OpenPKG CVS Repository
http://cvs.openpkg.org/
____________________________________________________________________________
Server: cvs.openpkg.org Name: Ralf S. Engelschall
Root: /v/openpkg/cvs Email: [EMAIL PROTECTED]
Module: openpkg-src Date: 03-Nov-2006 23:41:47
Branch: OPENPKG_2_STABLE Handle: 2006110322414600
Modified files: (Branch: OPENPKG_2_STABLE)
openpkg-src/apache apache.patch.php apache.spec
Log:
MFC: recent fixes and upgrade to security fixed new upstream PHP
version
Summary:
Revision Changes Path
1.6.2.2 +6 -73 openpkg-src/apache/apache.patch.php
1.335.2.9 +3 -3 openpkg-src/apache/apache.spec
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: openpkg-src/apache/apache.patch.php
============================================================================
$ cvs diff -u -r1.6.2.1 -r1.6.2.2 apache.patch.php
--- openpkg-src/apache/apache.patch.php 3 Nov 2006 08:01:49 -0000
1.6.2.1
+++ openpkg-src/apache/apache.patch.php 3 Nov 2006 22:41:46 -0000
1.6.2.2
@@ -1,82 +1,15 @@
Security Fix (CVE-2006-4625)
Index: Zend/zend_ini.c
---- Zend/zend_ini.c.orig 2006-01-05 00:53:04 +0100
-+++ Zend/zend_ini.c 2006-10-17 08:24:12 +0200
-@@ -256,8 +256,8 @@
- zend_ini_entry *ini_entry;
+--- Zend/zend_ini.c.orig 2006-09-06 10:54:44 +0200
++++ Zend/zend_ini.c 2006-11-03 08:46:12 +0100
+@@ -235,7 +235,8 @@
+ char *duplicate;
TSRMLS_FETCH();
- if (zend_hash_find(EG(ini_directives), name, name_length, (void **)
&ini_entry)==FAILURE) {
-- return FAILURE;
+ if (zend_hash_find(EG(ini_directives), name, name_length, (void **)
&ini_entry)==FAILURE ||
-+ (stage == ZEND_INI_STAGE_RUNTIME && (ini_entry->modifiable &
ZEND_INI_USER) == 0)) { return FAILURE;
++ (stage == ZEND_INI_STAGE_RUNTIME && (ini_entry->modifiable &
ZEND_INI_USER)==0)) {
+ return FAILURE;
}
- zend_restore_ini_entry_cb(ini_entry, stage TSRMLS_CC);
-
------------------------------------------------------------------------------
-
-Security Fix (CVE-2006-4812)
-
-Index: Zend/zend_alloc.c
---- Zend/zend_alloc.c.orig 2006-08-10 19:16:24 +0200
-+++ Zend/zend_alloc.c 2006-10-17 08:25:42 +0200
-@@ -328,15 +328,14 @@
- ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC
ZEND_FILE_LINE_ORIG_DC)
- {
- void *p;
-- int final_size = size*nmemb;
-
- HANDLE_BLOCK_INTERRUPTIONS();
-- p = _emalloc(final_size ZEND_FILE_LINE_RELAY_CC
ZEND_FILE_LINE_ORIG_RELAY_CC);
-+ p = _safe_emalloc(nmemb, size, 0 ZEND_FILE_LINE_RELAY_CC
ZEND_FILE_LINE_ORIG_RELAY_CC);
- if (!p) {
- HANDLE_UNBLOCK_INTERRUPTIONS();
- return (void *) p;
- }
-- memset(p, 0, final_size);
-+ memset(p, 0, size * nmemb);
- HANDLE_UNBLOCK_INTERRUPTIONS();
- return p;
- }
-
------------------------------------------------------------------------------
-
-Security Fix (CVE-2006-5178)
-
-Index: main/php_open_temporary_file.c
---- main/php_open_temporary_file.c.orig 2006-05-24 01:22:26 +0200
-+++ main/php_open_temporary_file.c 2006-10-17 08:26:02 +0200
-@@ -206,6 +206,7 @@
- PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char
**opened_path_p TSRMLS_DC)
- {
- int fd;
-+ const char *temp_dir;
-
- if (!pfx) {
- pfx = "tmp.";
-@@ -214,11 +215,22 @@
- *opened_path_p = NULL;
- }
-
-+ if (!dir || *dir == '\0') {
-+def_tmp:
-+ temp_dir = php_get_temporary_directory();
-+
-+ if (temp_dir && *temp_dir != '\0' &&
!php_check_open_basedir(temp_dir TSRMLS_CC)) {
-+ return php_do_open_temporary_file(temp_dir, pfx,
opened_path_p TSRMLS_CC);
-+ } else {
-+ return -1;
-+ }
-+ }
-+
- /* Try the directory given as parameter. */
- fd = php_do_open_temporary_file(dir, pfx, opened_path_p TSRMLS_CC);
- if (fd == -1) {
- /* Use default temporary directory. */
-- fd = php_do_open_temporary_file(php_get_temporary_directory(),
pfx, opened_path_p TSRMLS_CC);
-+ goto def_tmp;
- }
- return fd;
- }
@@ .
patch -p0 <<'@@ .'
Index: openpkg-src/apache/apache.spec
============================================================================
$ cvs diff -u -r1.335.2.8 -r1.335.2.9 apache.spec
--- openpkg-src/apache/apache.spec 3 Nov 2006 08:01:54 -0000
1.335.2.8
+++ openpkg-src/apache/apache.spec 3 Nov 2006 22:41:46 -0000
1.335.2.9
@@ -35,7 +35,7 @@
%define V_apache 1.3.37
%define V_mod_ssl 2.8.28-1.3.37
%define V_mod_perl 1.29
-%define V_mod_php 5.1.6
+%define V_mod_php 5.2.0
%define V_mod_php_hardened 5.1.6-0.4.15
%define V_mod_dav 1.0.3-1.3.6
%define V_mod_layout 3.2.1
@@ -489,7 +489,7 @@
prog apache:mod_security = {
version = %{V_mod_security}
url = http://www.modsecurity.org/download/
- regex = modsecurity-apache_(\d+\.\d+(\.\d+)*)\.tar\.gz
+ regex = modsecurity-apache_(1\.\d+(\.\d+)*)\.tar\.gz
}
prog apache:mod_evasive = {
version = %{V_mod_evasive}
@@ -532,7 +532,7 @@
ext/mssql/php_mssql.h
%endif
%if "%{with_mod_php_hardened}" == "yes"
- %patch -p0 -P 2
+ %patch -p1 -P 2
%endif
) || exit $?
%endif
@@ .
______________________________________________________________________
The OpenPKG Project www.openpkg.org
CVS Repository Commit List [email protected]
