fpm_scoreboard_free(struct fpm_worker_pool_s *wp) /* {{{ */
 {
-       size_t scoreboard_size, scoreboard_nprocs_size;
+       size_t scoreboard_procs_size;
+       struct fpm_scoreboard_s *scoreboard = wp->scoreboard;
 
        if (!scoreboard) {
                zlog(ZLOG_ERROR, "**scoreboard is NULL");
                return;
        }
 
-       scoreboard_size        = sizeof(struct fpm_scoreboard_s) + 
(scoreboard->nprocs) * sizeof(struct fpm_scoreboard_proc_s *);
-       scoreboard_nprocs_size = sizeof(struct fpm_scoreboard_proc_s) * 
scoreboard->nprocs;
+       scoreboard_procs_size = sizeof(struct fpm_scoreboard_proc_s) * 
wp->config->pm_max_children;
 
-       fpm_shm_free(scoreboard, scoreboard_size + scoreboard_nprocs_size);
+       fpm_shm_free(scoreboard, sizeof(struct fpm_scoreboard_s) + 
scoreboard_procs_size);
 }
 /* }}} */
 
-void fpm_scoreboard_child_use(struct fpm_scoreboard_s *scoreboard, int 
child_index, pid_t pid) /* {{{ */
+void fpm_scoreboard_child_use(struct fpm_child_s *child, pid_t pid) /* {{{ */
 {
        struct fpm_scoreboard_proc_s *proc;
-       fpm_scoreboard = scoreboard;
-       fpm_scoreboard_i = child_index;
-       proc = fpm_scoreboard_proc_get(scoreboard, child_index);
+       fpm_scoreboard = child->wp->scoreboard;
+       fpm_scoreboard_i = child->scoreboard_i;
+       proc = fpm_scoreboard_proc_get_from_child(child);
        if (!proc) {
                return;
        }
@@ -264,18 +277,22 @@ void fpm_scoreboard_child_use(struct fpm_scoreboard_s 
*scoreboard, int child_ind
 }
 /* }}} */
 
-void fpm_scoreboard_proc_free(struct fpm_scoreboard_s *scoreboard, int 
child_index) /* {{{ */
+void fpm_scoreboard_proc_free(struct fpm_child_s *child) /* {{{ */
 {
+       struct fpm_worker_pool_s *wp = child->wp;
+       struct fpm_scoreboard_s *scoreboard = wp->scoreboard;
+       int child_index = child->scoreboard_i;
+
        if (!scoreboard) {
                return;
        }
 
-       if (child_index < 0 || (unsigned int)child_index >= scoreboard->nprocs) 
{
+       if (child_index < 0 || child_index >= wp->config->pm_max_children) {
                return;
        }
 
-       if (scoreboard->procs[child_index] && 
scoreboard->procs[child_index]->used > 0) {
-               memset(scoreboard->procs[child_index], 0, sizeof(struct 
fpm_scoreboard_proc_s));
+       if (scoreboard->procs[child_index].used > 0) {
+               memset(&scoreboard->procs[child_index], 0, sizeof(struct 
fpm_scoreboard_proc_s));
        }
 
        /* set this slot as free to avoid search on next alloc */
@@ -283,41 +300,44 @@ void fpm_scoreboard_proc_free(struct fpm_scoreboard_s 
*scoreboard, int child_ind
 }
 /* }}} */
 
-int fpm_scoreboard_proc_alloc(struct fpm_scoreboard_s *scoreboard, int 
*child_index) /* {{{ */
+int fpm_scoreboard_proc_alloc(struct fpm_child_s *child) /* {{{ */
 {
        int i = -1;
+       struct fpm_worker_pool_s *wp = child->wp;
+       struct fpm_scoreboard_s *scoreboard = wp->scoreboard;
+       int nprocs = wp->config->pm_max_children;
 
-       if (!scoreboard || !child_index) {
+       if (!scoreboard) {
                return -1;
        }
 
        /* first try the slot which is supposed to be free */
-       if (scoreboard->free_proc >= 0 && (unsigned int)scoreboard->free_proc < 
scoreboard->nprocs) {
-               if (scoreboard->procs[scoreboard->free_proc] && 
!scoreboard->procs[scoreboard->free_proc]->used) {
+       if (scoreboard->free_proc >= 0 && scoreboard->free_proc < nprocs) {
+               if (!scoreboard->procs[scoreboard->free_proc].used) {
                        i = scoreboard->free_proc;
                }
        }
 
        if (i < 0) { /* the supposed free slot is not, let's search for a free 
slot */
                zlog(ZLOG_DEBUG, "[pool %s] the proc->free_slot was not free. 
Let's search", scoreboard->pool);
-               for (i = 0; i < (int)scoreboard->nprocs; i++) {
-                       if (scoreboard->procs[i] && 
!scoreboard->procs[i]->used) { /* found */
+               for (i = 0; i < nprocs; i++) {
+                       if (!scoreboard->procs[i].used) { /* found */
                                break;
                        }
                }
        }
 
        /* no free slot */
-       if (i < 0 || i >= (int)scoreboard->nprocs) {
+       if (i < 0 || i >= nprocs) {
                zlog(ZLOG_ERROR, "[pool %s] no free scoreboard slot", 
scoreboard->pool);
                return -1;
        }
 
-       scoreboard->procs[i]->used = 1;
-       *child_index = i;
+       scoreboard->procs[i].used = 1;
+       child->scoreboard_i = i;
 
        /* supposed next slot is free */
-       if (i + 1 >= (int)scoreboard->nprocs) {
+       if (i + 1 >= nprocs) {
                scoreboard->free_proc = 0;
        } else {
                scoreboard->free_proc = i + 1;
diff --git a/sapi/fpm/fpm/fpm_scoreboard.h b/sapi/fpm/fpm/fpm_scoreboard.h
index 1fecde1d0feb..9d5981e1c739 100644
--- a/sapi/fpm/fpm/fpm_scoreboard.h
+++ b/sapi/fpm/fpm/fpm_scoreboard.h
@@ -63,7 +63,7 @@ struct fpm_scoreboard_s {
        unsigned int nprocs;
        int free_proc;
        unsigned long int slow_rq;
-       struct fpm_scoreboard_proc_s *procs[];
+       struct fpm_scoreboard_proc_s procs[];
 };
 
 int fpm_scoreboard_init_main();
@@ -72,18 +72,19 @@ int fpm_scoreboard_init_child(struct fpm_worker_pool_s *wp);
 void fpm_scoreboard_update(int idle, int active, int lq, int lq_len, int 
requests, int max_children_reached, int slow_rq, int action, struct 
fpm_scoreboard_s *scoreboard);
 struct fpm_scoreboard_s *fpm_scoreboard_get();
 struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get(struct fpm_scoreboard_s 
*scoreboard, int child_index);
+struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_get_from_child(struct 
fpm_child_s *child);
 
 struct fpm_scoreboard_s *fpm_scoreboard_acquire(struct fpm_scoreboard_s 
*scoreboard, int nohang);
 void fpm_scoreboard_release(struct fpm_scoreboard_s *scoreboard);
 struct fpm_scoreboard_proc_s *fpm_scoreboard_proc_acquire(struct 
fpm_scoreboard_s *scoreboard, int child_index, int nohang);
 void fpm_scoreboard_proc_release(struct fpm_scoreboard_proc_s *proc);
 
-void fpm_scoreboard_free(struct fpm_scoreboard_s *scoreboard);
+void fpm_scoreboard_free(struct fpm_worker_pool_s *wp);
 
-void fpm_scoreboard_child_use(struct fpm_scoreboard_s *scoreboard, int 
child_index, pid_t pid);
+void fpm_scoreboard_child_use(struct fpm_child_s *child, pid_t pid);
 
-void fpm_scoreboard_proc_free(struct fpm_scoreboard_s *scoreboard, int 
child_index);
-int fpm_scoreboard_proc_alloc(struct fpm_scoreboard_s *scoreboard, int 
*child_index);
+void fpm_scoreboard_proc_free(struct fpm_child_s *child);
+int fpm_scoreboard_proc_alloc(struct fpm_child_s *child);
 
 #ifdef HAVE_TIMES
 float fpm_scoreboard_get_tick();
diff --git a/sapi/fpm/fpm/fpm_status.c b/sapi/fpm/fpm/fpm_status.c
index 36d224063583..de8db9d61a25 100644
--- a/sapi/fpm/fpm/fpm_status.c
+++ b/sapi/fpm/fpm/fpm_status.c
@@ -498,10 +498,10 @@ int fpm_status_handle_request(void) /* {{{ */
 
                        first = 1;
                        for (i=0; i<scoreboard_p->nprocs; i++) {
-                               if (!scoreboard_p->procs[i] || 
!scoreboard_p->procs[i]->used) {
+                               if (!scoreboard_p->procs[i].used) {
                                        continue;
                                }
-                               proc = *scoreboard_p->procs[i];
+                               proc = scoreboard_p->procs[i];
 
                                if (first) {
                                        first = 0;
diff --git a/sapi/fpm/fpm/fpm_worker_pool.c b/sapi/fpm/fpm/fpm_worker_pool.c
index d04528f4e0d0..65a9b226b1ae 100644
--- a/sapi/fpm/fpm/fpm_worker_pool.c
+++ b/sapi/fpm/fpm/fpm_worker_pool.c
@@ -54,7 +54,7 @@ static void fpm_worker_pool_cleanup(int which, void *arg) /* 
{{{ */
                fpm_worker_pool_config_free(wp->config);
                fpm_children_free(wp->children);
                if ((which & FPM_CLEANUP_CHILD) == 0 && fpm_globals.parent_pid 
== getpid()) {
-                       fpm_scoreboard_free(wp->scoreboard);
+                       fpm_scoreboard_free(wp);
                }
                fpm_worker_pool_free(wp);
        }

++++++ php7-CVE-2021-21704.patch ++++++
Index: php-7.4.6/ext/pdo_firebird/firebird_driver.c
===================================================================
--- php-7.4.6.orig/ext/pdo_firebird/firebird_driver.c   2020-05-12 
10:09:19.000000000 +0200
+++ php-7.4.6/ext/pdo_firebird/firebird_driver.c        2021-08-02 
14:05:22.216865965 +0200
@@ -206,8 +206,17 @@ static zend_long firebird_handle_doer(pd
        if (result[0] == isc_info_sql_records) {
                unsigned i = 3, result_size = isc_vax_integer(&result[1],2);
 
+               if (result_size > sizeof(result)) {
+                       ret = -1;
+                       goto free_statement;
+               }
                while (result[i] != isc_info_end && i < result_size) {
                        short len = (short)isc_vax_integer(&result[i+1],2);
+                       /* bail out on bad len */
+                       if (len != 1 && len != 2 && len != 4) {
+                               ret = -1;
+                               goto free_statement;
+                       }
                        if (result[i] != isc_info_req_select_count) {
                                ret += isc_vax_integer(&result[i+3],len);
                        }
@@ -509,14 +518,16 @@ static int firebird_handle_set_attribute
 }
 /* }}} */
 
+#define INFO_BUF_LEN 512
+
 /* callback to used to report database server info */
 static void firebird_info_cb(void *arg, char const *s) /* {{{ */
 {
        if (arg) {
                if (*(char*)arg) { /* second call */
-                       strcat(arg, " ");
+                       strlcat(arg, " ", INFO_BUF_LEN);
                }
-               strcat(arg, s);
+               strlcat(arg, s, INFO_BUF_LEN);
        }
 }
 /* }}} */
@@ -527,7 +538,7 @@ static int firebird_handle_get_attribute
        pdo_firebird_db_handle *H = (pdo_firebird_db_handle *)dbh->driver_data;
 
        switch (attr) {
-               char tmp[512];
+               char tmp[INFO_BUF_LEN];
 
                case PDO_ATTR_AUTOCOMMIT:
                        ZVAL_LONG(val,dbh->auto_commit);
Index: php-7.4.6/ext/pdo_firebird/firebird_statement.c
===================================================================
--- php-7.4.6.orig/ext/pdo_firebird/firebird_statement.c        2020-05-12 
10:09:19.000000000 +0200
+++ php-7.4.6/ext/pdo_firebird/firebird_statement.c     2021-08-02 
14:05:22.216865965 +0200
@@ -136,8 +136,14 @@ static int firebird_stmt_execute(pdo_stm
                                }
                                if (result[0] == isc_info_sql_records) {
                                        unsigned i = 3, result_size = 
isc_vax_integer(&result[1], 2);
+                                       if (result_size > sizeof(result)) {
+                                               goto error;
+                                       }
                                        while (result[i] != isc_info_end && i < 
result_size) {
                                                short len = (short) 
isc_vax_integer(&result[i + 1], 2);
+                                               if (len != 1 && len != 2 && len 
!= 4) {
+                                                       goto error;
+                                               }
                                                if (result[i] != 
isc_info_req_select_count) {
                                                        affected_rows += 
isc_vax_integer(&result[i + 3], len);
                                                }
@@ -161,6 +167,7 @@ static int firebird_stmt_execute(pdo_stm
                return 1;
        } while (0);
 
+error:
        RECORD_ERROR(stmt);
 
        return 0;
@@ -302,6 +309,11 @@ static int firebird_fetch_blob(pdo_stmt_
                unsigned short seg_len;
                ISC_STATUS stat;
 
+               /* prevent overflow */
+               if (*len == ZEND_ULONG_MAX) {
+                       result = 0;
+                       goto fetch_blob_end;
+               }
                *ptr = S->fetch_buf[colno] = erealloc(S->fetch_buf[colno], 
*len+1);
 
                for (cur_len = stat = 0; (!stat || stat == isc_segment) && 
cur_len < *len; cur_len += seg_len) {
++++++ php7-CVE-2021-21705.patch ++++++
Index: php-7.4.6/ext/filter/logical_filters.c
===================================================================
--- php-7.4.6.orig/ext/filter/logical_filters.c 2020-05-12 10:09:22.000000000 
+0200
+++ php-7.4.6/ext/filter/logical_filters.c      2021-07-09 14:56:54.242534739 
+0200
@@ -555,6 +555,22 @@ void php_filter_validate_domain(PHP_INPU
 }
 /* }}} */
 
+static int is_userinfo_valid(zend_string *str)
+{
+       const char *valid = "-._~!$&'()*+,;=:";
+       const char *p = ZSTR_VAL(str);
+       while (p - ZSTR_VAL(str) < ZSTR_LEN(str)) {
+               if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
+                       p++;
+               } else if (*p == '%' && p - ZSTR_VAL(str) <= ZSTR_LEN(str) - 3 
&& isdigit(*(p+1)) && isxdigit(*(p+2))) {
+                       p += 3;
+               } else {
+                       return 0;
+               }
+       }
+       return 1;
+}
+
 void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 {
        php_url *url;
@@ -615,6 +631,15 @@ bad_url:
                php_url_free(url);
                RETURN_VALIDATION_FAILED
        }
+
+       if (url->user != NULL && !is_userinfo_valid(url->user)
+               || url->pass != NULL && !is_userinfo_valid(url->pass)
+       ) {
+               php_url_free(url);
+               RETURN_VALIDATION_FAILED
+
+       }
+
        php_url_free(url);
 }
 /* }}} */
++++++ php7-CVE-2021-21707.patch ++++++
Index: php-7.4.6/ext/dom/domimplementation.c
===================================================================
--- php-7.4.6.orig/ext/dom/domimplementation.c  2020-05-12 10:09:21.000000000 
+0200
+++ php-7.4.6/ext/dom/domimplementation.c       2021-11-26 11:22:10.118332604 
+0100
@@ -112,6 +112,11 @@ PHP_METHOD(domimplementation, createDocu
                pch2 = (xmlChar *) systemid;
        }
 
+       if (strstr(name, "%00")) {
+               php_error_docref(NULL, E_WARNING, "URI must not contain 
percent-encoded NUL bytes");
+               RETURN_FALSE;
+       }
+
        uri = xmlParseURI(name);
        if (uri != NULL && uri->opaque != NULL) {
                localname = xmlStrdup((xmlChar *) uri->opaque);
Index: php-7.4.6/ext/libxml/libxml.c
===================================================================
--- php-7.4.6.orig/ext/libxml/libxml.c  2020-05-12 10:09:17.000000000 +0200
+++ php-7.4.6/ext/libxml/libxml.c       2021-11-26 11:22:10.122332630 +0100
@@ -303,6 +303,10 @@ static void *php_libxml_streams_IO_open_
        int isescaped=0;
        xmlURI *uri;
 
+       if (strstr(filename, "%00")) {
+               php_error_docref(NULL, E_WARNING, "URI must not contain 
percent-encoded NUL bytes");
+               return NULL;
+       }
 
        uri = xmlParseURI(filename);
        if (uri && (uri->scheme == NULL ||
@@ -434,6 +438,11 @@ php_libxml_output_buffer_create_filename
        if (URI == NULL)
                return(NULL);
 
+       if (strstr(URI, "%00")) {
+               php_error_docref(NULL, E_WARNING, "URI must not contain 
percent-encoded NUL bytes");
+               return NULL;
+       }
+
        puri = xmlParseURI(URI);
        if (puri != NULL) {
                if (puri->scheme != NULL)
++++++ php7-arm-build-fixes.patch ++++++
Index: php-7.4.5/ext/standard/crc32.c
===================================================================
--- php-7.4.5.orig/ext/standard/crc32.c 2020-04-14 14:54:45.000000000 +0200
+++ php-7.4.5/ext/standard/crc32.c      2020-05-13 10:08:59.811448152 +0200
@@ -20,7 +20,7 @@
 #include "basic_functions.h"
 #include "crc32.h"
 
-#if defined(__aarch64__) && defined(HAVE_SYS_AUXV_H)
+#if 0
 # include <arm_acle.h>
 # if defined(__linux__)
 #  include <sys/auxv.h>
@@ -85,7 +85,7 @@ PHP_NAMED_FUNCTION(php_if_crc32)
 
        crc = crcinit^0xFFFFFFFF;
 
-#if defined(__aarch64__) && defined(HAVE_SYS_AUXV_H)
+#if 0
        if (has_crc32_insn()) {
                crc = crc32_aarch64(crc, p, nr);
                RETURN_LONG(crc^0xFFFFFFFF);
Index: php-7.4.5/Zend/zend_operators.h
===================================================================
--- php-7.4.5.orig/Zend/zend_operators.h        2020-04-14 14:54:48.000000000 
+0200
+++ php-7.4.5/Zend/zend_operators.h     2020-05-13 12:00:10.846071237 +0200
@@ -670,26 +670,6 @@ overflow: ZEND_ATTRIBUTE_COLD_LABEL
        return;
 overflow: ZEND_ATTRIBUTE_COLD_LABEL
        ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2));
-#elif ZEND_USE_ASM_ARITHMETIC && defined(__aarch64__)
-       __asm__ goto(
-               "ldr    x5, [%1]\n\t"
-               "ldr    x6, [%2]\n\t"
-               "adds   x5, x5, x6\n\t"
-               "bvs    %l5\n\t"
-               "mov    w6, %3\n\t"
-               "str    x5, [%0]\n\t"
-               "str    w6, [%0, %c4]\n"
-               :
-               : "r"(&result->value),
-                 "r"(&op1->value),
-                 "r"(&op2->value),
-                 "n"(IS_LONG),
-                 "n"(ZVAL_OFFSETOF_TYPE)
-               : "x5", "x6", "cc", "memory"
-               : overflow);
-       return;
-overflow: ZEND_ATTRIBUTE_COLD_LABEL
-       ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) + (double) Z_LVAL_P(op2));
 #elif PHP_HAVE_BUILTIN_SADDL_OVERFLOW && SIZEOF_LONG == SIZEOF_ZEND_LONG
        long lresult;
        if (UNEXPECTED(__builtin_saddl_overflow(Z_LVAL_P(op1), Z_LVAL_P(op2), 
&lresult))) {
@@ -779,26 +759,6 @@ overflow: ZEND_ATTRIBUTE_COLD_LABEL
                : overflow);
        return;
 overflow: ZEND_ATTRIBUTE_COLD_LABEL
-       ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2));
-#elif ZEND_USE_ASM_ARITHMETIC && defined(__aarch64__)
-       __asm__ goto(
-               "ldr    x5, [%1]\n\t"
-               "ldr    x6, [%2]\n\t"
-               "subs   x5, x5, x6\n\t"
-               "bvs    %l5\n\t"
-               "mov    w6, %3\n\t"
-               "str    x5, [%0]\n\t"
-               "str    w6, [%0, %c4]\n"
-               :
-               : "r"(&result->value),
-                 "r"(&op1->value),
-                 "r"(&op2->value),
-                 "n"(IS_LONG),
-                 "n"(ZVAL_OFFSETOF_TYPE)
-               : "x5", "x6", "cc", "memory"
-               : overflow);
-       return;
-overflow: ZEND_ATTRIBUTE_COLD_LABEL
        ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2));
 #elif PHP_HAVE_BUILTIN_SSUBL_OVERFLOW && SIZEOF_LONG == SIZEOF_ZEND_LONG
        long lresult;
++++++ php7-bsc1175508.patch ++++++
>From d66e48b5b6574f91e5dbd0a73c4ae3b62874a47a Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita....@gmail.com>
Date: Mon, 30 Aug 2021 16:31:28 +0200
Subject: [PATCH] Error on resource ID space overflow

---
 Zend/zend_list.c | 2 ++
 1 file changed, 2 insertions(+)

Index: php-7.4.6/Zend/zend_list.c
===================================================================
--- php-7.4.6.orig/Zend/zend_list.c     2021-10-04 13:04:05.596024043 +0200
+++ php-7.4.6/Zend/zend_list.c  2021-10-04 13:07:26.869206163 +0200
@@ -37,6 +37,8 @@ ZEND_API zval* ZEND_FASTCALL zend_list_i
        index = zend_hash_next_free_element(&EG(regular_list));
        if (index == 0) {
                index = 1;
+       } else if (index == INT_MAX) {
+               zend_error_noreturn(E_ERROR, "Resource ID space overflow");
        }
        ZVAL_NEW_RES(&zv, index, ptr, type);
        return zend_hash_index_add_new(&EG(regular_list), index, &zv);
++++++ php7.rpmlintrc ++++++
# Non-versioned shared library, php-embed requires
# exact version of main package, parallel installation
# not wanted
addFilter("php.-embed.* shlib-policy-name-error")
# PHP5 is obsolete, replaced by PHP7
addFilter("obsolete-not-provided php5-*")
# Forgot to add category?
addFilter("non-standard-group Development/Libraries/PHP")

Reply via email to