summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2015-09-30 16:18:02 +0200
committerRemi Collet <fedora@famillecollet.com>2015-09-30 16:18:02 +0200
commitb5fcfe18f4462c30cbd7572e3f0e79201600e40f (patch)
tree9e4d4107bf72938a794036f7ba923d476e8f1b8a
parent2c516d16c73b1e19c6af984ae13cead3a4a8728b (diff)
PHP 5.4: backport fix for #70433 and #69720
-rw-r--r--bug69720.patch62
-rw-r--r--bug70433.patch52
-rw-r--r--php.spec21
3 files changed, 134 insertions, 1 deletions
diff --git a/bug69720.patch b/bug69720.patch
new file mode 100644
index 0000000..bfcd058
--- /dev/null
+++ b/bug69720.patch
@@ -0,0 +1,62 @@
+Backported from 5.5 for 5.4
+binary patch dropped
+
+
+From d698f0ae51f67c9cce870b09c59df3d6ba959244 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Mon, 28 Sep 2015 15:51:59 -0700
+Subject: [PATCH] Fix bug #69720: Null pointer dereference in
+ phar_get_fp_offset()
+
+---
+ ext/phar/tests/bug69720.phar | Bin 0 -> 8192 bytes
+ ext/phar/tests/bug69720.phpt | 40 ++++++++++++++++++++++++++++++++++++++++
+ ext/phar/util.c | 6 +++++-
+ 3 files changed, 45 insertions(+), 1 deletion(-)
+ create mode 100644 ext/phar/tests/bug69720.phar
+ create mode 100644 ext/phar/tests/bug69720.phpt
+
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+index 2c41adf..69da7b9 100644
+--- a/ext/phar/util.c
++++ b/ext/phar/util.c
+@@ -716,7 +716,11 @@ really_get_entry:
+ (*ret)->is_tar = entry->is_tar;
+ (*ret)->fp = phar_get_efp(entry, 1 TSRMLS_CC);
+ if (entry->link) {
+- (*ret)->zero = phar_get_fp_offset(phar_get_link_source(entry TSRMLS_CC) TSRMLS_CC);
++ phar_entry_info *link = phar_get_link_source(entry TSRMLS_CC);
++ if(!link) {
++ return FAILURE;
++ }
++ (*ret)->zero = phar_get_fp_offset(link TSRMLS_CC);
+ } else {
+ (*ret)->zero = phar_get_fp_offset(entry TSRMLS_CC);
+ }
+--
+2.1.4
+
+From f98ab19dc0c978e3caaa2614579e4a61f2c317f5 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Mon, 28 Sep 2015 20:43:18 -0700
+Subject: [PATCH] fix memory leak
+
+---
+ ext/phar/util.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+index 69da7b9..e7decda 100644
+--- a/ext/phar/util.c
++++ b/ext/phar/util.c
+@@ -718,6 +718,7 @@ really_get_entry:
+ if (entry->link) {
+ phar_entry_info *link = phar_get_link_source(entry TSRMLS_CC);
+ if(!link) {
++ efree(*ret);
+ return FAILURE;
+ }
+ (*ret)->zero = phar_get_fp_offset(link TSRMLS_CC);
+--
+2.1.4
+
diff --git a/bug70433.patch b/bug70433.patch
new file mode 100644
index 0000000..d4a4335
--- /dev/null
+++ b/bug70433.patch
@@ -0,0 +1,52 @@
+Backported from 5.5 for 5.4
+binary patch dropped
+
+
+From e78ac461dbefb7c4a3e9fde78d50fbc56b7b0183 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Mon, 28 Sep 2015 17:12:35 -0700
+Subject: [PATCH] FIx bug #70433 - Uninitialized pointer in phar_make_dirstream
+ when zip entry filename is "/"
+
+From 1ddf72180a52d247db88ea42a3e35f824a8fbda1 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Mon, 28 Sep 2015 21:37:26 -0700
+Subject: [PATCH] Better fix for bug #70433
+
+---
+ ext/phar/dirstream.c | 2 +-
+ ext/phar/util.c | 2 +-
+ ext/phar/zip.c | 4 +++-
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+index e7decda..303daed 100644
+--- a/ext/phar/util.c
++++ b/ext/phar/util.c
+@@ -2248,7 +2248,7 @@ void phar_add_virtual_dirs(phar_archive_data *phar, char *filename, int filename
+
+ while ((s = zend_memrchr(filename, '/', filename_len))) {
+ filename_len = s - filename;
+- if (FAILURE == zend_hash_add_empty_element(&phar->virtual_dirs, filename, filename_len)) {
++ if (!filename_len || FAILURE == zend_hash_add_empty_element(&phar->virtual_dirs, filename, filename_len)) {
+ break;
+ }
+ }
+diff --git a/ext/phar/zip.c b/ext/phar/zip.c
+index 142165c..e4883d3 100644
+--- a/ext/phar/zip.c
++++ b/ext/phar/zip.c
+@@ -396,7 +396,9 @@ foundit:
+
+ if (entry.filename[entry.filename_len - 1] == '/') {
+ entry.is_dir = 1;
+- entry.filename_len--;
++ if(entry.filename_len > 1) {
++ entry.filename_len--;
++ }
+ entry.flags |= PHAR_ENT_PERM_DEF_DIR;
+ } else {
+ entry.is_dir = 0;
+--
+2.1.4
+
diff --git a/php.spec b/php.spec
index 0ec2a2f..d7687db 100644
--- a/php.spec
+++ b/php.spec
@@ -119,7 +119,7 @@
Summary: PHP scripting language for creating dynamic web sites
Name: %{?scl_prefix}php
Version: 5.4.45
-Release: 1%{?dist}
+Release: 2%{?dist}
# All files licensed under PHP version 3.01, except
# Zend is licensed under Zend
# TSRM is licensed under BSD
@@ -177,6 +177,8 @@ Patch101: php-5.4.38-systemd.patch
Patch102: php-5.4.39-bug50444.patch
# Security fixes (200+)
+Patch200: bug69720.patch
+Patch201: bug70433.patch
# Fixes for tests (300+)
# Backported from 5.5
@@ -813,6 +815,8 @@ support for using the enchant library to PHP.
%patch102 -p1 -b .bug50444
# security patches
+%patch200 -p1 -b .bug69720
+%patch201 -p1 -b .bug70433
# Fixes for tests
%patch300 -p1 -b .datetests1
@@ -1463,6 +1467,16 @@ if [ -f /etc/rc.d/init.d/%{?scl_prefix}php-fpm ]; then
fi
%endif
+%pre common
+cat << EOF
+
+WARNING : PHP 5.4 have reached its "End of Life".
+Even, if this package includes some security fix, backported from 5.5,
+The upgrade to a maintained version is very strongly recommended.
+
+EOF
+
+
%{!?_licensedir:%global license %%doc}
%files
@@ -1617,6 +1631,11 @@ fi
%changelog
+* Wed Sep 30 2015 Remi Collet <remi@fedoraproject.org> 5.4.45-2
+- Fix bug #70433 - Uninitialized pointer in phar_make_dirstream
+ when zip entry filename is "/"
+- Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
+
* Wed Sep 2 2015 Remi Collet <remi@fedoraproject.org> 5.4.45-1
- Update to 5.4.45
http://www.php.net/releases/5_4_45.php