From 5595ebceecf9b0712790b5c1bf8ce3915846b2bc Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Tue, 20 Dec 2022 08:08:48 +0100 Subject: pdo: fix #81740: PDO::quote() may return unquoted string CVE-2022-31631 use oracle client library version 21.8 --- php-bug81740.patch | 86 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ php.spec | 13 +++++++-- 2 files changed, 96 insertions(+), 3 deletions(-) create mode 100644 php-bug81740.patch diff --git a/php-bug81740.patch b/php-bug81740.patch new file mode 100644 index 0000000..557ad5b --- /dev/null +++ b/php-bug81740.patch @@ -0,0 +1,86 @@ +From b6caf64f9a0c0d9745962e37a57ba4dd32d6a712 Mon Sep 17 00:00:00 2001 +From: "Christoph M. Becker" +Date: Mon, 31 Oct 2022 17:20:23 +0100 +Subject: [PATCH 1/2] Fix #81740: PDO::quote() may return unquoted string + +`sqlite3_snprintf()` expects its first parameter to be `int`; we need +to avoid overflow. + +(cherry picked from commit 921b6813da3237a83e908998483f46ae3d8bacba) +(cherry picked from commit 7cb160efe19d3dfb8b92629805733ea186b55050) +--- + ext/pdo_sqlite/sqlite_driver.c | 3 +++ + ext/pdo_sqlite/tests/bug81740.phpt | 17 +++++++++++++++++ + 2 files changed, 20 insertions(+) + create mode 100644 ext/pdo_sqlite/tests/bug81740.phpt + +diff --git a/ext/pdo_sqlite/sqlite_driver.c b/ext/pdo_sqlite/sqlite_driver.c +index f9a2a4d04f..ac466f488e 100644 +--- a/ext/pdo_sqlite/sqlite_driver.c ++++ b/ext/pdo_sqlite/sqlite_driver.c +@@ -232,6 +232,9 @@ static char *pdo_sqlite_last_insert_id(pdo_dbh_t *dbh, const char *name, size_t + /* NB: doesn't handle binary strings... use prepared stmts for that */ + static int sqlite_handle_quoter(pdo_dbh_t *dbh, const char *unquoted, size_t unquotedlen, char **quoted, size_t *quotedlen, enum pdo_param_type paramtype ) + { ++ if (unquotedlen > (INT_MAX - 3) / 2) { ++ return 0; ++ } + *quoted = safe_emalloc(2, unquotedlen, 3); + sqlite3_snprintf(2*unquotedlen + 3, *quoted, "'%q'", unquoted); + *quotedlen = strlen(*quoted); +diff --git a/ext/pdo_sqlite/tests/bug81740.phpt b/ext/pdo_sqlite/tests/bug81740.phpt +new file mode 100644 +index 0000000000..99fb07c304 +--- /dev/null ++++ b/ext/pdo_sqlite/tests/bug81740.phpt +@@ -0,0 +1,17 @@ ++--TEST-- ++Bug #81740 (PDO::quote() may return unquoted string) ++--SKIPIF-- ++ ++--INI-- ++memory_limit=-1 ++--FILE-- ++quote($string)); ++?> ++--EXPECT-- ++bool(false) +-- +2.38.1 + +From dbfbd99e91701c0a5613133c06305fd70545e9ad Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Mon, 19 Dec 2022 09:24:02 +0100 +Subject: [PATCH 2/2] NEWS + +(cherry picked from commit 7328f3a0344806b846bd05657bdce96e47810bf0) +--- + NEWS | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/NEWS b/NEWS +index 7f30a1cd2e..6b05aa48fe 100644 +--- a/NEWS ++++ b/NEWS +@@ -1,6 +1,12 @@ + PHP NEWS + ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| + ++Backported from 8.0.27 ++ ++- PDO/SQLite: ++ . Fixed bug #81740 (PDO::quote() may return unquoted string). ++ (CVE-2022-31631) (cmb) ++ + Backported from 7.4.32 + + - Core: +-- +2.38.1 + diff --git a/php.spec b/php.spec index ca15884..1a961d1 100644 --- a/php.spec +++ b/php.spec @@ -55,7 +55,7 @@ %global mysql_sock %(mysql_config --socket 2>/dev/null || echo /var/lib/mysql/mysql.sock) -%global oraclever 21.7 +%global oraclever 21.8 %global oraclelib 21.1 # Build for LiteSpeed Web Server (LSAPI) @@ -126,7 +126,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: %{?scl_prefix}php Version: %{upver}%{?rcver:~%{rcver}} -Release: 22%{?dist} +Release: 23%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -223,6 +223,7 @@ Patch230: php-bug81719.patch Patch231: php-bug81720.patch Patch232: php-bug81727.patch Patch233: php-bug81726.patch +Patch234: php-bug81740.patch # Fixes for tests (300+) # Factory is droped from system tzdata @@ -987,6 +988,7 @@ sed -e 's/php-devel/%{?scl_prefix}php-devel/' -i scripts/phpize.in %patch231 -p1 -b .bug81720 %patch232 -p1 -b .bug81727 %patch233 -p1 -b .bug81726 +%patch234 -p1 -b .bug81740 # Fixes for tests %patch300 -p1 -b .datetests @@ -1766,7 +1768,7 @@ cat << EOF WARNING : PHP 7.1 have reached its "End of Life" in December 2019. Even, if this package includes some of - the important security fix, backported from 7.4, the + the important security fixes, backported from 8.0, the UPGRADE to a maintained version is very strongly RECOMMENDED. ===================================================================== @@ -1950,6 +1952,11 @@ EOF %changelog +* Mon Dec 19 2022 Remi Collet - 7.1.33-23 +- pdo: fix #81740: PDO::quote() may return unquoted string + CVE-2022-31631 +- use oracle client library version 21.8 + * Tue Sep 27 2022 Remi Collet - 7.1.33-22 - phar: fix #81726 DOS when using quine gzip file. CVE-2022-31628 - core: fix #81727 Don't mangle HTTP variable names that clash with ones -- cgit