Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=ab1dcbee16b5a71a1863a88b5721f08aa7730db7
commit ab1dcbee16b5a71a1863a88b5721f08aa7730db7 Author: kikadf <[email protected]> Date: Thu Mar 13 10:30:33 2014 +0100 php-5.3.26-2-x86_64 * Fix CVE-2013-4113, CVE-2013-4248, CVE-2013-6420, CVE-2013-6712, * CVE-2014-1943 diff --git a/source/devel/php/CVE-2013-4113.patch b/source/devel/php/CVE-2013-4113.patch new file mode 100644 index 0000000..107e2f8 --- /dev/null +++ b/source/devel/php/CVE-2013-4113.patch @@ -0,0 +1,142 @@ +From 7d163e8a0880ae8af2dd869071393e5dc07ef271 Mon Sep 17 00:00:00 2001 +From: Rob Richards <[email protected]> +Date: Sat, 6 Jul 2013 07:53:07 -0400 +Subject: [PATCH] truncate results at depth of 255 to prevent corruption + +--- + ext/xml/xml.c | 90 +++++++++++++++++++++++++++++++++-------------------------- + 1 file changed, 50 insertions(+), 40 deletions(-) + +--- php5-squeeze.orig/ext/xml/xml.c ++++ php5-squeeze/ext/xml/xml.c +@@ -427,7 +427,7 @@ static void xml_parser_dtor(zend_rsrc_li + } + if (parser->ltags) { + int inx; +- for (inx = 0; inx < parser->level; inx++) ++ for (inx = 0; ((inx < parser->level) && (inx < XML_MAXLEVEL)); inx++) + efree(parser->ltags[ inx ]); + efree(parser->ltags); + } +@@ -905,45 +905,50 @@ void _xml_startElementHandler(void *user + } + + if (parser->data) { +- zval *tag, *atr; +- int atcnt = 0; ++ if (parser->level <= XML_MAXLEVEL) { ++ zval *tag, *atr; ++ int atcnt = 0; + +- MAKE_STD_ZVAL(tag); +- MAKE_STD_ZVAL(atr); ++ MAKE_STD_ZVAL(tag); ++ MAKE_STD_ZVAL(atr); + +- array_init(tag); +- array_init(atr); ++ array_init(tag); ++ array_init(atr); + +- _xml_add_to_info(parser,((char *) tag_name) + parser->toffset); ++ _xml_add_to_info(parser,((char *) tag_name) + parser->toffset); + +- add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */ +- add_assoc_string(tag,"type","open",1); +- add_assoc_long(tag,"level",parser->level); ++ add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */ ++ add_assoc_string(tag,"type","open",1); ++ add_assoc_long(tag,"level",parser->level); + +- parser->ltags[parser->level-1] = estrdup(tag_name); +- parser->lastwasopen = 1; ++ parser->ltags[parser->level-1] = estrdup(tag_name); ++ parser->lastwasopen = 1; + +- attributes = (const XML_Char **) attrs; ++ attributes = (const XML_Char **) attrs; + +- while (attributes && *attributes) { +- att = _xml_decode_tag(parser, attributes[0]); +- val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding); +- +- add_assoc_stringl(atr,att,val,val_len,0); ++ while (attributes && *attributes) { ++ att = _xml_decode_tag(parser, attributes[0]); ++ val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding); + +- atcnt++; +- attributes += 2; ++ add_assoc_stringl(atr,att,val,val_len,0); + +- efree(att); +- } ++ atcnt++; ++ attributes += 2; + +- if (atcnt) { +- zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL); +- } else { +- zval_ptr_dtor(&atr); +- } ++ efree(att); ++ } ++ ++ if (atcnt) { ++ zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL); ++ } else { ++ zval_ptr_dtor(&atr); ++ } + +- zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag); ++ zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag); ++ } else if (parser->level == (XML_MAXLEVEL + 1)) { ++ TSRMLS_FETCH(); ++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated"); ++ } + } + + efree(tag_name); +@@ -995,7 +1000,7 @@ void _xml_endElementHandler(void *userDa + + efree(tag_name); + +- if (parser->ltags) { ++ if ((parser->ltags) && (parser->level <= XML_MAXLEVEL)) { + efree(parser->ltags[parser->level-1]); + } + +@@ -1079,18 +1084,23 @@ void _xml_characterDataHandler(void *use + } + } + +- MAKE_STD_ZVAL(tag); +- +- array_init(tag); +- +- _xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset); ++ if (parser->level <= XML_MAXLEVEL) { ++ MAKE_STD_ZVAL(tag); + +- add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1); +- add_assoc_string(tag,"value",decoded_value,0); +- add_assoc_string(tag,"type","cdata",1); +- add_assoc_long(tag,"level",parser->level); ++ array_init(tag); + +- zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL); ++ _xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset); ++ ++ add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1); ++ add_assoc_string(tag,"value",decoded_value,0); ++ add_assoc_string(tag,"type","cdata",1); ++ add_assoc_long(tag,"level",parser->level); ++ ++ zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL); ++ } else if (parser->level == (XML_MAXLEVEL + 1)) { ++ TSRMLS_FETCH(); ++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated"); ++ } + } + } else { + efree(decoded_value); diff --git a/source/devel/php/CVE-2013-4248.patch b/source/devel/php/CVE-2013-4248.patch new file mode 100644 index 0000000..d20d8d1 --- /dev/null +++ b/source/devel/php/CVE-2013-4248.patch @@ -0,0 +1,176 @@ +From dcea4ec698dcae39b7bba6f6aa08933cbfee6755 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <[email protected]> +Date: Tue, 13 Aug 2013 22:20:33 -0700 +Subject: [PATCH] Fix CVE-2013-4073 - handling of certs with null bytes + +--- + ext/openssl/openssl.c | 86 ++++++++++++++++++++++++++++++++++++- + ext/openssl/tests/cve2013_4073.pem | 28 ++++++++++++ + ext/openssl/tests/cve2013_4073.phpt | 19 ++++++++ + 4 files changed, 135 insertions(+), 2 deletions(-) + create mode 100644 ext/openssl/tests/cve2013_4073.pem + create mode 100644 ext/openssl/tests/cve2013_4073.phpt + +--- php5.orig/ext/openssl/openssl.c ++++ php5/ext/openssl/openssl.c +@@ -1325,6 +1325,74 @@ PHP_FUNCTION(openssl_x509_check_private_ + } + /* }}} */ + ++/* Special handling of subjectAltName, see CVE-2013-4073 ++ * Christian Heimes ++ */ ++ ++static int openssl_x509v3_subjectAltName(BIO *bio, X509_EXTENSION *extension) ++{ ++ GENERAL_NAMES *names; ++ const X509V3_EXT_METHOD *method = NULL; ++ long i, length, num; ++ const unsigned char *p; ++ ++ method = X509V3_EXT_get(extension); ++ if (method == NULL) { ++ return -1; ++ } ++ ++ p = extension->value->data; ++ length = extension->value->length; ++ if (method->it) { ++ names = (GENERAL_NAMES*)(ASN1_item_d2i(NULL, &p, length, ++ ASN1_ITEM_ptr(method->it))); ++ } else { ++ names = (GENERAL_NAMES*)(method->d2i(NULL, &p, length)); ++ } ++ if (names == NULL) { ++ return -1; ++ } ++ ++ num = sk_GENERAL_NAME_num(names); ++ for (i = 0; i < num; i++) { ++ GENERAL_NAME *name; ++ ASN1_STRING *as; ++ name = sk_GENERAL_NAME_value(names, i); ++ switch (name->type) { ++ case GEN_EMAIL: ++ BIO_puts(bio, "email:"); ++ as = name->d.rfc822Name; ++ BIO_write(bio, ASN1_STRING_data(as), ++ ASN1_STRING_length(as)); ++ break; ++ case GEN_DNS: ++ BIO_puts(bio, "DNS:"); ++ as = name->d.dNSName; ++ BIO_write(bio, ASN1_STRING_data(as), ++ ASN1_STRING_length(as)); ++ break; ++ case GEN_URI: ++ BIO_puts(bio, "URI:"); ++ as = name->d.uniformResourceIdentifier; ++ BIO_write(bio, ASN1_STRING_data(as), ++ ASN1_STRING_length(as)); ++ break; ++ default: ++ /* use builtin print for GEN_OTHERNAME, GEN_X400, ++ * GEN_EDIPARTY, GEN_DIRNAME, GEN_IPADD and GEN_RID ++ */ ++ GENERAL_NAME_print(bio, name); ++ } ++ /* trailing ', ' except for last element */ ++ if (i < (num - 1)) { ++ BIO_puts(bio, ", "); ++ } ++ } ++ sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free); ++ ++ return 0; ++} ++ + /* {{{ proto array openssl_x509_parse(mixed x509 [, bool shortnames=true]) + Returns an array of the fields/values of the CERT */ + PHP_FUNCTION(openssl_x509_parse) +@@ -1421,15 +1489,30 @@ PHP_FUNCTION(openssl_x509_parse) + + + for (i = 0; i < X509_get_ext_count(cert); i++) { ++ int nid; + extension = X509_get_ext(cert, i); +- if (OBJ_obj2nid(X509_EXTENSION_get_object(extension)) != NID_undef) { ++ nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension)); ++ if (nid != NID_undef) { + extname = (char *)OBJ_nid2sn(OBJ_obj2nid(X509_EXTENSION_get_object(extension))); + } else { + OBJ_obj2txt(buf, sizeof(buf)-1, X509_EXTENSION_get_object(extension), 1); + extname = buf; + } + bio_out = BIO_new(BIO_s_mem()); +- if (X509V3_EXT_print(bio_out, extension, 0, 0)) { ++ if (nid == NID_subject_alt_name) { ++ if (openssl_x509v3_subjectAltName(bio_out, extension) == 0) { ++ BIO_get_mem_ptr(bio_out, &bio_buf); ++ add_assoc_stringl(subitem, extname, bio_buf->data, bio_buf->length, 1); ++ } else { ++ zval_dtor(return_value); ++ if (certresource == -1 && cert) { ++ X509_free(cert); ++ } ++ BIO_free(bio_out); ++ RETURN_FALSE; ++ } ++ } ++ else if (X509V3_EXT_print(bio_out, extension, 0, 0)) { + BIO_get_mem_ptr(bio_out, &bio_buf); + add_assoc_stringl(subitem, extname, bio_buf->data, bio_buf->length, 1); + } else { +--- /dev/null ++++ php5/ext/openssl/tests/cve2013_4073.pem +@@ -0,0 +1,28 @@ ++-----BEGIN CERTIFICATE----- ++MIIE2DCCA8CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBxTELMAkGA1UEBhMCVVMx ++DzANBgNVBAgMBk9yZWdvbjESMBAGA1UEBwwJQmVhdmVydG9uMSMwIQYDVQQKDBpQ ++eXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEgMB4GA1UECwwXUHl0aG9uIENvcmUg ++RGV2ZWxvcG1lbnQxJDAiBgNVBAMMG251bGwucHl0aG9uLm9yZwBleGFtcGxlLm9y ++ZzEkMCIGCSqGSIb3DQEJARYVcHl0aG9uLWRldkBweXRob24ub3JnMB4XDTEzMDgw ++NzEzMTE1MloXDTEzMDgwNzEzMTI1MlowgcUxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI ++DAZPcmVnb24xEjAQBgNVBAcMCUJlYXZlcnRvbjEjMCEGA1UECgwaUHl0aG9uIFNv ++ZnR3YXJlIEZvdW5kYXRpb24xIDAeBgNVBAsMF1B5dGhvbiBDb3JlIERldmVsb3Bt ++ZW50MSQwIgYDVQQDDBtudWxsLnB5dGhvbi5vcmcAZXhhbXBsZS5vcmcxJDAiBgkq ++hkiG9w0BCQEWFXB5dGhvbi1kZXZAcHl0aG9uLm9yZzCCASIwDQYJKoZIhvcNAQEB ++BQADggEPADCCAQoCggEBALXq7cn7Rn1vO3aA3TrzA5QLp6bb7B3f/yN0CJ2XFj+j ++pHs+Gw6WWSUDpybiiKnPec33BFawq3kyblnBMjBU61ioy5HwQqVkJ8vUVjGIUq3P ++vX/wBmQfzCe4o4uM89gpHyUL9UYGG8oCRa17dgqcv7u5rg0Wq2B1rgY+nHwx3JIv ++KRrgSwyRkGzpN8WQ1yrXlxWjgI9de0mPVDDUlywcWze1q2kwaEPTM3hLAmD1PESA ++oY/n8A/RXoeeRs9i/Pm/DGUS8ZPINXk/yOzsR/XvvkTVroIeLZqfmFpnZeF0cHzL ++08LODkVJJ9zjLdT7SA4vnne4FEbAxDbKAq5qkYzaL4UCAwEAAaOB0DCBzTAMBgNV ++HRMBAf8EAjAAMB0GA1UdDgQWBBSIWlXAUv9hzVKjNQ/qWpwkOCL3XDALBgNVHQ8E ++BAMCBeAwgZAGA1UdEQSBiDCBhYIeYWx0bnVsbC5weXRob24ub3JnAGV4YW1wbGUu ++Y29tgSBudWxsQHB5dGhvbi5vcmcAdXNlckBleGFtcGxlLm9yZ4YpaHR0cDovL251 ++bGwucHl0aG9uLm9yZwBodHRwOi8vZXhhbXBsZS5vcmeHBMAAAgGHECABDbgAAAAA ++AAAAAAAAAAEwDQYJKoZIhvcNAQEFBQADggEBAKxPRe99SaghcI6IWT7UNkJw9aO9 ++i9eo0Fj2MUqxpKbdb9noRDy2CnHWf7EIYZ1gznXPdwzSN4YCjV5d+Q9xtBaowT0j ++HPERs1ZuytCNNJTmhyqZ8q6uzMLoht4IqH/FBfpvgaeC5tBTnTT0rD5A/olXeimk ++kX4LxlEx5RAvpGB2zZVRGr6LobD9rVK91xuHYNIxxxfEGE8tCCWjp0+3ksri9SXx ++VHWBnbM9YaL32u3hxm8sYB/Yb8WSBavJCWJJqRStVRHM1koZlJmXNx2BX4vPo6iW ++RFEIPQsFZRLrtnCAiEhyT8bC2s/Njlu6ly9gtJZWSV46Q3ZjBL4q9sHKqZQ= ++-----END CERTIFICATE----- +--- /dev/null ++++ php5/ext/openssl/tests/cve2013_4073.phpt +@@ -0,0 +1,19 @@ ++--TEST-- ++CVE 2013-4073: Null-byte certificate handling ++--SKIPIF-- ++<?php ++if (!extension_loaded("openssl")) die("skip"); ++--FILE-- ++<?php ++$cert = file_get_contents(__DIR__ . '/cve2013_4073.pem'); ++$info = openssl_x509_parse($cert); ++var_export($info['extensions']); ++ ++--EXPECTF-- ++array ( ++ 'basicConstraints' => 'CA:FALSE', ++ 'subjectKeyIdentifier' => '88:5A:55:C0:52:FF:61:CD:52:A3:35:0F:EA:5A:9C:24:38:22:F7:5C', ++ 'keyUsage' => 'Digital Signature, Non Repudiation, Key Encipherment', ++ 'subjectAltName' => 'DNS:altnull.python.org' . "\0" . 'example.com, email:[email protected]' . "\0" . '[email protected], URI:http://null.python.org' . "\0" . 'http://example.org, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1 ++', ++) diff --git a/source/devel/php/CVE-2013-6420.patch b/source/devel/php/CVE-2013-6420.patch new file mode 100644 index 0000000..3c2f9f4 --- /dev/null +++ b/source/devel/php/CVE-2013-6420.patch @@ -0,0 +1,102 @@ +From c1224573c773b6845e83505f717fbf820fc18415 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <[email protected]> +Date: Sun, 8 Dec 2013 11:40:18 -0800 +Subject: [PATCH] Fix CVE-2013-6420 - memory corruption in openssl_x509_parse + +--- + NEWS | 4 +++- + ext/openssl/openssl.c | 18 ++++++++++++++---- + ext/openssl/tests/cve-2013-6420.crt | 29 +++++++++++++++++++++++++++++ + ext/openssl/tests/cve-2013-6420.phpt | 18 ++++++++++++++++++ + 4 files changed, 64 insertions(+), 5 deletions(-) + create mode 100644 ext/openssl/tests/cve-2013-6420.crt + create mode 100644 ext/openssl/tests/cve-2013-6420.phpt + +--- php5.orig/ext/openssl/openssl.c ++++ php5/ext/openssl/openssl.c +@@ -644,18 +644,28 @@ static time_t asn1_time_to_time_t(ASN1_U + char * thestr; + long gmadjust = 0; + +- if (timestr->length < 13) { +- php_error_docref(NULL TSRMLS_CC, E_WARNING, "extension author too lazy to parse %s correctly", timestr->data); ++ if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME) { ++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal ASN1 data type for timestamp"); + return (time_t)-1; + } + +- strbuf = estrdup((char *)timestr->data); ++ if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) { ++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp"); ++ return (time_t)-1; ++ } ++ ++ if (ASN1_STRING_length(timestr) < 13) { ++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to parse time string %s correctly", timestr->data); ++ return (time_t)-1; ++ } ++ ++ strbuf = estrdup((char *)ASN1_STRING_data(timestr)); + + memset(&thetime, 0, sizeof(thetime)); + + /* we work backwards so that we can use atoi more easily */ + +- thestr = strbuf + timestr->length - 3; ++ thestr = strbuf + ASN1_STRING_length(timestr) - 3; + + thetime.tm_sec = atoi(thestr); + *thestr = '\0'; +--- /dev/null ++++ php5/ext/openssl/tests/cve-2013-6420.crt +@@ -0,0 +1,29 @@ ++-----BEGIN CERTIFICATE----- ++MIIEpDCCA4ygAwIBAgIJAJzu8r6u6eBcMA0GCSqGSIb3DQEBBQUAMIHDMQswCQYD ++VQQGEwJERTEcMBoGA1UECAwTTm9yZHJoZWluLVdlc3RmYWxlbjEQMA4GA1UEBwwH ++S8ODwrZsbjEUMBIGA1UECgwLU2VrdGlvbkVpbnMxHzAdBgNVBAsMFk1hbGljaW91 ++cyBDZXJ0IFNlY3Rpb24xITAfBgNVBAMMGG1hbGljaW91cy5zZWt0aW9uZWlucy5k ++ZTEqMCgGCSqGSIb3DQEJARYbc3RlZmFuLmVzc2VyQHNla3Rpb25laW5zLmRlMHUY ++ZDE5NzAwMTAxMDAwMDAwWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ++AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ++AAAAAAAXDTE0MTEyODExMzkzNVowgcMxCzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNO ++b3JkcmhlaW4tV2VzdGZhbGVuMRAwDgYDVQQHDAdLw4PCtmxuMRQwEgYDVQQKDAtT ++ZWt0aW9uRWluczEfMB0GA1UECwwWTWFsaWNpb3VzIENlcnQgU2VjdGlvbjEhMB8G ++A1UEAwwYbWFsaWNpb3VzLnNla3Rpb25laW5zLmRlMSowKAYJKoZIhvcNAQkBFhtz ++dGVmYW4uZXNzZXJAc2VrdGlvbmVpbnMuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IB ++DwAwggEKAoIBAQDDAf3hl7JY0XcFniyEJpSSDqn0OqBr6QP65usJPRt/8PaDoqBu ++wEYT/Na+6fsgPjC0uK9DZgWg2tHWWoanSblAMoz5PH6Z+S4SHRZ7e2dDIjPjdhjh ++0mLg2UMO5yp0V797Ggs9lNt6JRfH81MN2obXWs4NtztLMuD6egqpr8dDbr34aOs8 ++pkdui5UawTZksy5pLPHq5cMhFGm06v65CLo0V2Pd9+KAokPrPcN5KLKebz7mLpk6 ++SMeEXOKP4idEqxyQ7O7fBuHMedsQhu+prY3si3BUyKfQtP5CZnX2bp0wKHxX12DX ++1nfFIt9DbGvHTcyOuN+nZLPBm3vWxntyIIvVAgMBAAGjQjBAMAkGA1UdEwQCMAAw ++EQYJYIZIAYb4QgEBBAQDAgeAMAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggrBgEF ++BQcDAjANBgkqhkiG9w0BAQUFAAOCAQEAG0fZYYCTbdj1XYc+1SnoaPR+vI8C8CaD ++8+0UYhdnyU4gga0BAcDrY9e94eEAu6ZqycF6FjLqXXdAboppWocr6T6GD1x33Ckl ++VArzG/KxQohGD2JeqkhIMlDomxHO7ka39+Oa8i2vWLVyjU8AZvWMAruHa4EENyG7 ++lW2AagaFKFCr9TnXTfrdxGVEbv7KVQ6bdhg5p5SjpWH1+Mq03uR3ZXPBYdyV8319 ++o0lVj1KFI2DCL/liWisJRoof+1cR35Ctd0wYBcpB6TZslMcOPl76dwKwJgeJo2Qg ++Zsfmc2vC1/qOlNuNq/0TzzkVGv8ETT3CgaU+UXe4XOVvkccebJn2dg== ++-----END CERTIFICATE----- ++ ++ +--- /dev/null ++++ php5/ext/openssl/tests/cve-2013-6420.phpt +@@ -0,0 +1,18 @@ ++--TEST-- ++CVE-2013-6420 ++--SKIPIF-- ++<?php ++if (!extension_loaded("openssl")) die("skip"); ++?> ++--FILE-- ++<?php ++$crt = substr(__FILE__, 0, -4).'.crt'; ++$info = openssl_x509_parse("file://$crt"); ++var_dump($info['issuer']['emailAddress'], $info["validFrom_time_t"]); ++?> ++Done ++--EXPECTF-- ++%s openssl_x509_parse(): illegal ASN1 data type for timestamp in %s%ecve-2013-6420.php on line 3 ++string(27) "[email protected]" ++int(-1) ++Done diff --git a/source/devel/php/CVE-2013-6712.patch b/source/devel/php/CVE-2013-6712.patch new file mode 100644 index 0000000..8e316d7 --- /dev/null +++ b/source/devel/php/CVE-2013-6712.patch @@ -0,0 +1,33 @@ +From 12fe4e90be7bfa2a763197079f68f5568a14e071 Mon Sep 17 00:00:00 2001 +From: Remi Collet <[email protected]> +Date: Wed, 27 Nov 2013 11:13:16 +0100 +Subject: [PATCH] Fixed bug #66060 (Heap buffer over-read in DateInterval) + +--- + NEWS | 3 +++ + ext/date/lib/parse_iso_intervals.c | 4 ++-- + ext/date/lib/parse_iso_intervals.re | 2 +- + 3 files changed, 6 insertions(+), 3 deletions(-) + +--- php5.orig/ext/date/lib/parse_iso_intervals.c ++++ php5/ext/date/lib/parse_iso_intervals.c +@@ -415,7 +415,7 @@ yy6: + break; + } + ptr++; +- } while (*ptr); ++ } while (!s->errors->error_count && *ptr); + s->have_period = 1; + TIMELIB_DEINIT; + return TIMELIB_PERIOD; +--- php5.orig/ext/date/lib/parse_iso_intervals.re ++++ php5/ext/date/lib/parse_iso_intervals.re +@@ -383,7 +383,7 @@ isoweek = year4 "-"? "W" weekof + break; + } + ptr++; +- } while (*ptr); ++ } while (!s->errors->error_count && *ptr); + s->have_period = 1; + TIMELIB_DEINIT; + return TIMELIB_PERIOD; diff --git a/source/devel/php/CVE-2014-1943.patch b/source/devel/php/CVE-2014-1943.patch new file mode 100644 index 0000000..794ba00 --- /dev/null +++ b/source/devel/php/CVE-2014-1943.patch @@ -0,0 +1,139 @@ +Upstream-Author: Christos Zoulas <[email protected]> +Description: + prevent infinite recursion. + count indirect recursion as recursion. + +Upstream commit IDs: + 3c081560c23f20b2985c285338b52c7aae9fdb0f + cc9e74dfeca5265ad725acc926ef0b8d2a18ee70 + +Backport for 5.11: Christoph Biedl <[email protected]> + +--- php5.orig/ext/fileinfo/libmagic/softmagic.c ++++ php5/ext/fileinfo/libmagic/softmagic.c +@@ -48,9 +48,9 @@ FILE_RCSID("@(#)$File: softmagic.c,v 1.1 + + + private int match(struct magic_set *, struct magic *, uint32_t, +- const unsigned char *, size_t, int, int); ++ const unsigned char *, size_t, int, int, int); + private int mget(struct magic_set *, const unsigned char *, +- struct magic *, size_t, unsigned int, int); ++ struct magic *, size_t, unsigned int, int, int); + private int magiccheck(struct magic_set *, struct magic *); + private int32_t mprint(struct magic_set *, struct magic *); + private int32_t moffset(struct magic_set *, struct magic *); +@@ -72,13 +72,13 @@ private void cvt_64(union VALUETYPE *, c + /*ARGSUSED1*/ /* nbytes passed for regularity, maybe need later */ + protected int + file_softmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes, +- int mode, int text) ++ size_t level, int mode, int text) + { + struct mlist *ml; + int rv; + for (ml = ms->mlist->next; ml != ms->mlist; ml = ml->next) + if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes, mode, +- text)) != 0) ++ text, level)) != 0) + return rv; + + return 0; +@@ -113,7 +113,8 @@ file_softmagic(struct magic_set *ms, con + */ + private int + match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, +- const unsigned char *s, size_t nbytes, int mode, int text) ++ const unsigned char *s, size_t nbytes, int mode, int text, ++ int recursion_level) + { + uint32_t magindex = 0; + unsigned int cont_level = 0; +@@ -145,7 +146,7 @@ match(struct magic_set *ms, struct magic + ms->line = m->lineno; + + /* if main entry matches, print it... */ +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -227,7 +228,7 @@ match(struct magic_set *ms, struct magic + continue; + } + #endif +- switch (mget(ms, s, m, nbytes, cont_level, text)) { ++ switch (mget(ms, s, m, nbytes, cont_level, text, recursion_level + 1)) { + case -1: + return -1; + case 0: +@@ -997,12 +998,18 @@ mcopy(struct magic_set *ms, union VALUET + + private int + mget(struct magic_set *ms, const unsigned char *s, +- struct magic *m, size_t nbytes, unsigned int cont_level, int text) ++ struct magic *m, size_t nbytes, unsigned int cont_level, int text, ++ int recursion_level) + { + uint32_t offset = ms->offset; + uint32_t count = m->str_range; + union VALUETYPE *p = &ms->ms_value; + ++ if (recursion_level >= 20) { ++ file_error(ms, 0, "recursion nesting exceeded"); ++ return -1; ++ } ++ + if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1) + return -1; + +@@ -1550,13 +1557,15 @@ mget(struct magic_set *ms, const unsigne + break; + + case FILE_INDIRECT: ++ if (offset == 0) ++ return 0; + if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 && + file_printf(ms, "%s", m->desc) == -1) + return -1; + if (nbytes < offset) + return 0; + return file_softmagic(ms, s + offset, nbytes - offset, +- BINTEST, text); ++ recursion_level, BINTEST, text); + + case FILE_DEFAULT: /* nothing to check */ + default: +--- php5.orig/ext/fileinfo/libmagic/ascmagic.c ++++ php5/ext/fileinfo/libmagic/ascmagic.c +@@ -145,7 +145,7 @@ file_ascmagic_with_encoding(struct magic + == NULL) + goto done; + if ((rv = file_softmagic(ms, utf8_buf, +- (size_t)(utf8_end - utf8_buf), TEXTTEST, text)) == 0) ++ (size_t)(utf8_end - utf8_buf), 0, TEXTTEST, text)) == 0) + rv = -1; + } + +--- php5.orig/ext/fileinfo/libmagic/file.h ++++ php5/ext/fileinfo/libmagic/file.h +@@ -414,7 +414,7 @@ protected int file_encoding(struct magic + unichar **, size_t *, const char **, const char **, const char **); + protected int file_is_tar(struct magic_set *, const unsigned char *, size_t); + protected int file_softmagic(struct magic_set *, const unsigned char *, size_t, +- int, int); ++ size_t, int, int); + protected struct mlist *file_apprentice(struct magic_set *, const char *, int); + protected uint64_t file_signextend(struct magic_set *, struct magic *, + uint64_t); +--- php5.orig/ext/fileinfo/libmagic/funcs.c ++++ php5/ext/fileinfo/libmagic/funcs.c +@@ -235,7 +235,7 @@ file_buffer(struct magic_set *ms, php_st + + /* try soft magic tests */ + if ((ms->flags & MAGIC_NO_CHECK_SOFT) == 0) +- if ((m = file_softmagic(ms, ubuf, nb, BINTEST, ++ if ((m = file_softmagic(ms, ubuf, nb, 0, BINTEST, + looks_text)) != 0) { + if ((ms->flags & MAGIC_DEBUG) != 0) + (void)fprintf(stderr, "softmagic %d\n", m); diff --git a/source/devel/php/FrugalBuild b/source/devel/php/FrugalBuild index 2a54521..fe87e79 100644 --- a/source/devel/php/FrugalBuild +++ b/source/devel/php/FrugalBuild @@ -4,7 +4,7 @@ pkgname=php pkgver=5.3.26 -pkgrel=1 +pkgrel=2 pkgdesc="A widely-used general-purpose scripting language" url="http://www.php.net"; backup=(etc/{php.ini,httpd/conf/modules.d/$pkgname.conf}) @@ -16,8 +16,15 @@ makedepends=('apache' 'imap>=2006k-2' 'bzip2' 'mta' 'tidy=1306.g4387491' 'freetd groups=('devel') archs=('i686' 'x86_64') up2date="lynx -dump http://www.php.net/downloads.php | grep 'Complete Source Code' -B2 | awk '/stable/ {print \$2}'" -source=(http://www.php.net/distributions/$pkgname-$pkgver.tar.gz \ +#source=(http://www.php.net/distributions/$pkgname-$pkgver.tar.gz \ +source=(http://museum.php.net/php5/$pkgname-$pkgver.tar.gz \ autoconf_259.patch php.ini php.conf README.Frugalware phpize.in.patch) +sha1sums=('99e8094051f94b0a03b05fa9d4cbe0794ee3ac4f' \ + 'c99534745f4dee26446c9e6f42e35a0c85ce961b' \ + '9249ca52e57a3069befe20311fd02fc8bee7aeef' \ + '0850ef23512a02e8460dc36f08f453d148dcd9df' \ + '40ae88f0721e02a2c75de76be342c51c85bf734d' \ + '4c598e1c8683518090f7a0e9fef01c57593137c8') subpkgs=("$pkgname-cgi") suboptions=('nodocs') ## its depends on PHP and the same files are installed etc @@ -26,6 +33,18 @@ subrodepends=("$pkgname=$pkgver") subgroups=('devel-extra') subarchs=('i686 x86_64') + +# FSA fix *** +source=(${source[@]} CVE-2013-4113.patch CVE-2013-4248.patch CVE-2013-6420.patch \ + CVE-2013-6712.patch CVE-2014-1943.patch) +sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ + 'b75fe24356d0e6c5d375c4d2d2315f17d5e34e31' \ + '805231398c06b27e4e1f8c18ce9d6aed7b06382d' \ + '0e2ad0691c8a4bbb128d978f21f79e36df1a0bf5' \ + 'ff4c9a129952081b9db72f5b941f6ffc53a6213d') +# *********** + + build() { ## the php config @@ -141,12 +160,6 @@ build() Fln /usr/share/libtool/config/ltmain.sh /usr/lib/php/build/ltmain.sh Fln /usr/share/aclocal/libtool.m4 /usr/lib/php/build/libtool.m4 } -sha1sums=('99e8094051f94b0a03b05fa9d4cbe0794ee3ac4f' \ - 'c99534745f4dee26446c9e6f42e35a0c85ce961b' \ - '9249ca52e57a3069befe20311fd02fc8bee7aeef' \ - '0850ef23512a02e8460dc36f08f453d148dcd9df' \ - '40ae88f0721e02a2c75de76be342c51c85bf734d' \ - '4c598e1c8683518090f7a0e9fef01c57593137c8') # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
