summaryrefslogtreecommitdiffstats
path: root/bug72479.patch
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2016-07-22 19:29:20 +0200
committerRemi Collet <fedora@famillecollet.com>2016-07-22 19:29:20 +0200
commit2f649ee4cbea50aaf88ae480ecfe36651dd135a2 (patch)
treea354b0289ff36de74a82652f9946413b6917dd95 /bug72479.patch
parentd3a4c0e1202c51c100fe28a60ed9beab1918de91 (diff)
PHP 5.4.45 with security fix from 5.5.38
Diffstat (limited to 'bug72479.patch')
-rw-r--r--bug72479.patch408
1 files changed, 408 insertions, 0 deletions
diff --git a/bug72479.patch b/bug72479.patch
new file mode 100644
index 0000000..6d459be
--- /dev/null
+++ b/bug72479.patch
@@ -0,0 +1,408 @@
+From cab1c3b3708eead315e033359d07049b23b147a3 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Sun, 26 Jun 2016 17:52:09 -0700
+Subject: [PATCH] Fixed bug #72479 - same as #72434
+
+---
+ ext/snmp/snmp.c | 89 ++++++++++++++++++++++++--------------------
+ ext/snmp/tests/bug72479.phpt | 35 +++++++++++++++++
+ 2 files changed, 84 insertions(+), 40 deletions(-)
+ create mode 100644 ext/snmp/tests/bug72479.phpt
+
+diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c
+index 6c1da4c..e1161c7 100644
+--- a/ext/snmp/snmp.c
++++ b/ext/snmp/snmp.c
+@@ -475,7 +475,7 @@ static void php_snmp_session_destructor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
+ static void php_snmp_object_free_storage(void *object TSRMLS_DC)
+ {
+ php_snmp_object *intern = (php_snmp_object *)object;
+-
++
+ if (!intern) {
+ return;
+ }
+@@ -483,7 +483,7 @@ static void php_snmp_object_free_storage(void *object TSRMLS_DC)
+ netsnmp_session_free(&(intern->session));
+
+ zend_object_std_dtor(&intern->zo TSRMLS_CC);
+-
++
+ efree(intern);
+ }
+
+@@ -503,7 +503,7 @@ static zend_object_value php_snmp_object_new(zend_class_entry *class_type TSRMLS
+ retval.handlers = (zend_object_handlers *) &php_snmp_object_handlers;
+
+ return retval;
+-
++
+ }
+
+ /* {{{ php_snmp_error
+@@ -556,7 +556,7 @@ static void php_snmp_getvalue(struct variable_list *vars, zval *snmpval TSRMLS_D
+ char *dbuf = (char *)NULL;
+ int buflen = sizeof(sbuf) - 1;
+ int val_len = vars->val_len;
+-
++
+ /* use emalloc() for large values, use static array otherwize */
+
+ /* There is no way to know the size of buffer snprint_value() needs in order to print a value there.
+@@ -702,7 +702,7 @@ static void php_snmp_getvalue(struct variable_list *vars, zval *snmpval TSRMLS_D
+ * SNMP object fetcher/setter for all SNMP versions
+ *
+ */
+-static void php_snmp_internal(INTERNAL_FUNCTION_PARAMETERS, int st,
++static void php_snmp_internal(INTERNAL_FUNCTION_PARAMETERS, int st,
+ struct snmp_session *session,
+ struct objid_query *objid_query)
+ {
+@@ -721,7 +721,7 @@ static void php_snmp_internal(INTERNAL_FUNCTION_PARAMETERS, int st,
+
+ /* we start with retval=FALSE. If any actual data is acquired, retval will be set to appropriate type */
+ RETVAL_FALSE;
+-
++
+ /* reset errno and errstr */
+ php_snmp_error(getThis(), NULL TSRMLS_CC, PHP_SNMP_ERRNO_NOERROR, "");
+
+@@ -805,8 +805,8 @@ retry:
+ }
+ for (vars = response->variables; vars; vars = vars->next_variable) {
+ /* do not output errors as values */
+- if ( vars->type == SNMP_ENDOFMIBVIEW ||
+- vars->type == SNMP_NOSUCHOBJECT ||
++ if ( vars->type == SNMP_ENDOFMIBVIEW ||
++ vars->type == SNMP_NOSUCHOBJECT ||
+ vars->type == SNMP_NOSUCHINSTANCE ) {
+ if ((st & SNMP_CMD_WALK) && Z_TYPE_P(return_value) == IS_ARRAY) {
+ break;
+@@ -816,8 +816,8 @@ retry:
+ php_snmp_error(getThis(), NULL TSRMLS_CC, PHP_SNMP_ERRNO_ERROR_IN_REPLY, "Error in packet at '%s': %s", buf, buf2);
+ continue;
+ }
+-
+- if ((st & SNMP_CMD_WALK) &&
++
++ if ((st & SNMP_CMD_WALK) &&
+ (vars->name_length < rootlen || memcmp(root, vars->name, rootlen * sizeof(oid)))) { /* not part of this subtree */
+ if (Z_TYPE_P(return_value) == IS_ARRAY) { /* some records are fetched already, shut down further lookup */
+ keepwalking = 0;
+@@ -1101,7 +1101,7 @@ static int php_snmp_parse_oid(zval *object, int st, struct objid_query *objid_qu
+ efree(objid_query->vars);
+ return FALSE;
+ }
+- } else {
++ } else {
+ memmove((char *)objid_query->vars[0].name, (char *)objid_mib, sizeof(objid_mib));
+ objid_query->vars[0].name_length = sizeof(objid_mib) / sizeof(oid);
+ }
+@@ -1437,7 +1437,7 @@ static void php_snmp(INTERNAL_FUNCTION_PARAMETERS, int st, int version)
+ int session_less_mode = (getThis() == NULL);
+ php_snmp_object *snmp_object;
+ php_snmp_object glob_snmp_object;
+-
++
+ objid_query.max_repetitions = -1;
+ objid_query.non_repeaters = 0;
+ objid_query.valueretrieval = SNMP_G(valueretrieval);
+@@ -1550,7 +1550,7 @@ static void php_snmp(INTERNAL_FUNCTION_PARAMETERS, int st, int version)
+ }
+
+ php_snmp_internal(INTERNAL_FUNCTION_PARAM_PASSTHRU, st, session, &objid_query);
+-
++
+ efree(objid_query.vars);
+
+ if (session_less_mode) {
+@@ -1563,7 +1563,7 @@ static void php_snmp(INTERNAL_FUNCTION_PARAMETERS, int st, int version)
+ }
+ /* }}} */
+
+-/* {{{ proto mixed snmpget(string host, string community, mixed object_id [, int timeout [, int retries]])
++/* {{{ proto mixed snmpget(string host, string community, mixed object_id [, int timeout [, int retries]])
+ Fetch a SNMP object */
+ PHP_FUNCTION(snmpget)
+ {
+@@ -1571,7 +1571,7 @@ PHP_FUNCTION(snmpget)
+ }
+ /* }}} */
+
+-/* {{{ proto mixed snmpgetnext(string host, string community, mixed object_id [, int timeout [, int retries]])
++/* {{{ proto mixed snmpgetnext(string host, string community, mixed object_id [, int timeout [, int retries]])
+ Fetch a SNMP object */
+ PHP_FUNCTION(snmpgetnext)
+ {
+@@ -1579,7 +1579,7 @@ PHP_FUNCTION(snmpgetnext)
+ }
+ /* }}} */
+
+-/* {{{ proto mixed snmpwalk(string host, string community, mixed object_id [, int timeout [, int retries]])
++/* {{{ proto mixed snmpwalk(string host, string community, mixed object_id [, int timeout [, int retries]])
+ Return all objects under the specified object id */
+ PHP_FUNCTION(snmpwalk)
+ {
+@@ -1595,7 +1595,7 @@ PHP_FUNCTION(snmprealwalk)
+ }
+ /* }}} */
+
+-/* {{{ proto bool snmpset(string host, string community, mixed object_id, mixed type, mixed value [, int timeout [, int retries]])
++/* {{{ proto bool snmpset(string host, string community, mixed object_id, mixed type, mixed value [, int timeout [, int retries]])
+ Set the value of a SNMP object */
+ PHP_FUNCTION(snmpset)
+ {
+@@ -1642,7 +1642,7 @@ PHP_FUNCTION(snmp_set_enum_print)
+
+ netsnmp_ds_set_boolean(NETSNMP_DS_LIBRARY_ID, NETSNMP_DS_LIB_PRINT_NUMERIC_ENUM, (int) a1);
+ RETURN_TRUE;
+-}
++}
+ /* }}} */
+
+ /* {{{ proto bool snmp_set_oid_output_format(int oid_format)
+@@ -1670,10 +1670,10 @@ PHP_FUNCTION(snmp_set_oid_output_format)
+ RETURN_FALSE;
+ break;
+ }
+-}
++}
+ /* }}} */
+
+-/* {{{ proto mixed snmp2_get(string host, string community, mixed object_id [, int timeout [, int retries]])
++/* {{{ proto mixed snmp2_get(string host, string community, mixed object_id [, int timeout [, int retries]])
+ Fetch a SNMP object */
+ PHP_FUNCTION(snmp2_get)
+ {
+@@ -1681,7 +1681,7 @@ PHP_FUNCTION(snmp2_get)
+ }
+ /* }}} */
+
+-/* {{{ proto mixed snmp2_getnext(string host, string community, mixed object_id [, int timeout [, int retries]])
++/* {{{ proto mixed snmp2_getnext(string host, string community, mixed object_id [, int timeout [, int retries]])
+ Fetch a SNMP object */
+ PHP_FUNCTION(snmp2_getnext)
+ {
+@@ -1689,7 +1689,7 @@ PHP_FUNCTION(snmp2_getnext)
+ }
+ /* }}} */
+
+-/* {{{ proto mixed snmp2_walk(string host, string community, mixed object_id [, int timeout [, int retries]])
++/* {{{ proto mixed snmp2_walk(string host, string community, mixed object_id [, int timeout [, int retries]])
+ Return all objects under the specified object id */
+ PHP_FUNCTION(snmp2_walk)
+ {
+@@ -1705,7 +1705,7 @@ PHP_FUNCTION(snmp2_real_walk)
+ }
+ /* }}} */
+
+-/* {{{ proto bool snmp2_set(string host, string community, mixed object_id, mixed type, mixed value [, int timeout [, int retries]])
++/* {{{ proto bool snmp2_set(string host, string community, mixed object_id, mixed type, mixed value [, int timeout [, int retries]])
+ Set the value of a SNMP object */
+ PHP_FUNCTION(snmp2_set)
+ {
+@@ -1821,7 +1821,7 @@ PHP_METHOD(snmp, __construct)
+
+ snmp_object = (php_snmp_object *)zend_object_store_get_object(object TSRMLS_CC);
+ zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
+-
++
+ if (zend_parse_parameters(argc TSRMLS_CC, "lss|ll", &version, &a1, &a1_len, &a2, &a2_len, &timeout, &retries) == FAILURE) {
+ zend_restore_error_handling(&error_handling TSRMLS_CC);
+ return;
+@@ -1843,7 +1843,7 @@ PHP_METHOD(snmp, __construct)
+ if (snmp_object->session) {
+ netsnmp_session_free(&(snmp_object->session));
+ }
+-
++
+ if (netsnmp_session_init(&(snmp_object->session), version, a1, a2, timeout, retries TSRMLS_CC)) {
+ return;
+ }
+@@ -1857,7 +1857,7 @@ PHP_METHOD(snmp, __construct)
+ }
+ /* }}} */
+
+-/* {{{ proto bool SNMP::close()
++/* {{{ proto bool SNMP::close()
+ Close SNMP session */
+ PHP_METHOD(snmp, close)
+ {
+@@ -1900,7 +1900,7 @@ PHP_METHOD(snmp, walk)
+ }
+ /* }}} */
+
+-/* {{{ proto bool SNMP::set(mixed object_id, mixed type, mixed value)
++/* {{{ proto bool SNMP::set(mixed object_id, mixed type, mixed value)
+ Set the value of a SNMP object */
+ PHP_METHOD(snmp, set)
+ {
+@@ -1918,7 +1918,7 @@ PHP_METHOD(snmp, setSecurity)
+ int argc = ZEND_NUM_ARGS();
+
+ snmp_object = (php_snmp_object *)zend_object_store_get_object(object TSRMLS_CC);
+-
++
+ if (zend_parse_parameters(argc TSRMLS_CC, "s|ssssss", &a1, &a1_len, &a2, &a2_len, &a3, &a3_len,
+ &a4, &a4_len, &a5, &a5_len, &a6, &a6_len, &a7, &a7_len) == FAILURE) {
+ RETURN_FALSE;
+@@ -1932,7 +1932,7 @@ PHP_METHOD(snmp, setSecurity)
+ }
+ /* }}} */
+
+-/* {{{ proto long SNMP::getErrno()
++/* {{{ proto long SNMP::getErrno()
+ Get last error code number */
+ PHP_METHOD(snmp, getErrno)
+ {
+@@ -1946,7 +1946,7 @@ PHP_METHOD(snmp, getErrno)
+ }
+ /* }}} */
+
+-/* {{{ proto long SNMP::getError()
++/* {{{ proto long SNMP::getError()
+ Get last error message */
+ PHP_METHOD(snmp, getError)
+ {
+@@ -2095,6 +2095,14 @@ static int php_snmp_has_property(zval *object, zval *member, int has_set_exists,
+ }
+ /* }}} */
+
++static HashTable *php_snmp_get_gc(zval *object, zval ***gc_data, int *gc_data_count TSRMLS_DC) /* {{{ */
++{
++ *gc_data = NULL;
++ *gc_data_count = 0;
++ return zend_std_get_properties(object TSRMLS_CC);
++}
++/* }}} */
++
+ /* {{{ php_snmp_get_properties(zval *object)
+ Returns all object properties. Injects SNMP properties into object on first call */
+ static HashTable *php_snmp_get_properties(zval *object TSRMLS_DC)
+@@ -2137,23 +2145,23 @@ static int php_snmp_read_info(php_snmp_object *snmp_object, zval **retval TSRMLS
+ if (snmp_object->session == NULL) {
+ return SUCCESS;
+ }
+-
++
+ MAKE_STD_ZVAL(val);
+ ZVAL_STRINGL(val, snmp_object->session->peername, strlen(snmp_object->session->peername), 1);
+ add_assoc_zval(*retval, "hostname", val);
+-
++
+ MAKE_STD_ZVAL(val);
+ ZVAL_LONG(val, snmp_object->session->remote_port);
+ add_assoc_zval(*retval, "port", val);
+-
++
+ MAKE_STD_ZVAL(val);
+ ZVAL_LONG(val, snmp_object->session->timeout);
+ add_assoc_zval(*retval, "timeout", val);
+-
++
+ MAKE_STD_ZVAL(val);
+ ZVAL_LONG(val, snmp_object->session->retries);
+ add_assoc_zval(*retval, "retries", val);
+-
++
+ return SUCCESS;
+ }
+ /* }}} */
+@@ -2226,7 +2234,7 @@ static int php_snmp_write_max_oids(php_snmp_object *snmp_object, zval *newval TS
+ } else {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "max_oids should be positive integer or NULL, got %ld", Z_LVAL_P(newval));
+ }
+-
++
+ if (newval == &ztmp) {
+ zval_dtor(newval);
+ }
+@@ -2254,7 +2262,7 @@ static int php_snmp_write_valueretrieval(php_snmp_object *snmp_object, zval *new
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown SNMP value retrieval method '%ld'", Z_LVAL_P(newval));
+ ret = FAILURE;
+ }
+-
++
+ if (newval == &ztmp) {
+ zval_dtor(newval);
+ }
+@@ -2297,7 +2305,7 @@ static int php_snmp_write_oid_output_format(php_snmp_object *snmp_object, zval *
+ convert_to_long(&ztmp);
+ newval = &ztmp;
+ }
+-
++
+ switch(Z_LVAL_P(newval)) {
+ case NETSNMP_OID_OUTPUT_SUFFIX:
+ case NETSNMP_OID_OUTPUT_MODULE:
+@@ -2332,7 +2340,7 @@ static int php_snmp_write_exceptions_enabled(php_snmp_object *snmp_object, zval
+ newval = &ztmp;
+ }
+
+- snmp_object->exceptions_enabled = Z_LVAL_P(newval);
++ snmp_object->exceptions_enabled = Z_LVAL_P(newval);
+
+ if (newval == &ztmp) {
+ zval_dtor(newval);
+@@ -2401,6 +2409,7 @@ PHP_MINIT_FUNCTION(snmp)
+ php_snmp_object_handlers.write_property = php_snmp_write_property;
+ php_snmp_object_handlers.has_property = php_snmp_has_property;
+ php_snmp_object_handlers.get_properties = php_snmp_get_properties;
++ php_snmp_object_handlers.get_gc = php_snmp_get_gc;
+
+ /* Register SNMP Class */
+ INIT_CLASS_ENTRY(ce, "SNMP", php_snmp_class_methods);
+@@ -2467,7 +2476,7 @@ PHP_MINIT_FUNCTION(snmp)
+ PHP_MSHUTDOWN_FUNCTION(snmp)
+ {
+ snmp_shutdown("snmpapp");
+-
++
+ zend_hash_destroy(&php_snmp_properties);
+
+ return SUCCESS;
+diff --git a/ext/snmp/tests/bug72479.phpt b/ext/snmp/tests/bug72479.phpt
+new file mode 100644
+index 0000000..0308754
+--- /dev/null
++++ b/ext/snmp/tests/bug72479.phpt
+@@ -0,0 +1,35 @@
++--TEST--
++Bug #72479: Use After Free Vulnerability in SNMP with GC and unserialize()
++--SKIPIF--
++<?php
++require_once(dirname(__FILE__).'/skipif.inc');
++?>
++--FILE--
++<?php
++$arr = [1, [1, 2, 3, 4, 5], 3, 4, 5];
++$poc = 'a:3:{i:1;N;i:2;O:4:"snmp":1:{s:11:"quick_print";'.serialize($arr).'}i:1;R:7;}';
++$out = unserialize($poc);
++gc_collect_cycles();
++$fakezval = ptr2str(1122334455);
++$fakezval .= ptr2str(0);
++$fakezval .= "\x00\x00\x00\x00";
++$fakezval .= "\x01";
++$fakezval .= "\x00";
++$fakezval .= "\x00\x00";
++for ($i = 0; $i < 5; $i++) {
++ $v[$i] = $fakezval.$i;
++}
++var_dump($out[1]);
++
++function ptr2str($ptr)
++{
++ $out = '';
++ for ($i = 0; $i < 8; $i++) {
++ $out .= chr($ptr & 0xff);
++ $ptr >>= 8;
++ }
++ return $out;
++}
++?>
++--EXPECT--
++int(1)
+\ No newline at end of file
+--
+2.1.4
+