Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=f133d47cdb004abd33a7fd830195f8020380da4d
commit f133d47cdb004abd33a7fd830195f8020380da4d Author: kikadf <[email protected]> Date: Thu Sep 11 14:02:29 2014 +0200 php-5.3.26-2arcturus6-x86_64 * Fix CVE-2014-4698 diff --git a/source/devel/php/CVE-2014-3597.patch b/source/devel/php/CVE-2014-3597.patch index fae3f72..08ab95c 100644 --- a/source/devel/php/CVE-2014-3597.patch +++ b/source/devel/php/CVE-2014-3597.patch @@ -1,36 +1,32 @@ -From 2fefae47716d501aec41c1102f3fd4531f070b05 Mon Sep 17 00:00:00 2001 -From: Remi Collet <[email protected]> -Date: Tue, 19 Aug 2014 08:33:49 +0200 -Subject: [PATCH] Fixed Sec Bug #67717 segfault in dns_get_record CVE-2014-3597 +Origin: https://github.com/php/php-src/commit/2fefae47716d501aec41c1102f3fd4531f070b05 +From: Remi Collet +Subject: Fixed Sec Bug #67717 segfault in dns_get_record CVE-2014-3597 -Incomplete fix for CVE-2014-4049 - -Check possible buffer overflow -- pass real buffer end to dn_expand calls -- check buffer len before each read --- - ext/standard/dns.c | 84 ++++++++++++++++++++++++++++++++++++++---------------- + ext/standard/dns.c | 84 +++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 60 insertions(+), 24 deletions(-) ---- php5.orig/ext/standard/dns.c -+++ php5/ext/standard/dns.c -@@ -412,8 +412,14 @@ PHP_FUNCTION(dns_check_record) +Index: b/ext/standard/dns.c +=================================================================== +--- a/ext/standard/dns.c ++++ b/ext/standard/dns.c +@@ -412,8 +412,14 @@ #if HAVE_FULL_DNS_FUNCS +#define CHECKCP(n) do { \ -+ if (cp + n > end) { \ -+ return NULL; \ -+ } \ ++ if (cp + n > end) { \ ++ return NULL; \ ++ } \ +} while (0) + /* {{{ php_parserr */ --static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int store, int raw, zval **subarray) -+static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_to_fetch, int store, int raw, zval **subarray) +-static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int store, zval **subarray) ++static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_to_fetch, int store, zval **subarray) { u_short type, class, dlen; u_long ttl; -@@ -425,16 +431,18 @@ static u_char *php_parserr(u_char *cp, q +@@ -425,16 +431,18 @@ *subarray = NULL; @@ -50,8 +46,8 @@ Check possible buffer overflow if (type_to_fetch != T_ANY && type != type_to_fetch) { cp += dlen; return cp; -@@ -461,12 +469,14 @@ static u_char *php_parserr(u_char *cp, q - +@@ -451,12 +459,14 @@ + add_assoc_string(*subarray, "host", name, 1); switch (type) { case DNS_T_A: + CHECKCP(4); @@ -65,7 +61,7 @@ Check possible buffer overflow add_assoc_string(*subarray, "type", "MX", 1); GETSHORT(n, cp); add_assoc_long(*subarray, "pri", n); -@@ -485,7 +495,7 @@ static u_char *php_parserr(u_char *cp, q +@@ -475,7 +485,7 @@ if (type == DNS_T_PTR) { add_assoc_string(*subarray, "type", "PTR", 1); } @@ -74,7 +70,7 @@ Check possible buffer overflow if (n < 0) { return NULL; } -@@ -495,18 +505,22 @@ static u_char *php_parserr(u_char *cp, q +@@ -485,18 +495,22 @@ case DNS_T_HINFO: /* See RFC 1010 for values */ add_assoc_string(*subarray, "type", "HINFO", 1); @@ -98,7 +94,7 @@ Check possible buffer overflow zval *entries = NULL; add_assoc_string(*subarray, "type", "TXT", 1); -@@ -515,37 +529,41 @@ static u_char *php_parserr(u_char *cp, q +@@ -505,37 +519,41 @@ MAKE_STD_ZVAL(entries); array_init(entries); @@ -151,7 +147,7 @@ Check possible buffer overflow GETLONG(n, cp); add_assoc_long(*subarray, "serial", n); GETLONG(n, cp); -@@ -559,6 +577,7 @@ static u_char *php_parserr(u_char *cp, q +@@ -549,6 +567,7 @@ break; case DNS_T_AAAA: tp = (u_char*)name; @@ -159,7 +155,7 @@ Check possible buffer overflow for(i=0; i < 8; i++) { GETSHORT(s, cp); if (s != 0) { -@@ -593,6 +612,7 @@ static u_char *php_parserr(u_char *cp, q +@@ -583,6 +602,7 @@ case DNS_T_A6: p = cp; add_assoc_string(*subarray, "type", "A6", 1); @@ -167,7 +163,7 @@ Check possible buffer overflow n = ((int)cp[0]) & 0xFF; cp++; add_assoc_long(*subarray, "masklen", n); -@@ -628,6 +648,7 @@ static u_char *php_parserr(u_char *cp, q +@@ -618,6 +638,7 @@ cp++; } for (i = (n + 8) / 16; i < 8; i++) { @@ -175,7 +171,7 @@ Check possible buffer overflow GETSHORT(s, cp); if (s != 0) { if (tp > (u_char *)name) { -@@ -657,7 +678,7 @@ static u_char *php_parserr(u_char *cp, q +@@ -647,7 +668,7 @@ tp[0] = '\0'; add_assoc_string(*subarray, "ipv6", name, 1); if (cp < p + dlen) { @@ -184,7 +180,7 @@ Check possible buffer overflow if (n < 0) { return NULL; } -@@ -666,6 +687,7 @@ static u_char *php_parserr(u_char *cp, q +@@ -656,6 +677,7 @@ } break; case DNS_T_SRV: @@ -192,7 +188,7 @@ Check possible buffer overflow add_assoc_string(*subarray, "type", "SRV", 1); GETSHORT(n, cp); add_assoc_long(*subarray, "pri", n); -@@ -673,7 +695,7 @@ static u_char *php_parserr(u_char *cp, q +@@ -663,7 +685,7 @@ add_assoc_long(*subarray, "weight", n); GETSHORT(n, cp); add_assoc_long(*subarray, "port", n); @@ -201,7 +197,7 @@ Check possible buffer overflow if (n < 0) { return NULL; } -@@ -681,21 +703,35 @@ static u_char *php_parserr(u_char *cp, q +@@ -671,21 +693,35 @@ add_assoc_string(*subarray, "target", name, 1); break; case DNS_T_NAPTR: @@ -241,30 +237,30 @@ Check possible buffer overflow if (n < 0) { return NULL; } -@@ -888,7 +924,7 @@ PHP_FUNCTION(dns_get_record) +@@ -852,7 +888,7 @@ while (an-- && cp && cp < end) { zval *retval; -- cp = php_parserr(cp, &answer, type_to_fetch, store_results, raw, &retval); -+ cp = php_parserr(cp, end, &answer, type_to_fetch, store_results, raw, &retval); +- cp = php_parserr(cp, &answer, type_to_fetch, store_results, &retval); ++ cp = php_parserr(cp, end, &answer, type_to_fetch, store_results, &retval); if (retval != NULL && store_results) { add_next_index_zval(return_value, retval); } -@@ -901,7 +937,7 @@ PHP_FUNCTION(dns_get_record) +@@ -865,7 +901,7 @@ while (ns-- > 0 && cp && cp < end) { zval *retval = NULL; -- cp = php_parserr(cp, &answer, DNS_T_ANY, authns != NULL, raw, &retval); -+ cp = php_parserr(cp, end, &answer, DNS_T_ANY, authns != NULL, raw, &retval); +- cp = php_parserr(cp, &answer, DNS_T_ANY, authns != NULL, &retval); ++ cp = php_parserr(cp, end, &answer, DNS_T_ANY, authns != NULL, &retval); if (retval != NULL) { add_next_index_zval(authns, retval); } -@@ -913,7 +949,7 @@ PHP_FUNCTION(dns_get_record) +@@ -877,7 +913,7 @@ while (ar-- > 0 && cp && cp < end) { zval *retval = NULL; -- cp = php_parserr(cp, &answer, DNS_T_ANY, 1, raw, &retval); -+ cp = php_parserr(cp, end, &answer, DNS_T_ANY, 1, raw, &retval); +- cp = php_parserr(cp, &answer, DNS_T_ANY, 1, &retval); ++ cp = php_parserr(cp, end, &answer, DNS_T_ANY, 1, &retval); if (retval != NULL) { add_next_index_zval(addtl, retval); } diff --git a/source/devel/php/CVE-2014-4670.patch b/source/devel/php/CVE-2014-4670.patch index 3cc2f05..2ecc2ae 100644 --- a/source/devel/php/CVE-2014-4670.patch +++ b/source/devel/php/CVE-2014-4670.patch @@ -1,6 +1,20 @@ ---- php5.orig/ext/spl/spl_dllist.c -+++ php5/ext/spl/spl_dllist.c -@@ -43,12 +43,10 @@ PHPAPI zend_class_entry *spl_ce_SplStac +From df78c48354f376cf419d7a97f88ca07d572f00fb Mon Sep 17 00:00:00 2001 +From: Xinchen Hui <[email protected]> +Date: Wed, 2 Jul 2014 17:45:09 +0800 +Subject: [PATCH] Fixed Bug #67538 (SPL Iterators use-after-free) + +--- + NEWS | 3 +++ + ext/spl/spl_dllist.c | 7 +++++-- + ext/spl/tests/bug67538.phpt | 17 +++++++++++++++++ + 3 files changed, 25 insertions(+), 2 deletions(-) + create mode 100644 ext/spl/tests/bug67538.phpt + +Index: php5-5.3.10/ext/spl/spl_dllist.c +=================================================================== +--- php5-5.3.10.orig/ext/spl/spl_dllist.c 2014-07-07 08:36:07.950630297 -0400 ++++ php5-5.3.10/ext/spl/spl_dllist.c 2014-07-07 08:36:07.946630297 -0400 +@@ -40,12 +40,10 @@ #define SPL_LLIST_DELREF(elem) if(!--(elem)->rc) { \ efree(elem); \ @@ -13,7 +27,7 @@ } #define SPL_LLIST_ADDREF(elem) (elem)->rc++ -@@ -916,6 +914,11 @@ SPL_METHOD(SplDoublyLinkedList, offsetUn +@@ -911,6 +909,11 @@ llist->dtor(element TSRMLS_CC); } @@ -25,8 +39,10 @@ zval_ptr_dtor((zval **)&element->data); element->data = NULL; ---- /dev/null -+++ php5/ext/spl/tests/bug67538.phpt +Index: php5-5.3.10/ext/spl/tests/bug67538.phpt +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ php5-5.3.10/ext/spl/tests/bug67538.phpt 2014-07-07 08:36:07.946630297 -0400 @@ -0,0 +1,17 @@ +--TEST-- +Bug #67538 (SPL Iterators use-after-free) diff --git a/source/devel/php/CVE-2014-4698.patch b/source/devel/php/CVE-2014-4698.patch new file mode 100644 index 0000000..b805946 --- /dev/null +++ b/source/devel/php/CVE-2014-4698.patch @@ -0,0 +1,53 @@ +From 22882a9d89712ff2b6ebc20a689a89452bba4dcd Mon Sep 17 00:00:00 2001 +From: Xinchen Hui <[email protected]> +Date: Wed, 2 Jul 2014 17:57:42 +0800 +Subject: [PATCH] Fixed bug #67539 (ArrayIterator use-after-free due to object + change during sorting) + +--- + NEWS | 2 ++ + ext/spl/spl_array.c | 7 +++++++ + ext/spl/tests/bug67539.phpt | 15 +++++++++++++++ + 3 files changed, 24 insertions(+) + create mode 100644 ext/spl/tests/bug67539.phpt + +Index: php5-5.3.10/ext/spl/spl_array.c +=================================================================== +--- php5-5.3.10.orig/ext/spl/spl_array.c 2014-07-07 08:37:07.030629381 -0400 ++++ php5-5.3.10/ext/spl/spl_array.c 2014-07-07 08:37:07.026629381 -0400 +@@ -1732,8 +1732,15 @@ + { + const unsigned char *p, *s; + zval *pmembers, *pflags = NULL; ++ HashTable *aht; + long flags; + ++ aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); ++ if (aht->nApplyCount > 0) { ++ zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); ++ return; ++ } ++ + /* storage */ + s = p = buf; + +Index: php5-5.3.10/ext/spl/tests/bug67539.phpt +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ php5-5.3.10/ext/spl/tests/bug67539.phpt 2014-07-07 08:37:07.026629381 -0400 +@@ -0,0 +1,15 @@ ++--TEST-- ++Bug #67539 (ArrayIterator use-after-free due to object change during sorting) ++--FILE-- ++<?php ++ ++$it = new ArrayIterator(array_fill(0,2,'X'), 1 ); ++ ++function badsort($a, $b) { ++ $GLOBALS['it']->unserialize($GLOBALS['it']->serialize()); ++ return TRUE; ++} ++ ++$it->uksort('badsort'); ++--EXPECTF-- ++Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d diff --git a/source/devel/php/CVE-2014-4721.patch b/source/devel/php/CVE-2014-4721.patch index af40307..d1a0f80 100644 --- a/source/devel/php/CVE-2014-4721.patch +++ b/source/devel/php/CVE-2014-4721.patch @@ -1,18 +1,21 @@ -From 3804c0d00fa6e629173fb1c8c61f8f88d5fe39b9 Mon Sep 17 00:00:00 2001 +From fb0128af2a95ec0d1a0360be49776c5b056d1f33 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev <[email protected]> Date: Mon, 23 Jun 2014 00:19:37 -0700 Subject: [PATCH] Fix bug #67498 - phpinfo() Type Confusion Information Leak Vulnerability --- + NEWS | 2 ++ ext/standard/info.c | 8 ++++---- ext/standard/tests/general_functions/bug67498.phpt | 15 +++++++++++++++ - 2 files changed, 19 insertions(+), 4 deletions(-) + 3 files changed, 21 insertions(+), 4 deletions(-) create mode 100644 ext/standard/tests/general_functions/bug67498.phpt ---- php5.orig/ext/standard/info.c -+++ php5/ext/standard/info.c -@@ -875,16 +875,16 @@ PHPAPI void php_print_info(int flag TSRM +Index: php5-5.3.10/ext/standard/info.c +=================================================================== +--- php5-5.3.10.orig/ext/standard/info.c 2014-07-07 08:39:01.334627610 -0400 ++++ php5-5.3.10/ext/standard/info.c 2014-07-07 08:39:01.334627610 -0400 +@@ -972,16 +972,16 @@ php_info_print_table_start(); php_info_print_table_header(2, "Variable", "Value"); @@ -32,9 +35,11 @@ Subject: [PATCH] Fix bug #67498 - phpinfo() Type Confusion Information Leak + if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) { php_info_print_table_row(2, "PHP_AUTH_PW", Z_STRVAL_PP(data)); } - php_print_gpcse_array(ZEND_STRL("_REQUEST") TSRMLS_CC); ---- /dev/null -+++ php5/ext/standard/tests/general_functions/bug67498.phpt + php_print_gpcse_array("_REQUEST", sizeof("_REQUEST")-1 TSRMLS_CC); +Index: php5-5.3.10/ext/standard/tests/general_functions/bug67498.phpt +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ php5-5.3.10/ext/standard/tests/general_functions/bug67498.phpt 2014-07-07 08:39:01.334627610 -0400 @@ -0,0 +1,15 @@ +--TEST-- +phpinfo() Type Confusion Information Leak Vulnerability diff --git a/source/devel/php/FrugalBuild b/source/devel/php/FrugalBuild index 5e58f5a..0e7d4be 100644 --- a/source/devel/php/FrugalBuild +++ b/source/devel/php/FrugalBuild @@ -4,7 +4,7 @@ pkgname=php pkgver=5.3.26 -pkgrel=2arcturus5 +pkgrel=2arcturus6 pkgdesc="A widely-used general-purpose scripting language" url="http://www.php.net"; backup=(etc/{php.ini,httpd/conf/modules.d/$pkgname.conf}) @@ -41,7 +41,7 @@ source=(${source[@]} CVE-2013-4113.patch CVE-2013-4248.patch CVE-2013-6420.patch CVE-2014-0207.patch CVE-2014-3478.patch CVE-2014-3479.patch CVE-2014-3480.patch CVE-2014-3487.patch CVE-2014-4721.patch CVE-2014-3538.patch CVE-2014-3587.patch - CVE-2014-4670.patch CVE-2014-4049.patch) + CVE-2014-4670.patch CVE-2014-4049.patch CVE-2014-4698.patch) sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ 'b75fe24356d0e6c5d375c4d2d2315f17d5e34e31' \ '805231398c06b27e4e1f8c18ce9d6aed7b06382d' \ @@ -56,11 +56,12 @@ sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ '205f1a29dc6f097a25171ded7ae69b291c2d98b3' \ '267fc9f6e12f03d41640e890173867b3aa05144c' \ 'd34955143d655b5a1496b2f939630e978529b4b6' \ - '72da3715195108595959c27ddace6822534bb765' \ + '4acec87a98743dd216d0679e08214837a0aca66b' \ 'f3b972bb901f0f3b41ae3c53dee2160fbcd55eec' \ '4739e1eab6f4522d91ecb05492e0430fbd28f42e' \ - '7c6563c4a60582a0ff32353e93cd6dfd2eeaa042' \ - 'a3fa0995e26e03681f0ce20289587645e6a4e401') + '34be06874a03c0b0d349d817af18059b92f4ec0e' \ + 'a3fa0995e26e03681f0ce20289587645e6a4e401' \ + '9c8ac4ba948c0feabc8c75e4f58ca3f775bb094f') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
