Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=9be682ec34df191543bd35779efd8f7f4f768063
commit 9be682ec34df191543bd35779efd8f7f4f768063 Author: kikadf <[email protected]> Date: Thu Aug 21 16:27:33 2014 +0200 php-5.3.26-2arcturus5-x86_64 * Fix CVE-2014-3538, CVE-3587, CVE-2014-4670 diff --git a/source/devel/php/CVE-2014-3538.patch b/source/devel/php/CVE-2014-3538.patch new file mode 100644 index 0000000..00d1818 --- /dev/null +++ b/source/devel/php/CVE-2014-3538.patch @@ -0,0 +1,97 @@ +--- php5.orig/ext/fileinfo/libmagic/softmagic.c ++++ php5/ext/fileinfo/libmagic/softmagic.c +@@ -56,7 +56,7 @@ private int32_t mprint(struct magic_set + private int32_t moffset(struct magic_set *, struct magic *); + private void mdebug(uint32_t, const char *, size_t); + private int mcopy(struct magic_set *, union VALUETYPE *, int, int, +- const unsigned char *, uint32_t, size_t, size_t); ++ const unsigned char *, uint32_t, size_t, struct magic *); + private int mconvert(struct magic_set *, struct magic *); + private int print_sep(struct magic_set *, int); + private int handle_annotation(struct magic_set *, struct magic *); +@@ -898,7 +898,7 @@ mdebug(uint32_t offset, const char *str, + + private int + mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir, +- const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt) ++ const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m) + { + /* + * Note: FILE_SEARCH and FILE_REGEX do not actually copy +@@ -918,15 +918,24 @@ mcopy(struct magic_set *ms, union VALUET + const char *last; /* end of search region */ + const char *buf; /* start of search region */ + const char *end; +- size_t lines; ++ size_t lines, linecnt, bytecnt; + ++ linecnt = m->str_range; ++ bytecnt = linecnt * 80; ++ ++ if (bytecnt == 0) { ++ bytecnt = 8192; ++ } ++ if (bytecnt > nbytes) { ++ bytecnt = nbytes; ++ } + if (s == NULL) { + ms->search.s_len = 0; + ms->search.s = NULL; + return 0; + } + buf = RCAST(const char *, s) + offset; +- end = last = RCAST(const char *, s) + nbytes; ++ end = last = RCAST(const char *, s) + bytecnt; + /* mget() guarantees buf <= last */ + for (lines = linecnt, b = buf; lines && b < end && + ((b = CAST(const char *, +@@ -939,7 +948,7 @@ mcopy(struct magic_set *ms, union VALUET + b++; + } + if (lines) +- last = RCAST(const char *, s) + nbytes; ++ last = RCAST(const char *, s) + bytecnt; + + ms->search.s = buf; + ms->search.s_len = last - buf; +@@ -1012,7 +1021,6 @@ mget(struct magic_set *ms, const unsigne + int recursion_level) + { + uint32_t offset = ms->offset; +- uint32_t count = m->str_range; + union VALUETYPE *p = &ms->ms_value; + + if (recursion_level >= 20) { +@@ -1020,10 +1028,13 @@ mget(struct magic_set *ms, const unsigne + return -1; + } + +- if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1) ++ if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, ++ (uint32_t)nbytes, m) == -1) + return -1; + + if ((ms->flags & MAGIC_DEBUG) != 0) { ++ fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, " ++ "nbytes=%zu)\n", m->type, m->flag, offset, nbytes); + mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE)); + } + +@@ -1504,7 +1515,7 @@ mget(struct magic_set *ms, const unsigne + if (m->flag & INDIROFFADD) { + offset += ms->c.li[cont_level-1].off; + } +- if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1) ++ if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1) + return -1; + ms->offset = offset; + +@@ -1906,7 +1917,7 @@ magiccheck(struct magic_set *ms, struct + zval *retval; + zval *subpats; + char *haystack; +- ++ + MAKE_STD_ZVAL(retval); + ALLOC_INIT_ZVAL(subpats); + diff --git a/source/devel/php/CVE-2014-3587.patch b/source/devel/php/CVE-2014-3587.patch new file mode 100644 index 0000000..40ee64e --- /dev/null +++ b/source/devel/php/CVE-2014-3587.patch @@ -0,0 +1,21 @@ +From 9217c8d8e3760a9747311727f49150af84f189a4 Mon Sep 17 00:00:00 2001 +From: Remi Collet <[email protected]> +Date: Tue, 29 Jul 2014 13:06:17 +0200 +Subject: [PATCH] fix possible pointer overflow + +Signed-off-by: Remi Collet <[email protected]> +--- + src/cdf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- php5.orig/ext/fileinfo/libmagic/cdf.c ++++ php5/ext/fileinfo/libmagic/cdf.c +@@ -820,7 +820,7 @@ cdf_read_property_info(const cdf_stream_ + q = (const uint8_t *)(const void *) + ((const char *)(const void *)p + ofs + - 2 * sizeof(uint32_t)); +- if (q > e) { ++ if (q < p || q > e) { + DPRINTF(("Ran of the end %p > %p\n", q, e)); + goto out; + } diff --git a/source/devel/php/CVE-2014-3597.patch b/source/devel/php/CVE-2014-3597.patch new file mode 100644 index 0000000..fae3f72 --- /dev/null +++ b/source/devel/php/CVE-2014-3597.patch @@ -0,0 +1,270 @@ +From 2fefae47716d501aec41c1102f3fd4531f070b05 Mon Sep 17 00:00:00 2001 +From: Remi Collet <[email protected]> +Date: Tue, 19 Aug 2014 08:33:49 +0200 +Subject: [PATCH] Fixed Sec Bug #67717 segfault in dns_get_record CVE-2014-3597 + +Incomplete fix for CVE-2014-4049 + +Check possible buffer overflow +- pass real buffer end to dn_expand calls +- check buffer len before each read +--- + ext/standard/dns.c | 84 ++++++++++++++++++++++++++++++++++++++---------------- + 1 file changed, 60 insertions(+), 24 deletions(-) + +--- php5.orig/ext/standard/dns.c ++++ php5/ext/standard/dns.c +@@ -412,8 +412,14 @@ PHP_FUNCTION(dns_check_record) + + #if HAVE_FULL_DNS_FUNCS + ++#define CHECKCP(n) do { \ ++ if (cp + n > end) { \ ++ return NULL; \ ++ } \ ++} while (0) ++ + /* {{{ php_parserr */ +-static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int store, int raw, zval **subarray) ++static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_to_fetch, int store, int raw, zval **subarray) + { + u_short type, class, dlen; + u_long ttl; +@@ -425,16 +431,18 @@ static u_char *php_parserr(u_char *cp, q + + *subarray = NULL; + +- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, sizeof(name) - 2); ++ n = dn_expand(answer->qb2, end, cp, name, sizeof(name) - 2); + if (n < 0) { + return NULL; + } + cp += n; + ++ CHECKCP(10); + GETSHORT(type, cp); + GETSHORT(class, cp); + GETLONG(ttl, cp); + GETSHORT(dlen, cp); ++ CHECKCP(dlen); + if (type_to_fetch != T_ANY && type != type_to_fetch) { + cp += dlen; + return cp; +@@ -461,12 +469,14 @@ static u_char *php_parserr(u_char *cp, q + + switch (type) { + case DNS_T_A: ++ CHECKCP(4); + add_assoc_string(*subarray, "type", "A", 1); + snprintf(name, sizeof(name), "%d.%d.%d.%d", cp[0], cp[1], cp[2], cp[3]); + add_assoc_string(*subarray, "ip", name, 1); + cp += dlen; + break; + case DNS_T_MX: ++ CHECKCP(2); + add_assoc_string(*subarray, "type", "MX", 1); + GETSHORT(n, cp); + add_assoc_long(*subarray, "pri", n); +@@ -485,7 +495,7 @@ static u_char *php_parserr(u_char *cp, q + if (type == DNS_T_PTR) { + add_assoc_string(*subarray, "type", "PTR", 1); + } +- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2); ++ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2); + if (n < 0) { + return NULL; + } +@@ -495,18 +505,22 @@ static u_char *php_parserr(u_char *cp, q + case DNS_T_HINFO: + /* See RFC 1010 for values */ + add_assoc_string(*subarray, "type", "HINFO", 1); ++ CHECKCP(1); + n = *cp & 0xFF; + cp++; ++ CHECKCP(n); + add_assoc_stringl(*subarray, "cpu", (char*)cp, n, 1); + cp += n; ++ CHECKCP(1); + n = *cp & 0xFF; + cp++; ++ CHECKCP(n); + add_assoc_stringl(*subarray, "os", (char*)cp, n, 1); + cp += n; + break; + case DNS_T_TXT: + { +- int ll = 0; ++ int l1 = 0, l2 = 0; + zval *entries = NULL; + + add_assoc_string(*subarray, "type", "TXT", 1); +@@ -515,37 +529,41 @@ static u_char *php_parserr(u_char *cp, q + MAKE_STD_ZVAL(entries); + array_init(entries); + +- while (ll < dlen) { +- n = cp[ll]; +- if ((ll + n) >= dlen) { ++ while (l1 < dlen) { ++ n = cp[l1]; ++ if ((l1 + n) >= dlen) { + // Invalid chunk length, truncate +- n = dlen - (ll + 1); ++ n = dlen - (l1 + 1); ++ } ++ if (n) { ++ memcpy(tp + l2 , cp + l1 + 1, n); ++ add_next_index_stringl(entries, cp + l1 + 1, n, 1); + } +- memcpy(tp + ll , cp + ll + 1, n); +- add_next_index_stringl(entries, cp + ll + 1, n, 1); +- ll = ll + n + 1; ++ l1 = l1 + n + 1; ++ l2 = l2 + n; + } +- tp[dlen] = '\0'; ++ tp[l2] = '\0'; + cp += dlen; + +- add_assoc_stringl(*subarray, "txt", tp, dlen - 1, 0); ++ add_assoc_stringl(*subarray, "txt", tp, l2, 0); + add_assoc_zval(*subarray, "entries", entries); + } + break; + case DNS_T_SOA: + add_assoc_string(*subarray, "type", "SOA", 1); +- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) -2); ++ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2); + if (n < 0) { + return NULL; + } + cp += n; + add_assoc_string(*subarray, "mname", name, 1); +- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) -2); ++ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2); + if (n < 0) { + return NULL; + } + cp += n; + add_assoc_string(*subarray, "rname", name, 1); ++ CHECKCP(5*4); + GETLONG(n, cp); + add_assoc_long(*subarray, "serial", n); + GETLONG(n, cp); +@@ -559,6 +577,7 @@ static u_char *php_parserr(u_char *cp, q + break; + case DNS_T_AAAA: + tp = (u_char*)name; ++ CHECKCP(8*2); + for(i=0; i < 8; i++) { + GETSHORT(s, cp); + if (s != 0) { +@@ -593,6 +612,7 @@ static u_char *php_parserr(u_char *cp, q + case DNS_T_A6: + p = cp; + add_assoc_string(*subarray, "type", "A6", 1); ++ CHECKCP(1); + n = ((int)cp[0]) & 0xFF; + cp++; + add_assoc_long(*subarray, "masklen", n); +@@ -628,6 +648,7 @@ static u_char *php_parserr(u_char *cp, q + cp++; + } + for (i = (n + 8) / 16; i < 8; i++) { ++ CHECKCP(2); + GETSHORT(s, cp); + if (s != 0) { + if (tp > (u_char *)name) { +@@ -657,7 +678,7 @@ static u_char *php_parserr(u_char *cp, q + tp[0] = '\0'; + add_assoc_string(*subarray, "ipv6", name, 1); + if (cp < p + dlen) { +- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2); ++ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2); + if (n < 0) { + return NULL; + } +@@ -666,6 +687,7 @@ static u_char *php_parserr(u_char *cp, q + } + break; + case DNS_T_SRV: ++ CHECKCP(3*2); + add_assoc_string(*subarray, "type", "SRV", 1); + GETSHORT(n, cp); + add_assoc_long(*subarray, "pri", n); +@@ -673,7 +695,7 @@ static u_char *php_parserr(u_char *cp, q + add_assoc_long(*subarray, "weight", n); + GETSHORT(n, cp); + add_assoc_long(*subarray, "port", n); +- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2); ++ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2); + if (n < 0) { + return NULL; + } +@@ -681,21 +703,35 @@ static u_char *php_parserr(u_char *cp, q + add_assoc_string(*subarray, "target", name, 1); + break; + case DNS_T_NAPTR: ++ CHECKCP(2*2); + add_assoc_string(*subarray, "type", "NAPTR", 1); + GETSHORT(n, cp); + add_assoc_long(*subarray, "order", n); + GETSHORT(n, cp); + add_assoc_long(*subarray, "pref", n); ++ ++ CHECKCP(1); + n = (cp[0] & 0xFF); +- add_assoc_stringl(*subarray, "flags", (char*)++cp, n, 1); ++ cp++; ++ CHECKCP(n); ++ add_assoc_stringl(*subarray, "flags", (char*)cp, n, 1); + cp += n; ++ ++ CHECKCP(1); + n = (cp[0] & 0xFF); +- add_assoc_stringl(*subarray, "services", (char*)++cp, n, 1); ++ cp++; ++ CHECKCP(n); ++ add_assoc_stringl(*subarray, "services", (char*)cp, n, 1); + cp += n; ++ ++ CHECKCP(1); + n = (cp[0] & 0xFF); +- add_assoc_stringl(*subarray, "regex", (char*)++cp, n, 1); ++ cp++; ++ CHECKCP(n); ++ add_assoc_stringl(*subarray, "regex", (char*)cp, n, 1); + cp += n; +- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2); ++ ++ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2); + if (n < 0) { + return NULL; + } +@@ -888,7 +924,7 @@ PHP_FUNCTION(dns_get_record) + while (an-- && cp && cp < end) { + zval *retval; + +- cp = php_parserr(cp, &answer, type_to_fetch, store_results, raw, &retval); ++ cp = php_parserr(cp, end, &answer, type_to_fetch, store_results, raw, &retval); + if (retval != NULL && store_results) { + add_next_index_zval(return_value, retval); + } +@@ -901,7 +937,7 @@ PHP_FUNCTION(dns_get_record) + while (ns-- > 0 && cp && cp < end) { + zval *retval = NULL; + +- cp = php_parserr(cp, &answer, DNS_T_ANY, authns != NULL, raw, &retval); ++ cp = php_parserr(cp, end, &answer, DNS_T_ANY, authns != NULL, raw, &retval); + if (retval != NULL) { + add_next_index_zval(authns, retval); + } +@@ -913,7 +949,7 @@ PHP_FUNCTION(dns_get_record) + while (ar-- > 0 && cp && cp < end) { + zval *retval = NULL; + +- cp = php_parserr(cp, &answer, DNS_T_ANY, 1, raw, &retval); ++ cp = php_parserr(cp, end, &answer, DNS_T_ANY, 1, raw, &retval); + if (retval != NULL) { + add_next_index_zval(addtl, retval); + } diff --git a/source/devel/php/CVE-2014-4670.patch b/source/devel/php/CVE-2014-4670.patch new file mode 100644 index 0000000..3cc2f05 --- /dev/null +++ b/source/devel/php/CVE-2014-4670.patch @@ -0,0 +1,47 @@ +--- php5.orig/ext/spl/spl_dllist.c ++++ php5/ext/spl/spl_dllist.c +@@ -43,12 +43,10 @@ PHPAPI zend_class_entry *spl_ce_SplStac + + #define SPL_LLIST_DELREF(elem) if(!--(elem)->rc) { \ + efree(elem); \ +- elem = NULL; \ + } + + #define SPL_LLIST_CHECK_DELREF(elem) if((elem) && !--(elem)->rc) { \ + efree(elem); \ +- elem = NULL; \ + } + + #define SPL_LLIST_ADDREF(elem) (elem)->rc++ +@@ -916,6 +914,11 @@ SPL_METHOD(SplDoublyLinkedList, offsetUn + llist->dtor(element TSRMLS_CC); + } + ++ if (intern->traverse_pointer == element) { ++ SPL_LLIST_DELREF(element); ++ intern->traverse_pointer = NULL; ++ } ++ + zval_ptr_dtor((zval **)&element->data); + element->data = NULL; + +--- /dev/null ++++ php5/ext/spl/tests/bug67538.phpt +@@ -0,0 +1,17 @@ ++--TEST-- ++Bug #67538 (SPL Iterators use-after-free) ++--FILE-- ++<?php ++$list = new SplDoublyLinkedList(); ++$list->push('a'); ++$list->push('b'); ++ ++$list->rewind(); ++$list->offsetUnset(0); ++$list->push('b'); ++$list->offsetUnset(0); ++$list->next(); ++echo "okey"; ++?> ++--EXPECTF-- ++okey diff --git a/source/devel/php/FrugalBuild b/source/devel/php/FrugalBuild index 2e81490..5e58f5a 100644 --- a/source/devel/php/FrugalBuild +++ b/source/devel/php/FrugalBuild @@ -4,7 +4,7 @@ pkgname=php pkgver=5.3.26 -pkgrel=2arcturus4 +pkgrel=2arcturus5 pkgdesc="A widely-used general-purpose scripting language" url="http://www.php.net"; backup=(etc/{php.ini,httpd/conf/modules.d/$pkgname.conf}) @@ -38,9 +38,10 @@ subarchs=('i686 x86_64') source=(${source[@]} CVE-2013-4113.patch CVE-2013-4248.patch CVE-2013-6420.patch CVE-2013-6712.patch CVE-2014-1943.patch CVE-2014-0185.patch CVE-2014-0237.patch CVE-2014-0238.patch CVE-2014-2270.patch - CVE-2014-4049.patch CVE-2014-0207.patch CVE-2014-3478.patch + CVE-2014-0207.patch CVE-2014-3478.patch CVE-2014-3479.patch CVE-2014-3480.patch CVE-2014-3487.patch - CVE-2014-4721.patch) + CVE-2014-4721.patch CVE-2014-3538.patch CVE-2014-3587.patch + CVE-2014-4670.patch CVE-2014-4049.patch) sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ 'b75fe24356d0e6c5d375c4d2d2315f17d5e34e31' \ '805231398c06b27e4e1f8c18ce9d6aed7b06382d' \ @@ -50,13 +51,16 @@ sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ '9fd5280138a6a9d8bfa4c5239f9451869985de35' \ '2c0db438c6773d5bc9d1af3b637c4d8cd93bf4e7' \ 'e2c4c40700c1004c4924abc329fc4f75030350e0' \ - 'a3fa0995e26e03681f0ce20289587645e6a4e401' \ '547c48428d7d772a6d12000ca09808a5beb149bc' \ 'f2937c031002888fdd5b56070b58d2c0e860b4c4' \ '205f1a29dc6f097a25171ded7ae69b291c2d98b3' \ '267fc9f6e12f03d41640e890173867b3aa05144c' \ 'd34955143d655b5a1496b2f939630e978529b4b6' \ - '72da3715195108595959c27ddace6822534bb765') + '72da3715195108595959c27ddace6822534bb765' \ + 'f3b972bb901f0f3b41ae3c53dee2160fbcd55eec' \ + '4739e1eab6f4522d91ecb05492e0430fbd28f42e' \ + '7c6563c4a60582a0ff32353e93cd6dfd2eeaa042' \ + 'a3fa0995e26e03681f0ce20289587645e6a4e401') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
