summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRemi Collet <remi@remirepo.net>2023-06-21 10:35:54 +0200
committerRemi Collet <remi@php.net>2023-06-21 10:35:54 +0200
commit9cce51403ccd8617d6348a15ca8642bcd76cc6ce (patch)
tree17994dce92c03d805b2d01f7636478dbc9ca0482
parentf4871e69a193dd95dc9814dd01a82f433e8eead0 (diff)
fix possible buffer overflow in date
define %php71___phpize and %php71___phpconfig
-rw-r--r--macros.php4
-rw-r--r--php-7.1.0-systzdata-v14.patch2
-rw-r--r--php-cve-2023-3247.patch (renamed from php-ghsa-76gg-c692-v2mw.patch)27
-rw-r--r--php.spec124
4 files changed, 96 insertions, 61 deletions
diff --git a/macros.php b/macros.php
index 3943a74..d3e937f 100644
--- a/macros.php
+++ b/macros.php
@@ -14,3 +14,7 @@
%@SCL@__php @BINDIR@/php
+%@SCL@__phpize @BINDIR@/phpize
+
+%@SCL@__phpconfig @BINDIR@/php-config
+
diff --git a/php-7.1.0-systzdata-v14.patch b/php-7.1.0-systzdata-v14.patch
index bd73a4b..1ab782b 100644
--- a/php-7.1.0-systzdata-v14.patch
+++ b/php-7.1.0-systzdata-v14.patch
@@ -392,7 +392,7 @@ diff -up php-7.1.0RC4/ext/date/lib/parse_tz.c.systzdata php-7.1.0RC4/ext/date/li
+ size_t n;
+ char *data, *p;
+
-+ data = malloc(3 * sysdb->index_size + 7);
++ data = malloc(3 * sysdb->index_size + sizeof(FAKE_HEADER) - 1);
+
+ p = mempcpy(data, FAKE_HEADER, sizeof(FAKE_HEADER) - 1);
+
diff --git a/php-ghsa-76gg-c692-v2mw.patch b/php-cve-2023-3247.patch
index 21b5b65..4d66794 100644
--- a/php-ghsa-76gg-c692-v2mw.patch
+++ b/php-cve-2023-3247.patch
@@ -123,3 +123,30 @@ index 9e5ecf6d22..2f281dd7db 100644
static char *get_http_header_value(char *headers, char *type);
static zend_string *get_http_body(php_stream *socketd, int close, char *headers);
+From fe8af503fd954396ad061ceecf470e93f490d467 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Thu, 15 Jun 2023 08:47:55 +0200
+Subject: [PATCH] add cve
+
+(cherry picked from commit f3021d66d7bb42d2578530cc94f9bde47e58eb10)
+---
+ NEWS | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/NEWS b/NEWS
+index 534c4787b4..e7cdaa7698 100644
+--- a/NEWS
++++ b/NEWS
+@@ -5,7 +5,8 @@ Backported from 8.0.29
+
+ - Soap:
+ . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
+- bytes in HTTP Digest authentication for SOAP). (nielsdos, timwolla)
++ bytes in HTTP Digest authentication for SOAP).
++ (CVE-2023-3247) (nielsdos, timwolla)
+
+ Backported from 8.0.28
+
+--
+2.40.1
+
diff --git a/php.spec b/php.spec
index a3bfff0..3489684 100644
--- a/php.spec
+++ b/php.spec
@@ -126,7 +126,7 @@
Summary: PHP scripting language for creating dynamic web sites
Name: %{?scl_prefix}php
Version: %{upver}%{?rcver:~%{rcver}}
-Release: 25%{?dist}
+Release: 26%{?dist}
# All files licensed under PHP version 3.01, except
# Zend is licensed under Zend
# TSRM is licensed under BSD
@@ -227,7 +227,7 @@ Patch234: php-bug81740.patch
Patch235: php-bug81744.patch
Patch236: php-bug81746.patch
Patch237: php-cve-2023-0662.patch
-Patch238: php-ghsa-76gg-c692-v2mw.patch
+Patch238: php-cve-2023-3247.patch
# Fixes for tests (300+)
# Factory is droped from system tzdata
@@ -930,84 +930,84 @@ support for JavaScript Object Notation (JSON) to PHP.
%setup -q -n php-%{upver}%{?rcver}
%endif
-%patch1 -p1 -b .mpmcheck
-%patch2 -p1 -b .true
-%patch5 -p1 -b .includedir
-%patch6 -p1 -b .embed
-%patch7 -p1 -b .recode
-%patch8 -p1 -b .libdb
+%patch -P1 -p1 -b .mpmcheck
+%patch -P2 -p1 -b .true
+%patch -P5 -p1 -b .includedir
+%patch -P6 -p1 -b .embed
+%patch -P7 -p1 -b .recode
+%patch -P8 -p1 -b .libdb
%if 0%{?rhel}
-%patch9 -p1 -b .curltls
+%patch -P9 -p1 -b .curltls
%endif
-%patch10 -p1 -b .nodes
+%patch -P10 -p1 -b .nodes
-%patch40 -p1 -b .dlopen
+%patch -P40 -p1 -b .dlopen
%if 0%{?fedora} >= 25 || 0%{?rhel} >= 6
-%patch42 -p1 -b .systzdata
+%patch -P42 -p1 -b .systzdata
%endif
-%patch43 -p1 -b .headers
+%patch -P43 -p1 -b .headers
sed -e 's/php-devel/%{?scl_prefix}php-devel/' -i scripts/phpize.in
%if 0%{?fedora} >= 18 || 0%{?rhel} >= 7
-%patch45 -p1 -b .ldap_r
+%patch -P45 -p1 -b .ldap_r
%endif
-%patch47 -p1 -b .phpinfo
-%patch48 -p1 -b .loadconf
-%patch49 -p1 -b .getallheaders
+%patch -P47 -p1 -b .phpinfo
+%patch -P48 -p1 -b .loadconf
+%patch -P49 -p1 -b .getallheaders
-%patch91 -p1 -b .remi-oci8
+%patch -P91 -p1 -b .remi-oci8
# upstream patches
# security patches
-%patch201 -p1 -b .bug78878
-%patch202 -p1 -b .bug78862
-%patch203 -p1 -b .bug78863
-%patch204 -p1 -b .bug78793
-%patch205 -p1 -b .bug78910
-%patch206 -p1 -b .bug79091
-%patch207 -p1 -b .bug79099
-%patch208 -p1 -b .bug79037
-%patch209 -p1 -b .bug77569
-%patch210 -p1 -b .bug79221
-%patch211 -p1 -b .bug79082
-%patch212 -p1 -b .bug79282
-%patch213 -p1 -b .bug79329
-%patch214 -p1 -b .bug79330
-%patch215 -p1 -b .bug79465
-%patch216 -p1 -b .bug78875
-%patch217 -p1 -b .bug78876
-%patch218 -p1 -b .bug79797
-%patch219 -p1 -b .bug79877
-%patch220 -p1 -b .bug79601
-%patch221 -p1 -b .bug79699
-%patch222 -p1 -b .bug77423
-%patch223 -p1 -b .bug80672
-%patch224 -p1 -b .bug80710
-%patch225 -p1 -b .bug81122
-%patch226 -p1 -b .bug76450
-%patch227 -p1 -b .bug81211
-%patch228 -p1 -b .bug81026
-%patch229 -p1 -b .bug79971
-%patch230 -p1 -b .bug81719
-%patch231 -p1 -b .bug81720
-%patch232 -p1 -b .bug81727
-%patch233 -p1 -b .bug81726
-%patch234 -p1 -b .bug81740
-%patch235 -p1 -b .bug81744
-%patch236 -p1 -b .bug81746
-%patch237 -p1 -b .cve0662
-%patch238 -p1 -b .ghsa-76gg-c692-v2mw
+%patch -P201 -p1 -b .bug78878
+%patch -P202 -p1 -b .bug78862
+%patch -P203 -p1 -b .bug78863
+%patch -P204 -p1 -b .bug78793
+%patch -P205 -p1 -b .bug78910
+%patch -P206 -p1 -b .bug79091
+%patch -P207 -p1 -b .bug79099
+%patch -P208 -p1 -b .bug79037
+%patch -P209 -p1 -b .bug77569
+%patch -P210 -p1 -b .bug79221
+%patch -P211 -p1 -b .bug79082
+%patch -P212 -p1 -b .bug79282
+%patch -P213 -p1 -b .bug79329
+%patch -P214 -p1 -b .bug79330
+%patch -P215 -p1 -b .bug79465
+%patch -P216 -p1 -b .bug78875
+%patch -P217 -p1 -b .bug78876
+%patch -P218 -p1 -b .bug79797
+%patch -P219 -p1 -b .bug79877
+%patch -P220 -p1 -b .bug79601
+%patch -P221 -p1 -b .bug79699
+%patch -P222 -p1 -b .bug77423
+%patch -P223 -p1 -b .bug80672
+%patch -P224 -p1 -b .bug80710
+%patch -P225 -p1 -b .bug81122
+%patch -P226 -p1 -b .bug76450
+%patch -P227 -p1 -b .bug81211
+%patch -P228 -p1 -b .bug81026
+%patch -P229 -p1 -b .bug79971
+%patch -P230 -p1 -b .bug81719
+%patch -P231 -p1 -b .bug81720
+%patch -P232 -p1 -b .bug81727
+%patch -P233 -p1 -b .bug81726
+%patch -P234 -p1 -b .bug81740
+%patch -P235 -p1 -b .bug81744
+%patch -P236 -p1 -b .bug81746
+%patch -P237 -p1 -b .cve0662
+%patch -P238 -p1 -b .cve3247
# Fixes for tests
-%patch300 -p1 -b .datetests
+%patch -P300 -p1 -b .datetests
%if %{with_libpcre}
if ! pkg-config libpcre --atleast-version 8.34 ; then
# Only apply when system libpcre < 8.34
-%patch301 -p1 -b .pcre834
+%patch -P301 -p1 -b .pcre834
fi
%endif
# New openssl certs
-%patch302 -p1 -b .renewcert
+%patch -P302 -p1 -b .renewcert
rm ext/openssl/tests/bug65538_003.phpt
# WIP patch
@@ -1960,10 +1960,14 @@ EOF
%changelog
+* Wed Jun 21 2023 Remi Collet <remi@remirepo.net> - 7.1.33-26
+- fix possible buffer overflow in date
+- define %%php71___phpize and %%php71___phpconfig
+
* Wed Jun 7 2023 Remi Collet <remi@remirepo.net> - 7.1.33-25
- Fix Missing error check and insufficient random bytes in HTTP Digest
authentication for SOAP
- GHSA-76gg-c692-v2mw
+ GHSA-76gg-c692-v2mw CVE-2023-3247
- use oracle client library version 21.10
* Tue Feb 14 2023 Remi Collet <remi@remirepo.net> - 7.1.33-24